Who is responsible
Niclas Heussinger is responsible for the processing of personal information by Departures (the “controller”). In this policy, “we”, “us” and “our” refer to Niclas Heussinger.
For privacy questions or requests, email privacy@noclue.vc.
Information we handle
- Account information: your name, email address, account identifier, email-verification status and authentication records. Passwords are stored as hashes, not readable passwords. If Sign in with Apple is available and you choose it, we receive the account information Apple provides and authentication identifiers or tokens needed for sign-in.
- Travel preferences: the departure airports, interests, pace, preferred trip length, budget, travel party and other preferences you provide, plus ideas you save or hide. These help us suggest trips.
- Trips, documents and journals: destinations, dates, budgets, itinerary items, booking references, reservation links, costs, notes, checklist tasks and assignments, journal entries and photos you add. The document wallet also stores original PDF and image files, their filenames, file details and any booking association you choose. This can include information about your travel companions if you enter it or include it in a file.
- Plus purchases and trip watches: your account identifier, name, email address, email-verification status, preferred currency, device language preference, purchased product and transaction and entitlement status. For trip watches, we also handle the dates, airports, party size, budget and preferences in briefs you save. We store matching quote summaries and alert delivery status.
- Safety reports: your report reason and details, the selected trip, invitation, journal excerpt or photo reference, account IDs, block choices and review decisions. These are used to investigate abuse and protect companions.
- Sharing information: invitations, invitee email addresses, membership and editing permissions. We also receive information about you when another user invites you to a trip.
- Technical information: session records, IP addresses and user-agent information used for authentication, security and abuse prevention. Our hosting providers may process request metadata and operational logs. If you enable notifications, we store the Apple push token, delivery environment and associated account/session records.
- Support messages: your email address, message and any information you choose to send when contacting us.
Departures does not request continuous or background location access. Airport and destination searches use the text you enter. The photo picker lets you choose individual images. Uploaded journal photos are re-encoded and their embedded EXIF/GPS metadata is removed; what is visibly shown remains part of the image. Document-wallet uploads preserve the original file, including embedded metadata such as location or author information. Review the whole file before adding it to a shared trip.
Why we use it
We use account and travel information to authenticate you, save and sync your plans, personalise discovery, share trips, display journals and deliver account emails or requested notifications. We use technical information to keep the service reliable, prevent abuse and investigate problems. Support information helps us respond to your requests. We use RevenueCat account details to find the correct customer and resolve purchase issues. We use account identifiers, purchase history, language and currency to understand subscription conversion, renewals and cancellations across customer groups and improve Plus. Names, email addresses and email-verification status are used for account support, not marketing messages.
Where the GDPR applies, our legal bases are performance of the service you request (Article 6(1)(b)); our legitimate interests in security, reliability, preventing abuse, answering enquiries and understanding and improving subscription performance (Article 6(1)(f)); consent where required for optional processing (Article 6(1)(a)); and compliance with applicable legal obligations (Article 6(1)(c)). You can withdraw consent for optional processing without affecting the lawfulness of earlier processing.
Account details are needed for account-backed features. Other content is optional, although a feature may need the information you provide to perform its function. Discovery ranks ideas using preferences and saved or hidden choices; it does not make decisions with legal or similarly significant effects about you.
Safety and content review
Automated text rules help identify prohibited content, and reports are reviewed by the Departures operator. Shared journal photos are hidden until you choose to view them. When enabled by your iOS settings, Apple’s Sensitive Content Analysis checks incoming journal photos on your device. Its classification stays on your device and is never sent with a report or upload. Wallet documents open in the system document preview when you select them; they do not receive the journal-photo sensitive-content check.
Abuse-review alerts sent through Resend contain report references rather than report details or photos. We retain reports for up to 90 days after review, and no longer than 180 days from submission under the ordinary retention process. Deleting an account removes its direct account links from reports; limited report evidence may remain during this period for abuse prevention.
Services that help Departures work
We use the following services for the functions described. We do not send your full trip journal to search or flight providers.
- Railway: hosts the API, database and private journal-photo and document storage. Railway processes the data stored with the service and technical request information. See its privacy policy and data processing terms.
- Resend: delivers verification and password-reset emails and processes recipients, message content and delivery information. See its privacy policy and data processing terms.
- Apple: provides App Store purchases and subscription management, MapKit destination search, push delivery and, where enabled, Sign in with Apple. MapKit processes destination-search queries; push delivery uses device tokens and notification content. See Apple’s privacy information.
- CityAPI: receives airport-search text in anonymous requests from the device. These requests do not include your Departures account token, but the provider can receive your IP address and connection metadata.
- FlightAware: when you request an available flight lookup, the backend sends the flight number and date to obtain flight or schedule information. The lookup does not send your account identity, booking reference or journal.
- Apple Weather: when you request warm-weather trip matches, our server sends destination coordinates and the destination time zone to Apple WeatherKit to check daily forecasts. When you enable the rain check while planning a day, it sends your selected starting-place coordinates, trip time zone and selected hours to retrieve an hourly forecast. Better for the Weather checks the coordinates and scheduled hours of the outdoor activities you select. Google Maps provides venue locations, opening hours and walking routes for alternative plans. We do not send your name, email, saved interests or device location for these checks. See Apple’s privacy policy.
- Google Maps: when you use outing suggestions or Plus day planning, Google receives your starting-point searches, selected coordinates and the locations needed to check a walking route, including the next appointment’s address where relevant. It supplies places, opening hours and routes. Opening a route or place link also connects your device to Google. See Google’s privacy policy.
- OpenAI: when you request an outing, the backend sends your travel interests, preferred pace, selected starting coordinates, available time, saved and scheduled activity place names, and nearby candidate places to choose a suitable outing. That outing request does not send your account name or email, booking references, journal or photos. For booking imports, PDFs and images are first read on your device. Only when you tap Extract do we send the reviewed confirmation text and destination time zone to OpenAI; that text may contain booking references or other personal details you have left in it. You can remove unnecessary information before extraction. The original file is not sent to OpenAI for extraction. If you keep the original in the document wallet when saving the booking, the app uploads that file separately to Departures. Removing details from the extracted text does not remove them from the original shared file. We request that the API response is not stored as a retrievable response; provider retention remains subject to its account settings and terms. See OpenAI’s privacy policy. Outing and booking-extraction requests are optional and do not run in the background. The extraction response is presented for your review before any booking is added.
- RevenueCat: receives your Departures account identifier, name, email address (including an Apple private relay address if you use one), email-verification status, preferred currency and device language preference when the signed-in app connects to our billing service, including for accounts without a paid subscription. It also receives purchase/transaction and SDK connection information. We use these records to verify and manage Plus access, provide purchase support and analyse subscription performance by language and currency. The app refreshes these details when they change; existing users begin sharing the additional account details when they use an app version with this integration. We do not send trip itineraries, booking documents, journals, photos, passwords or authentication tokens as RevenueCat customer attributes. Apple handles the payment; Departures does not receive your card details. RevenueCat customer and transaction records are separate from your trip database. See its data processing terms. See RevenueCat’s privacy policy.
- Duffel: when live flight search or trip-price matching is enabled, receives departure/destination airports, dates and the number/type of travelers. Accommodation searches run only when separately enabled and use destination coordinates, check-in and check-out dates, room requirements and the number/type of guests. Otherwise, search results identify the missing accommodation price. We do not send passenger names, account email, existing booking references, journals or photos for these searches. Active watches can repeat their supported searches until paused, expired, deleted or membership ends. Saved interests, pace, party, season and discovery style guide destination selection.
- Wikimedia: supplies destination photographs and attribution. The backend requests destination-image metadata; loading a remote image on your device can disclose its IP address and request information to the image host.
Travel-provider and other external links open services with their own privacy policies. Bookings and payments are handled by those providers; Departures does not process card payments.
We may also disclose information where required by law or necessary to protect legal rights or the security of the service. Providers processing information on our behalf are expected to use it for the relevant service and protect it under applicable data-processing terms.
Processing across borders
Service providers may process information outside your country, including in the United States. Railway and Resend describe their international-transfer arrangements, including applicable standard contractual clauses, in the data-processing terms linked above. Apple and other services describe their practices in their own privacy information. Contact us for information about the safeguards relevant to your data or to request a copy of applicable transfer safeguards.
Retention and deletion
We keep account information and saved travel content while your account exists and the information is needed to provide the service. You can edit or remove your trip content in the app. Use Profile → Delete account to request deletion of your account, or contact us about personal information you cannot remove yourself.
- Account deletion: removes your account, sessions, profile, preferences, invitations, notification-device registrations and trips you own. Owned trips are removed for their other members too.
- Trips owned by someone else: you leave those trips. Their shared text, plans and checklist tasks remain with the trip owner; checklist assignments to your account are cleared. Journal photos and wallet documents uploaded by you are removed. Contact us if remaining shared content contains your personal information and you want it reviewed or erased.
- Plus records: deleting a watch deletes its stored matches; matches otherwise expire from our database after seven days. Account deletion removes your saved watches. Apple and RevenueCat may retain transaction records under their own service and legal requirements; contact us for help with related data requests. Deleting a Departures account does not cancel an Apple subscription: manage cancellation in your Apple account.
- Photos and original documents: deleting an item removes access through the service. Storage deletion is queued and retried if storage is temporarily unavailable. Unattached photo uploads and unfinished document uploads become eligible for cleanup after 24 hours, so physical removal is not always immediate. Removing an offline download only removes the device copy; deleting the original from the wallet removes it for the trip’s other members too.
- Short-lived records: sessions expire after seven days unless renewed through use; verification links expire after one hour and reset links after 30 minutes. Expired verification records become eligible for cleanup one day after expiry. Authentication-email queue records and completed notification queue records become eligible for cleanup after 14 days. Expiry of a credential does not mean every related operational record is immediately erased.
- Operational records: logs, security records and any provider-managed backups may remain for the period needed for security, troubleshooting, recovery or applicable legal obligations. Retention depends on the record’s purpose and the provider’s configuration and terms; these records are not used to recreate an active account for ordinary use after deletion.
Information on your device
Authentication credentials are stored in the iOS Keychain. The app stores preferences and previously synced trip snapshots locally, and caches opened journal photos for offline reading. These copies are scoped to your account. Successful sign-out or account deletion clears the app’s local trip and photo copies for that service. Offline access is limited by the last verified session expiry, and disconnected copies are reconciled when the app reconnects.
Wallet previews use temporary device copies. Choosing to keep a document offline saves a separate download for that account and service. Wallet files and local drafts use iOS file protection and are excluded from device backups. The app clears these copies on sign-out, account deletion or an account change; if the device cannot complete cleanup, access remains blocked until cleanup succeeds. Refreshed trip and document lists remove local wallet copies for lost access or deleted originals. Devices that remain offline cannot receive these changes.
Journal drafts, including selected photos, can be saved locally while you write. Unsubmitted drafts stay on your device. Entries you choose to save or share are queued for upload and retried when the running app reconnects. If access to the trip is lost, personal journal drafts remain available locally for you to review or export, but are not uploaded without current trip access. Edited travel-book titles, chapters and selections are saved locally; those edits do not change the original journal. Local drafts are removed on sign-out, account deletion or an account change.
The optional Today widget reads a limited snapshot shared locally with the widget extension: the destination, upcoming plan titles, place names, times, time zone and links back to the trip. It does not receive authentication credentials, document files or journal contents. Widget information can appear on your Home Screen or Lock Screen, subject to your iOS privacy settings. To support widget updates, its protected snapshot remains readable after the device’s first unlock. Snapshots expire within 24 hours or at the last verified session expiry, whichever comes first. The app clears the snapshot and requests a widget refresh when you sign out; iOS controls when the displayed widget refreshes.
Downloaded Editions and shared booking confirmations are stored on the device for the signed-in account. Shared confirmations expire from the app inbox after 24 hours and are removed on sign-out; they are not uploaded by the share extension. Travel books are rendered on your device using the journal content and selected photos. Copies you export through the share sheet are controlled by the destination you choose and are not removed when you sign out.
This privacy page uses no cookies, analytics, scripts or third-party fonts. Loading it still sends ordinary connection information to the hosting infrastructure.
RevenueCat account details
Signing out stops the app from updating your RevenueCat account details; it does not delete the existing RevenueCat record. In-app account deletion removes your Departures data but does not automatically delete RevenueCat customer attributes or cancel an Apple subscription. Contact privacy@noclue.vc to request correction or deletion of RevenueCat-held account details or to object to subscription analytics. We review provider-held records separately and retain information only where needed for ongoing subscription administration or applicable legal obligations.
Your choices and rights
You can change travel preferences, edit or remove content, manage trip members if you created the trip, and delete your account in Departures. You can turn off notifications in iOS Settings and choose which photos to share through the system photo picker. Withdrawing access does not by itself delete information you already uploaded; remove it in the app or contact us.
Depending on applicable law, you may have rights to access, correct, erase, restrict processing of, or receive a portable copy of your personal information. You may object to processing based on legitimate interests and withdraw consent where processing relies on it. Email privacy@noclue.vc to make a request. We may need to verify your identity before acting.
If the GDPR applies, you can complain to a data-protection supervisory authority, including the authority where you live, work or believe an infringement occurred.
Changes to this policy
We will update this page when our practices change and show the new date above. Where required, we will provide additional notice or seek consent before introducing materially different processing.