Privacy policy

Globigo is operated by Verselix. For anything in this document, write to [email protected].

Your account. A stable identifier from Apple or Google, your name, and your email address. Apple lets you withhold your email — if you do, we never receive it and the account works without it.

Your profile. A username, photo, date of birth, gender, home country, languages you speak, and the travel styles and interests you pick during signup. Date of birth is stored as a date only, and is used to show an age rather than being frozen into a number that goes stale.

Your trips. Destinations, dates, itineraries, flights, bookings, expenses, packing lists, to-dos, photographs, and messages you send.

Your device. A push notification token for each device you enable notifications on, and a device label such as “iPhone 15 · iOS 18.2” shown in your own sign-in history so you can recognise your own devices. We do not store IP addresses against sign-ins.

Location is the easiest thing for a travel app to over-collect, so these are the exact rules:

• We keep one current position per person, overwritten each time it updates. There is no history of where you have been.
• A position is recorded only while the app is open, and only if your phone has already granted location permission. The app never asks for that permission at launch.
• Arrival detection uses geofences around stops already on your itinerary. The only thing that leaves your phone is “you reached a place you had planned to visit” — never a trace of anywhere else you went.
• Other people on a trip see your position only if you switch sharing on. It is off by default.
• Setting location to Never deletes the stored position rather than hiding it.

The timeline of places you have visited is built from stops you entered and arrivals your phone confirmed — not from a location history, because we do not keep one.

Other travellers see what you share with them: trips you are both on, messages you send, and expenses you log. A private packing list or to-do list is visible to nobody but you — not the person who created the trip, and not an administrator.

We use these providers to run the service:

• DigitalOcean — hosting and photo storage. Photos live in a private bucket and are served through short-lived signed links.
• Aiven — the managed PostgreSQL database.
• Apple and Google — sign-in. Google also provides place search and maps.
• Expo — delivery of push notifications to your device.
• Paddle — payments for subscriptions bought on the web. Paddle is the merchant of record and handles your payment details; we never see your card number.
• Apple and Google again for subscriptions bought inside the app, via RevenueCat, which tells our server whether your subscription is active.
• Anthropic — when enabled, the names of items in a packing list are sent to generate short category labels. Photographs are not sent.

We do not sell your data, and we do not use it for advertising.

You can delete your account from Settings at any time. Because your records are entangled with other people’s — an expense you paid on a shared trip is also their record — deletion is not a single wipe. The account deletion page sets out exactly what is removed and what survives, step by step.

Depending on where you live you may have the right to access, correct, export, or erase your personal data, to object to processing, and to complain to a data protection authority. Write to [email protected] and we will respond within 30 days.

Globigo is not intended for children under 13, and we do not knowingly collect their data. A child can be added to a trip as a guest so that costs are split correctly — a guest is a name and a share of an expense, with no account, no login, and no personal data beyond the name the organiser types.

If we change this policy materially we will say so in the app before the change takes effect, rather than quietly updating the date at the top of this page.