Privacy Policy
Vayro plans trips. To do that, it needs some information about you and your trips. This page explains what we collect, why, who helps us process it, how long we keep it and how you stay in control.
In short: we don't sell your data, we don't show ads and we don't track you across apps or websites. Precise location stays on your iPhone. Documents are stored encrypted. You can delete your account and everything in it from the app at any time.
Who we are
Vayro is developed and operated by Jonh Alex, an independent developer, who is responsible (the "controller") for the personal data described here. Contact: support@usevayro.xyz.
What we collect and why
| Data | What exactly | Why |
|---|---|---|
| Account | From Sign in with Apple: a stable Apple user identifier and, if you share it, your first name. Apple may also give us an email address (or a private relay address); we currently don't store it. We keep a token from Apple only to revoke Sign in with Apple when you delete your account. | Create and secure your account. |
| Travel preferences | Home city and departure airports, pace, interests, stay style, breakfast, companions (the name you give and whether adult or child), currency, language and market, notification choices. | Plan trips that fit you. |
| Care and dietary needs (optional) | For example: avoid stairs, shorter walks, step-free access; vegetarian, vegan, gluten-free, lactose-free, halal, kosher, no pork. Some of these can reveal information about health, disability or religious beliefs. You choose whether to give them and can remove them at any time in Profile. | Only to plan your trips (your explicit consent). |
| Trips | Destinations, dates, travelers, plans and their versions, changes you ask for, bookings you add (provider and confirmation reference). | Keep and update your trips. |
| Documents and tickets | Files you choose to import (photos or PDFs of tickets, boarding passes, passports, insurance policies) and the Apple Wallet passes we create for you. Stored encrypted at rest (AES-256), never written to logs, served only to you through links that expire within minutes. | Keep them with your trip, also offline. |
| Approximate location | Only when a feature needs your area (a nearby departure airport, the weather where you are): coordinates rounded to about 1 km. Used to answer that request; not stored in your account. | Answer that request. |
| Device | Push notification token, language and time zone. | Send the notifications you turned on. |
| Technical logs | Request times, errors and performance data, redacted: no tokens, email addresses, document contents or free-text notes; coordinates rounded. | Security and fixing problems. |
What stays on your iPhone
- Precise location: directions, what's near you and optional arrival alerts on trip days are computed on the device.
- Voice: speech is turned into text by Apple, on the device when supported. We receive only the resulting text.
- Calendar: Vayro only adds your trip's moments. With full access it updates or removes only the events it added; it never reads your other events.
- Camera and photos: only the photos you pick are imported.
- Offline copy of your trips, protected by iOS data protection; sign-in tokens in the iOS Keychain.
What we don't do
- No selling or sharing of personal data, and no advertising.
- No tracking: no advertising identifier, no third-party analytics or advertising SDKs.
- No marketing profiles and no automated decisions with legal effects on you. The planner suggests; you decide.
Who processes data for us
- Amazon Web Services (United States): hosting, database and encrypted file storage.
- OpenAI: the AI models of the planner. They receive what is needed to plan: destination, dates, number and type of travelers, pace, interests, stay style, care and dietary needs, language and market, and the place and price data from our sources. They don't receive your name, email, documents, tickets or precise location. Under OpenAI's API terms, this data is not used to train their models by default.
- Google Maps Platform: places, routes, geocoding and time zones. Receives place names and coordinates of the places in your plan, and rounded coordinates when a feature needs your area.
- Duffel (when flight and stay offers are enabled): receives search parameters (origin, destination, dates, number of travelers), not your name.
- Public data sources: Open-Meteo (weather), Frankfurter (European Central Bank exchange rates), Nager.Date (public holidays), World Bank, REST Countries, Wikipedia. They receive only place, country or date queries, never personal data.
- Apple: Sign in with Apple, push notifications, Apple Wallet and speech recognition, under Apple's privacy policy.
International transfers
Our servers and most of the providers above are in the United States. When your data leaves your country, we rely on the safeguards the law provides, such as standard contractual clauses, and we give providers only what they need.
Legal bases
We process data to provide the service you asked for (your account and trips), with your consent (care and dietary needs, location, notifications, which you can withdraw at any time), and for our legitimate interest in keeping Vayro secure and working (technical logs). These bases follow the EU and UK GDPR and Brazil's LGPD.
How long we keep it
We keep your data while you have an account. When you delete it (Profile > Manage account > Delete account), we immediately delete your account, preferences, trips, bookings, documents and tickets, and revoke Sign in with Apple for Vayro. Technical logs are kept only for the limited time needed for security and troubleshooting. If backups contain your data, it disappears when those backups expire.
Your rights
You can access, correct, export or delete your data, object to or restrict its processing, and withdraw consent. Most of this is in the app (Profile); for anything else, write to support@usevayro.xyz from the email linked to your Apple Account. We answer within the time the law sets. You can also complain to your data protection authority (for example, the ANPD in Brazil or your authority in the EU or UK).
Security
Connections use TLS. Documents are encrypted at rest and reachable only through short-lived links. Sign-in uses short-lived access tokens with rotation. Logs are redacted. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
Children
Vayro is not directed to children under 13, and we don't knowingly collect their data. Companions you add may include children: we keep only the name you give and that they are a child.
Changes
We'll update this page and its date when something changes. If a change is significant, we'll tell you in the app before it applies.