TrovaloLegal
Privacy Policy
Trovalo is a trip planner you share with the people you travel with. This is what it keeps, who can see it, and how to get rid of it.
The short version
In one paragraph
Trovalo keeps your account (an internal ID, your email and the name you go by) and what you and your tripmates put into your trips. Everything in a trip is visible to the people in that trip - that's the point - and nothing to anyone else. Your travel documents are visible to you alone. Anonymous usage counts help improve the app. Nothing is sold, and you can delete your account from inside the app.
What Trovalo never does
No ads
Trovalo shows no ads, and doesn't track you across other companies' apps and websites.
No location history
Trovalo doesn't track your location or keep a location history.
Nothing sold
Your information isn't sold or rented, and what you put into trips is never used for advertising.
Only what you pick
Trovalo doesn't read your contacts, calendar or photo library - only the photos you choose to add.
Your account
Signing in
You sign in with Apple, with Google (on Android) or with your email address. Trovalo stores an internal account ID and an email address: the one Apple or Google provides (Apple's may be its private relay address if you chose "Hide My Email"), or the one you typed. Signing in by email sends a one-time code to that address; it's used for nothing else - no newsletters, no marketing.
Your name
The name you go by - from Apple or Google if you let them share it, or the one you typed - is what people in your trips see. You can change the name you use in each trip.
What's in your trips
What a trip holds
What its members put into it: the trip's name, destination, dates and currency; the people in it, including guests - people without the app, added by name only; invite links; checklists and packing lists; polls and votes; ideas, with any links and places; bookings, with confirmation codes and attached files such as tickets; the itinerary, with places on a map; photos; comments and the trip's activity feed; expenses, who paid, how they're split, payments back and the budget; and ratings and notes about the stops.
Who sees it
Everyone in that trip, and nobody else. What each person can change depends on their role (organizer, editor or viewer). The server enforces this for every request - the app can't show you a trip you're not in.
Photos
When you add photos, the app resizes them on your phone and removes their location and camera details before uploading. It reads a photo's location first, on your phone, only to file it under the nearest stop of the day; the location itself is never uploaded. (Android's photo picker usually removes the location before the app sees it.) Photos are stored privately and shown to trip members through links that expire within an hour.
Payment usernames
If you add your Venmo, PayPal.me or Revolut username so people can pay you back, everyone you share a trip with can see it. Trovalo never sees or handles payments - "Pay" just opens the other app.
Your travel documents
Yours alone
The document vault keeps details of your passport, visas, licence and insurance - numbers, expiry dates and any scans you add. They're tied to your account and visible to you alone, not to anyone in any trip, and the app asks for Face ID, your fingerprint or your passcode or screen lock each time you open them. Scans are stored privately.
Notifications
Push notifications
If you allow notifications, Trovalo stores your phone's push token (an identifier Apple gives the app, or on Android, Google's Firebase Cloud Messaging), whether it's a test or live build, which kinds of notification you turned off and which trips you muted. It's used only to tell you about your trips. It's removed when you sign out on that phone, when Apple or Google says it no longer works, and with your account.
What a notification says
The trip's name, who did what, and the start of a comment, sent through Apple's push service, or Google's on Android. Trovalo keeps no copy of it.
Reminders
Countdowns, tasks that are due, trip mornings and settling up are scheduled by your phone from what it already has. Nothing about them is sent to a server.
Purchases
Trip Seats and Trovalo Plus
Bought through Apple's App Store or Google Play. Trovalo checks each purchase with the store and keeps a record of it - the transaction identifier (on Google Play, the purchase token), the product and, for Plus, when it renews or ends - so your access follows your account, on any device. Trovalo never sees your payment details.
Anonymous usage analytics
TelemetryDeck
To learn which features are used, the app sends anonymous signals to TelemetryDeck - for example "a trip was created" or "an expense was added", with the app version and device type. No names, emails, trip contents, places or amounts are ever included, and TelemetryDeck replaces the device's identifier with an anonymous, double-hashed one, so signals can't be traced back to you.
On your device
An offline copy
Of your trips, kept in the app's caches so it works without a connection and left out of backups. On iPhone and iPad it's encrypted by iOS until you first unlock your device after a restart; on Android it's in storage only Trovalo can open, encrypted by Android. It's deleted when you sign out or delete your account.
Changes waiting to sync
Made while offline. They stay inside the app, are left out of device backups (iCloud, your computer or Google), are sent only to Trovalo's server, and are deleted once they're sent - or when you sign out (the app warns you first).
Widgets, the Live Activity and shortcuts
They read a short summary - your trips' names, dates, checklist progress and the day's plan - kept in a space only Trovalo and its widgets can open. On Android, your trips' names also appear as shortcuts on the app's icon. Both are cleared when you sign out.
The camera
Used to scan invite QR codes and receipts. Receipts are read on your phone (on Android, by Google's ML Kit, which also runs on the phone); the photo isn't kept or uploaded, only the amount, merchant and date you choose to save.
Send to Dawnlet
On iPhone and iPad, if you send a trip to Dawnlet, its places and your share of its costs are written to a space on your phone that only Trovalo and Dawnlet can open, protected so it can't be read while your phone is locked. Dawnlet shows you what's in it, adds what you choose to your Dawnlet account, and deletes it; Trovalo deletes anything left after a day. Nothing goes through a server.
Services Trovalo relies on
Supabase
Trovalo's database, file storage and sign-in, in the United States. It stores everything described here on Trovalo's behalf.
Apple
Sign in with Apple, App Store purchases, and on iPhone and iPad, push notifications, maps and place search; weather on every device (on Android, Trovalo's server asks Apple for the forecast). It receives what's needed for sign-in and purchases, the notifications sent to your phone, the place names you search, and a trip's destination (to show maps, travel times and the forecast) - not tied to your Apple ID by Trovalo.
On Android: Sign in with Google, Google Play purchases, push notifications (Firebase Cloud Messaging), and maps, place search and travel times (Google Maps Platform). It receives what's needed for sign-in and purchases, the notifications sent to your phone, the place names you search and the places a trip's map and travel times need - not tied to your Google account by Trovalo. Receipts and QR codes are read on your phone by Google's ML Kit and Play services, without sending the image.
TelemetryDeck
Anonymous usage signals (see Anonymous usage analytics). It receives no personal information.
Resend
Sends sign-in codes by email. It receives your email address and the code.
ExchangeRate-API
Daily exchange rates. It receives nothing about you - Trovalo's server asks for rates on its own.
Cloudflare
Hosts trovalo.app, and receives the usual web request data when you visit the site.
Links you open
A booking's website, Venmo, PayPal or Revolut take you to those services, under their own privacy policies.
Deleting things
From inside the app
You can delete anything you added, and your whole account (tap your picture or initials on your trips list for Settings, then Delete Account). Without the app, ask by email from the address you sign in with - see the link below.
What deleting your account removes
Your sign-in, your email and name, your documents and their scans, your payment usernames, your push tokens and notification settings, your seats and purchase records, and Apple's sign-in token for Trovalo. It happens right away.
What it keeps, for the others
Your trips stay whole for the people still in them: what you added stays, under the name you used, as a guest - including your share of the expenses, so nobody's balance changes. If you were a trip's organizer, someone else in it takes over.
Subscriptions
Deleting your account doesn't cancel a Trovalo Plus subscription - the store bills that. Cancel it on iPhone or iPad in Settings, under your name, then Subscriptions; on Android, in Google Play, under Payments & subscriptions.
Deleting a trip
When an organizer deletes a trip, everything in it is deleted for everyone.
Keeping it safe
Encrypted and checked
Data travels encrypted (HTTPS) and is stored encrypted by Trovalo's providers. Access is checked by the server on every request, by trip membership and role. No system is perfectly secure, but Trovalo keeps what it holds to what the app needs.
Children
Accounts are 13 and up
Trovalo accounts aren't meant for children under 13 (or the age your country sets for consenting to this). Children can still come along: an organizer can add them to a trip by name, as guests, without an account.
Your rights
See, correct, export, delete
Depending on where you live, you may have the right to see, correct, export or delete your information, or to object to how it's used. Most of it you can see, change and delete in the app; for anything else - including a copy of your data - get in touch. Trovalo processes your information to provide the service you signed up for (performance of a contract).
The website
trovalo.app
No cookies, no analytics and no third-party scripts. Opening an invite link in a browser shows a page that sends you to the app; the link's code isn't logged by the site.
Changes
If this policy changes
The new version is published here, with a new date. If a change affects what Trovalo collects or who sees it, the app will tell you before it applies.
Contact
Who's behind Trovalo
Trovalo is made by Aly Badawy, the developer of Dawnlet. Questions or requests are welcome.