Privacy Policy

1. Scope of this Policy

This Policy applies to personal data processed through the Service. It does not apply to the practices of third parties that we do not own or control, including the operators of the platforms through which the application is distributed and the third-party services identified in section 6, each of which processes personal data under its own privacy policy.

In this Policy, “personal data” means information relating to an identified or identifiable natural person. “Processing” means any operation performed on personal data, including collection, storage, use, disclosure and erasure. “You” means the individual to whom the personal data relates.

By creating an account you confirm that you have read this Policy. Where processing is stated below to rest on consent, that consent is requested separately and may be withdrawn as described in section 11.

2. Data controller

The controller responsible for the processing described in this Policy is the operator of TravelSpace. The controller's legal name, registered address and privacy contact details are set out in section 15. Where this Policy refers to “we”, “us” or “our”, it refers to that controller.

We have not appointed a Data Protection Officer, and are not required to do so on the basis of our current processing activities. Enquiries should be directed to the contact given in section 15.

3. Categories of personal data we collect

3.1 Account and profile data. When you create an account we collect your email address, your name, your username, your date of birth, and the home location you select together with its geographic coordinates. Each account is assigned an internal identifier to which all other records are associated. The following are optional and are collected only if you choose to provide them: a telephone number, a short biography, a profile photograph, and stated travel interests.

3.2 Photograph metadata and precise geolocation. With your permission, the application reads your device photograph library. The application only reads that library; it does not modify, move or delete any item within it. The processing operates on the metadata already embedded in each photograph, namely the capture timestamp and the recorded geographic coordinates. Those coordinates constitute precise geolocation data. Where a photograph is associated with a trip, its coordinates and timestamp are transmitted to and stored on our servers for two purposes: to restore the structure of that trip following a reset of local storage or a reinstallation of the application on the same device, and to make the contents of a shared trip available to the other participants of that trip. Those records identify each photograph by an identifier assigned by the operating system which has meaning only within the library it came from, and they do not constitute a transfer of your trips to a different device. Where you participate in a shared trip, the other participants of that trip may read the coordinates and capture times you contribute to it. Separately, with your permission, the application may read this device’s coarse location while it is in use, solely to identify a photograph already stored on the device that was taken near you on an earlier occasion. That reading is performed in memory on the device; the coordinate is not stored, is not transmitted to us, and is not used to compile a history of where you go.

3.3 Photographic content. The image content of a photograph is transmitted to us only in the following circumstances, each of which requires an affirmative act by you: where you publish the photograph to a location; where you add the photograph to the album of a trip; where you share a trip with friends and choose photographs as part of that share; where you designate it as your profile photograph; and where you attach a screenshot to a support report under section 3.6. Publication of a photograph to a location, and the photographs chosen when you share a trip with friends, are each limited to people you have accepted as friends. Where you then send a journal link, the photographs and city takes in that share are shown to anyone who has the link, including people who do not have an account. Taking the share down takes the page down. A photograph you add to the album of a trip is accessible to the other participants of that trip, whether or not you have accepted them as friends; removing it from the album deletes the stored file. Before a photograph is added to a trip album or published to a location, the application may analyse that photograph on the device using the operating system's Sensitive Content Analysis. After a photograph is saved to a journal, the device may also score that photograph for sharpness and exposure so an accidental frame is not used as a cover, a city strip, a list thumbnail, a widget face or a day of the journal. Those results remain on the device and are not transmitted to us. In all other cases the image content remains on your device, save that the application provides a facility by which you may share a summary image of a trip, which may include a cover photograph, through the sharing functions of your operating system; where you do so the recipient is determined by you and the image is not transmitted to us. Where you exclude a photograph from processing, the identifier assigned to that item by the operating system is retained so that the exclusion persists.

3.4 User-generated content. We process the content you create through the Service, including your trips and the stops within them, journal entries, published photographs, the sentences and place captions you choose when you share a trip with friends, saved and visited locations, reservations you have filed onto a trip, and your connections to and blocks of other users.

3.5 Contact data (hashed). Where you elect to use the contact-matching feature, telephone numbers in your device address book are converted on your device into SHA-256 hash values before any transmission occurs. Neither the telephone numbers themselves nor the associated names are transmitted to us. The hash values are compared against values derived from telephone numbers that other users have added to their own accounts, and are then discarded; no record of the submitted values is created. We do not maintain a copy of your address book. We draw your attention to the fact that hashing a telephone number does not render it anonymous: the range of possible telephone numbers is small enough that a determined party in possession of the application could derive the original number from its hash. This is the reason the submitted values are discarded rather than stored.

3.6 Diagnostic and support data. Where you submit a support report, that report may contain a screenshot of the screen then displayed, a log of the session, a description of the application state, an enumeration of the interface elements then on screen, the stage of processing that had been reached, your device model, your operating system version and the application version. Where the application has terminated unexpectedly, become unresponsive, or exceeded a processing-time or disk-writing threshold set by the operating system, the diagnostic report generated by that system is transmitted. Two mitigations apply. First, the session log, the description of application state, the enumeration of interface elements and the operating system diagnostic report are each filtered to remove email addresses, authentication tokens and application programming interface keys; that filter is not applied to free text you type into a report yourself, which is transmitted as you wrote it. Second, the enumeration of interface elements records the label of an element only where that label matches a fixed list of application chrome, so that content you have authored, such as the title of a trip or the name of a location, is not carried within it. Screenshots are not subject to that filtering, as it cannot be applied to image data; accordingly, a screenshot is included only in a report you have submitted yourself, and a report generated automatically following an unexpected termination contains no screenshot.

3.7 Device and technical data. Where you enable notifications, the operating system issues a device token which is stored in association with your account for the purpose of delivering those notifications. That token is the only device identifier we store. The application contains no advertising identifier.

3.8 Product interaction data. While you remain signed in, the application transmits enumerated records of which screens were opened, which named controls were used, and whether a closed list of outcomes occurred (for example that a scan finished, or that a subscription succeeded). Those records do not include the title of a trip, the text of a note, geographic coordinates, a search query, an email address, or the name of the device. They are stored on our servers and are not disclosed to a third-party analytics or advertising service.

3.9 Reservation mail. Where you forward a booking confirmation to the address we give you, we receive that message. We extract a title, dates and, where present, a confirmation number, and we hold a short excerpt of the message for thirty days or until you file or discard the reservation, whichever is sooner. Filing copies the title and dates onto a trip you can edit. The confirmation number and the excerpt are not copied onto the trip. Other participants of that trip see the title and the day. A message we cannot read is held as a failed reservation until you discard it.

3.10 Booking search. A tap on a stay, activity or table search opens Booking.com, GetYourGuide or OpenTable in your browser, carrying the city named on that screen and, where the trip already has them, the dates and the number of people. We do not receive the result of that search or of any booking you complete there. Those sites receive the query as independent controllers.

We do not knowingly collect special categories of personal data within the meaning of Article 9 of the General Data Protection Regulation, and we do not request such data.

4. Sources of personal data

Personal data is obtained from the following sources: directly from you, where you provide it in the course of registration or use; from your device, where you have granted the relevant operating system permission; and from other users, where they publish content to a shared trip on which you are a participant or otherwise interact with your account.

5. Purposes of processing and legal bases

Where the General Data Protection Regulation or the United Kingdom General Data Protection Regulation applies, we rely on the following legal bases.

• Performance of a contract (Article 6(1)(b)): creating and administering your account, authenticating you, generating and storing your trips, synchronising your content between your devices, operating shared trips, and providing support.
• Consent (Article 6(1)(a)): access to your photograph library, access to your device address book for the purposes of contact matching, and the delivery of push notifications. Each of these is requested through a separate operating system permission and may be withdrawn at any time through your device settings.
• Legitimate interests (Article 6(1)(f)): maintaining the security and integrity of the Service, preventing and investigating abuse, diagnosing defects, and verifying a telephone number you have chosen to provide, and understanding where in the application people stop so that we can keep it functioning. Our legitimate interest in each case is the reliable and secure operation of the Service, which we consider not to be overridden by your interests or fundamental rights, having regard to the mitigations described in sections 3.6, 3.8 and 10.
• Compliance with a legal obligation (Article 6(1)(c)): responding to valid requests from public authorities and complying with obligations to which we are subject.

We do not process personal data for advertising purposes, and we do not carry out advertising profiling. Trip detection involves the automated analysis of photograph metadata, which is performed on your device; it does not constitute a decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22.

6. Disclosure of personal data

We do not sell personal data and we do not disclose personal data to data brokers. Personal data is disclosed only as set out below.

6.1 To other users. A photograph you publish to a location is displayed to other users viewing that location; no other element of the associated trip is published with it, and withdrawing publication removes both the stored file and the corresponding record. A trip you share is accessible to the participants of that trip, whose own photographs and journal entries are stored within the same trip. The extent to which your remaining activity is visible to your connections is determined by settings within the application, which are enforced on our servers rather than by the requesting client.

6.2 To processors and service providers. We engage the following third parties, each of which processes personal data on our behalf or, where indicated, as an independent controller:

• Supabase — hosting of the database, file storage and authentication infrastructure, and transmission of transactional electronic mail including account confirmation and password recovery messages. Acting as a processor.
• Google — provision of mapping, location names and location photographs through the Google Maps and Google Places services. Text you enter to search for a location, and coordinates submitted for resolution into a location name, are transmitted to Google. In addition, the Google Maps software development kit incorporated in the application collects, for Google's own analytics purposes, crash data, performance data, product interaction data and a device identifier linked to the user. That collection is declared in the privacy manifest supplied by Google with that development kit, is carried out by Google as an independent controller, is governed by Google's privacy policy, and is not received by us.
• Apple — delivery of push notifications through the Apple Push Notification service. Diagnostic reports concerning unexpected termination are generated by the operating system on your device.
• Twilio — transmission of the text message by which a telephone number is verified, in its capacity as the messaging provider used by Supabase. Twilio receives the telephone number for the purpose of delivering that message.
• Resend — receipt of inbound electronic mail at mail.travelspaceapp.com, used only for the reservation inbox described in section 3.9. Acting as a processor.
• Anthropic — classifying support reports described in section 3.6. Those reports do not include a screenshot of your photographs. Acting as a processor. Reservation mail is parsed on our own servers and is not sent to Anthropic.
• Fly.io — hosting of an internal reporting tool that our staff use to query the first-party analytics described in section 13. It reads those records under a pseudonymous key, without an email address, name, username or contact details. Acting as a processor.
• Overture Maps Foundation — a catalog of venue names we store and display under a photograph. That catalog is published under the Community Data License Agreement — Permissive, Version 2.0, and contains names originating in part under the Apache License, Version 2.0. Coordinates of a photograph may be compared against that catalog on our servers. Those names are not obtained from Google Places.
• Booking.com, GetYourGuide and OpenTable — the city, and the dates and party size where present, when you tap a search row described in section 3.10. We do not receive the result. Acting as independent controllers of the pages they show you.

6.3 Legal and corporate disclosures. We may disclose personal data where required to do so by law, where necessary to respond to a valid request from a public authority, or where necessary to establish, exercise or defend legal claims. In the event of a merger, acquisition or transfer of assets, personal data may be transferred as part of that transaction, subject to the continued application of this Policy or a successor policy affording equivalent protection.

7. International transfers

The third parties identified in section 6 operate infrastructure in multiple jurisdictions, and personal data may accordingly be transferred to and processed in countries other than your country of residence, including the United States. Where personal data is transferred out of the European Economic Area or the United Kingdom, that transfer is made on the basis of an adequacy decision of the European Commission or, in its absence, standard contractual clauses adopted by the European Commission, together with such supplementary measures as are appropriate.

You may request further information about the transfer mechanisms applicable to a particular recipient by contacting us as set out in section 15.

8. Deletion of your account

You may delete your account at any time from within the application, under Settings in the You tab. Deletion removes your profile, your journal entries, the photographs you have published, your profile photograph, your saved locations, your connections, your blocks, your invitations, your notification token, your support reports and your authentication credentials. A trip of which no other participant remains an active member is deleted with the account. A trip of which one or more other participants remain active members is not deleted: control of that trip passes to the remaining participant who joined it earliest, who may keep it or delete it. The dates recorded for a trip are not altered by that transfer of control, and whether the trip is treated as past or forthcoming continues to be determined solely by those dates. Journal entries and photographs contributed by other participants are not erased on your instruction. Server-side records are removed first, followed by the copy held on your device. Deletion cannot be reversed.

The application attempts, at the time of deletion, to remove the files underlying your published photographs and your profile photograph. That attempt is not a condition of deletion completing. Where the attempt does not succeed, or where the account is deleted by us rather than from the application, those files are identified as having no remaining owner and are designed to be removed by a scheduled server-side process. Photographs held in your device library are unaffected, as they are not transmitted to or held by us.

9. Retention periods

Account, profile and user-generated content is retained for as long as your account remains open, and is erased on deletion of that account in accordance with section 8.

Where the application is used before an account has been created, the trips it finds are held under a temporary account with no email address, name or other identifier of yours. A temporary account that has not been saved to a sign-in, and has not been used for thirty days, is erased in full, in accordance with section 8, by a scheduled process within the database that runs nightly. The trips and photographs on your device are not affected.

Support and diagnostic reports described in section 3.6 are subject to two retention periods. Each is enforced by a scheduled process within the database itself, which runs nightly, rather than by the application or by any act of ours. Erasure accordingly takes effect on the first scheduled run following the expiry of the relevant period rather than at the instant of expiry, and each run is bounded, such that any accumulated backlog is worked through over successive runs.

The evidence attached to a report is erased once ninety days have elapsed since the report was submitted. That comprises any screenshot you attached, the session log, the diagnostic report generated by the operating system, the enumeration of interface elements, the record of a photograph scan and the description of application state.

The report record itself is deleted once three hundred and sixty-five days have elapsed since submission. That comprises the text you wrote, the severity, the screen the report was filed against and the values by which recurrences of the same defect are grouped together.

Deletion of your account erases any report of yours that neither period has yet reached, as provided in section 8.

Product interaction records described in section 3.8 are erased once one year has elapsed since they were written. That erasure is likewise enforced by a scheduled process within the database. The fact that you were enrolled as a new user is retained with the account and is erased on deletion of that account.

Hash values submitted for contact matching are not retained, as described in section 3.5. Records necessary for the establishment, exercise or defence of legal claims, or for compliance with a legal obligation, may be retained for the period required for that purpose.

10. Security of processing

We implement technical and organisational measures appropriate to the risk presented by the processing. Every database table containing user data is subject to row-level security, such that the database, rather than the requesting client, determines which records a given request may reach.

Your email address, your telephone number, the hash values derived from that number and your date of birth are not readable by other accounts. That restriction is imposed at the database level through column-level privileges, and does not depend on the correct behaviour of the application requesting the data.

The storage location holding published photographs is private, and each read from it is subject to an authorisation check which fails where the request carries no authenticated session. The storage location holding profile photographs is, by contrast, a public one: an object within it may be retrieved by any party able to construct its address, which is derived from the account identifier, without an authenticated session. That is a deliberate decision, taken because time-limited addresses expire and cannot be cached durably on the device, and it means that a profile photograph should be regarded as accessible to any person who obtains or derives its address. Data in transit is encrypted using transport layer security.

No method of transmission or storage is entirely secure, and we do not warrant absolute security. Where a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, within the periods prescribed by applicable law.

11. Your rights

Subject to the conditions and exceptions provided by applicable law, you have the following rights in respect of your personal data:

• Access — to obtain confirmation as to whether we process your personal data and, if so, a copy of it.
• Rectification — to have inaccurate personal data corrected and incomplete personal data completed. Profile data may be corrected directly within the application.
• Erasure — to have your personal data erased. This right may be exercised directly through the deletion function described in section 8, subject to the exceptions stated there.
• Restriction of processing — to require that processing be restricted in the circumstances provided by law.
• Objection — to object to processing carried out on the basis of our legitimate interests.
• Portability — to receive personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Withdrawal of consent — to withdraw consent at any time where processing is founded on consent, without affecting the lawfulness of processing carried out before withdrawal. Permissions relating to your photograph library, your address book and notifications may be withdrawn in your device settings.
• Complaint — to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

Access and portability are served by an export you can run yourself: Settings → Export my data produces a file of your profile, your trips and their stops, your notes, ideas and lists, and the identifiers of the photographs held on your device. The photographs themselves are not included; they are already in your photo library. Rights other than erasure, rectification and portability are exercised by written request to the contact given in section 15, and such requests are fulfilled manually. We will respond without undue delay and within the period required by applicable law. We may request information reasonably necessary to verify your identity before acting on a request, and may decline a request to the extent permitted by law, in which case we will state our reasons.

12. Notice to residents of California

This section supplements the foregoing and is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

Categories collected. In the twelve months preceding the effective date of this Policy, we have collected the following categories of personal information: identifiers, including name, electronic mail address, telephone number and account identifier; internet or other electronic network activity information, in the form of the diagnostic and support data described in section 3.6 and the product interaction data described in section 3.8; geolocation data, including precise geolocation derived from photograph metadata; audio, electronic, visual or similar information, in the form of photographs you publish; and other information you provide, including date of birth and stated travel interests. The categories of sources, the purposes of collection and the categories of recipients are as described in sections 4, 5 and 6 respectively.

Sensitive personal information. Precise geolocation constitutes sensitive personal information. We process it solely for the purpose of providing the Service, namely the identification and presentation of your trips. We do not use or disclose it for the purpose of inferring characteristics about you.

No sale or sharing. We do not sell personal information, and we do not share personal information for the purposes of cross-context behavioural advertising. We have not done so in the twelve months preceding the effective date of this Policy. We do not knowingly sell or share the personal information of consumers under sixteen years of age.

Rights. You have the right to know, to delete, and to correct personal information; the right to limit the use and disclosure of sensitive personal information; and the right not to receive discriminatory treatment for exercising any of these rights. These rights may be exercised as described in section 11. An authorised agent may submit a request on your behalf on provision of evidence of authority.

13. Advertising and tracking

The Service contains no advertising and no advertising network. We do not track you across applications or websites owned by other companies, and the privacy manifest accompanying the application declares no tracking and lists no tracking domains. The collection carried out by Google described in section 6.2 is not conducted for our purposes and is not received by us.

We operate first-party analytics for the functioning of the application: which screens are opened, which named controls are used, and whether enumerated outcomes such as a completed scan or a subscription occur. Those records are stored on our own servers for one year and are not used for advertising. They are not sent to a third-party analytics or advertising service and do not involve a tracking domain. Collection continues while you remain signed in. You may ask us to stop it by writing to the address in section 15, or by deleting your account. From time to time the application also asks two short optional questions — how disappointed you would be without it, and whether you would recommend it — and stores the closed answer and any sentence you add until the account is deleted. Incident diagnostics (a report a person files, or a crash delivered by the operating system) are a separate disclosure, described in section 3.6, and are not analytics. Public pages on this site — a journal someone has shared, an invitation, and the landing page — record a daily count of views: which page, the referring site's host when it is on a short allow list, and an optional campaign code from the link. Those counts do not include a cookie, an IP address, an account, or which journal or invitation was opened. A new install may also record whether it came from Apple Search Ads or arrived on its own, and the Search Ads campaign and ad-group numbers when Apple provides them. The token used to ask Apple is discarded and is not stored. No advertising identifier is collected.

14. Children

The Service is not directed to children and is not intended for them. Registration requires a date of birth, and an account cannot be completed where the date given indicates an age below seventeen years. That threshold is applied uniformly in every territory in which the Service is offered.

Seventeen years is not a figure required by data protection law. Article 8(1) of the General Data Protection Regulation permits each Member State to set, at between thirteen and sixteen years, the age below which the consent of the holder of parental responsibility is required for an information society service. The threshold applied here is above the highest of those figures, with the consequence that the parental consent condition in Article 8 does not arise in any Member State. The figure corresponds to the age rating under which the application is distributed.

Until the effective date of this Policy the threshold was thirteen years. An account registered under that rule may therefore belong to a person aged between thirteen and sixteen who registered legitimately at the time. Such accounts continue in existence, are not suspended and are not closed by reason of the change, and no age condition is applied to an account once it has been created. The higher threshold governs registrations made on and after the effective date.

No account has been registered on a date of birth indicating an age below thirteen years. We do not knowingly collect personal data from a person below the threshold in force at the time of registration, and where we become aware that such data has been collected we will erase it. A parent or guardian who believes that a child has provided personal data to us should contact us as set out in section 15.

15. Contact

Requests concerning your personal data, and enquiries concerning this Policy, should be addressed to info@doublethr33s.com. Requests under sections 7, 11 and 12 should be directed to that address.

The controller of the personal data described in this Policy is Double Thr33s, LLC, a limited liability company formed in the State of New York, whose registered address is 418 Broadway, Ste R, Albany, NY 12207, United States.

16. Amendments to this Policy

We may amend this Policy from time to time. The effective date at the head of this document records the date of the current version. Where an amendment materially affects the processing of your personal data, we will provide notice by a means appropriate to the circumstances, which may include notice within the application or by electronic mail to the address associated with your account, before the amendment takes effect. Continued use of the Service following the effective date of an amendment constitutes acknowledgement of the amended Policy.