Itineterry Privacy Policy

Effective 2026-07-29 · Operated by Terry Pedley ("we", "us")

Itineterry is a travel-itinerary planner available as a web app and an Android app. This policy explains what personal information Itineterry collects, why, how it is used and shared, and the choices you have. It applies to the Itineterry Android app and the Itineterry web service at itineterry.terrytory.synology.me.

1. Who is responsible for your data

Itineterry is operated by Terry Pedley, an individual developer based in Canada. We are the data controller for the information described below. The Itineterry server is self-hosted by us; your data is not held by a separate company on our behalf except for the limited third-party services listed in Section 5.

2. Information we collect

• Account information — the username you choose, your password, and, if you add one, your email address. Passwords are never stored in plain text; they are stored as a salted hash. An email address is optional — Itineterry works with a username and password alone. If you add one, we use it to let you sign in by email, reset a forgotten password, verify the address, and send you security notices (for example if your password or email is changed). An added email is stored unverified until you confirm it via a link we send.
• Itinerary content you create — trips and their items (flights, accommodations, transport, activities, etc.), including any dates, locations, addresses, phone numbers, confirmation numbers, costs, and free-text notes you enter.
• Collaboration data — if you share a trip, the usernames of members you invite and changes made to shared trips.
• Device push token — if you enable notifications, a Firebase Cloud Messaging token used to deliver push notifications to your device.
• Travel documents you choose to keep — when you import a booking that came with attachments (for example a boarding-pass PDF or a ticket QR image), or when you attach a file to an event yourself, we store that file so you can open it later, including offline. This is optional and off by default: imported attachments are discarded unless you tick "keep these documents" when reviewing the import. See Section 6 for how long we keep them and how to delete them.
• Technical and log data — basic request logs such as IP address and timestamps, kept for security and troubleshooting.

We do not collect your contacts, your photo library, precise device location, or advertising identifiers. Itineterry contains no advertising. The only files we hold are the travel documents described above, which you explicitly choose to keep.

Please note: a travel document often contains another person's personal information (for example a fellow traveller's name and seat) and may contain a scannable ticket barcode. Only keep documents you are comfortable storing, and delete them when you no longer need them.

3. How we use your information

• To provide the service: store your trips and sync them across your devices.
• To authenticate you and keep your account secure.
• To deliver collaboration notifications you have opted into (e.g. when someone edits a trip you share).
• To look up details you ask for, such as place or flight information (see Section 5).
• To diagnose problems and protect the service from abuse.

Our legal basis is your consent and the performance of the service you request, consistent with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). We do not sell your personal information.

4. Trip sharing and family connections

If you share a trip with other Itineterry users, the contents of that trip and your username become visible to the members you invite. Only share trips with people you trust.

You can also connect with another user as family — a standing connection, independent of any single trip, that two accounts need before either can share a trip with the other. A family connection is visible to both accounts involved. You can remove a family connection at any time in the app; doing so also ends any trip sharing that depended on it.

5. Third-party services

We share the minimum data necessary with the following services, only as needed:

• Google Firebase Cloud Messaging (Google) — delivers push notifications. Receives your device push token.
• Place lookup — when you search for a place, the search text is sent to a map provider (OpenStreetMap/Nominatim, or the Google Places API where enabled) to return matching results.
• Flight lookup — when you look up a flight, the flight number and date you enter may be sent to a flight-data provider (AeroDataBox) to return schedule details.
• Smart import (AI) — when you choose to import a booking, the text you paste, or the text and attachments of an email you forward to your personal import address (a dedicated address we generate for your account, separate from any email address you add for sign-in), are sent to the Google Gemini API (Google) so it can extract the booking details into events. Attachments (such as a boarding-pass PDF or ticket image) are read this way so that details appearing only in the attachment are captured. Only the material you submit for that import is sent — not your account, your other trips, or anything else. We use Gemini on a paid basis, under which Google processes it only to return the result and does not use it to train or improve its models. Attachments sent for extraction are not retained by us unless you separately choose to keep them (Section 2). The feature is optional; if you never use it, nothing is sent for AI processing.
• Google Play — if you purchase a subscription, the transaction is processed by Google Play. We receive confirmation that you are subscribed; we do not receive or store your payment-card details.

6. Data retention and deletion

We keep your account and itinerary data until you delete it or ask us to delete your account. You can delete individual trips and items in the app. To delete your account and associated data, contact us at terrytoriallabs@gmail.com and we will remove it. Backups are rotated and purged on a regular schedule. Technical logs are retained only as long as needed for security.

Travel documents are kept on a shorter schedule than the rest of your itinerary. A document you choose to keep is deleted automatically about a month after the trip it belongs to has finished, and you can delete any document yourself at any time from the event it is attached to. Documents are also removed immediately when you delete the event, the trip, or your account. Documents you keep are visible only to you — they are not shared with other members of a shared trip, even though the surrounding event is.

7. Security

Data is transmitted over encrypted HTTPS connections. Passwords are stored as salted hashes. On your Android device, your login token is stored in encrypted storage. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your information.

8. Children

Itineterry is not directed to children under 13, and we do not knowingly collect personal information from children.

9. International data

Our server is operated in Canada. If you use Itineterry from another country, your information will be transferred to and processed in Canada. Some third-party services in Section 5 may process data outside Canada.

10. Your rights

You may request access to, correction of, or deletion of your personal information, and you may withdraw consent at any time, by contacting us. Under PIPEDA you may also contact the Office of the Privacy Commissioner of Canada if you have an unresolved concern.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by a new effective date at the top of this page.

12. Contact

Questions or requests: terrytoriallabs@gmail.com.