What we hold, and why

What we hold

Eight fields, and nothing more

Your name, your date of birth, your email, your mobile and your residence. That is the whole of it.

• We do not hold your passport or your nationality.
• Your date of birth is the most sensitive thing here. It is held encrypted, it is never shown to another member, and it goes to a house only once a stay is confirmed.
• We do not hold a card number. Of a card we keep the brand and the last four digits.
• We do not hold the details of anyone other than you.

How you get in

A name, an email, and no password

You come in through Apple, Google or Facebook — whichever you choose. There is no password here to remember and none to lose, because we never make one and never see one. What you type goes to that company in its own window; we see none of it.

What comes back to us is your email address and, if the provider sends it, your name. We keep the name. The email stays with the account and is how we reach you. Nothing else comes across, and nothing goes the other way: we never post anything anywhere on your behalf.

• We do not take your profile photograph, and we do not ask that company for your contacts, your friends, your posts, or anything else it holds.
• Apple lets you hide your address behind one of its own. We do not mind, and everything works the same.
• Sign-in itself is run for us by Supabase, in Europe. It holds the account and the sessions; it is not shown to anyone and it is not used for anything else.
• Signing out ends the session on our side too, on every device, not only on the one in your hand.

Why we hold it

To arrange a stay, and to reach you about it

Your name and residence let a house receive you. Your email and mobile let the desk reach you when something about a journey changes. Your date of birth is asked for at the door of most houses, and some rates and policies depend on it.

What you want in a room and at a table is asked when you reserve a particular stay, and passed to that house alone — it is not kept as a standing profile.

Who sees what is a rule, not a setting: the members you are connected to see your moments and your stays, any member can find your name, and nobody is shown where you are. Nothing you post is public.

What we do not do

The limits we set ourselves

We do not sell member data, and we never share your itinerary with anyone but the house you booked. We never post on your behalf. We do not build a profile of you to resell, and we do not run advertising inside the app.

You will hear from us about a journey because you have one. You will hear from us about new escapes only if you asked to — that switch is off until you turn it on.

Who else sees it

Two, and only two

The house you book, once your stay is confirmed, and only what it needs to receive you.

When you search for a place we do not have, the app asks a mapping service — Photon, run by Komoot in Germany — what place you mean. It receives the word you typed and the address of your device, and nothing that identifies you. It receives nothing at all when you search for somewhere already in the collection.

When you describe a stay in your own words, what you wrote is read by a language model — run by Anthropic, in the United States — so that the search can be filled in for you. It receives your words, today’s date, the collection’s own vocabulary, and the letters of your Travel DNA. It does not receive your name, your date of birth, your email, your mobile, or anything else we hold about you, and what you write is not added to your profile.

• Nothing you write to the concierge reaches a house. It narrows the collection, and stops there.
• The desk is a person and stays one. The concierge is a machine, and the app says so where you use it.

Your photographs

Only the one you hand us

To add a moment from a stay, your phone opens its own picker and hands the app a single photograph. We never ask to read your library, and we could not read it if we wanted to: what reaches the app is the one frame you chose, and nothing else.

That photograph is then redrawn — resized and written afresh — before it is kept. Redrawing removes everything a camera writes into a file: the make of the phone, the exact minute, and the coordinates of the place it was taken. The copy we keep has never had them.

• Photographs stay on this phone. They are not uploaded, and no other member can see them.
• You can only add one from a stay you are on, or one you came back from within the week.
• Removing a moment deletes the file from the phone as well as the entry.

What the phone remembers

Kept here, sent nowhere

To estimate the travel around a stay, the app needs to know where you fly from. It remembers the airport you last chose, and the currency you prefer to read prices in, and it keeps both on this phone. Neither is sent to us, and neither travels with you to another device.

When the concierge reads a sentence you have written, what leaves the phone is the sentence, the collection it may search, and what those houses cost — never the airport itself, and never your name.

We do not book flights for you, and we pass nothing to an airline. When you ask us to arrange the travel around a stay, a person at the desk does it, and you confirm and pay for it separately.

• Your departure airport and your currency stay on this phone.
• Your recent searches stay here too, and clearing them is immediate.
• A price you read is converted for reading. Each house settles in its own currency.

What you can do

Yours to take, yours to end

You can ask for everything we hold at any time, and it arrives as a plain readable file. You can close your membership from the same screen, and what we hold goes with it.

You can correct anything yourself, from Personal data. Nothing needs to pass through us.

If someone will not stop

Blocking is silent, reporting is read

You can block any member. They stop seeing your moments and stop finding you, and you stop seeing theirs — in both directions, from the moment you tap it. Your connection ends. We do not tell them, and we never will: an alert would only send someone looking for you elsewhere.

Reporting is a different thing and does not hide anyone. It sends a note to the member desk, where a person reads it.

• A block is held as long as it stands. Unblocking removes it, and does not restore the connection.
• We hold who you reported, why, and anything you chose to write. We do not tell the person that you reported them.
• A report cannot be withdrawn from the app, so that nobody can be pressed into withdrawing one.
• Only the desk reads reports. Other members never see them, not even the count.

How long

As long as the stay, and a while after

What a house needs to receive you is passed at confirmation and is not kept by us afterwards. Records of a settled stay are kept as long as the law requires of any company that has been paid. Everything else goes when you close your membership.