Privacy Policy

1. Who is responsible

There is no data protection officer; one is not required for an operation of this size.

2. The principle: your data stays with you

Rutabi stores everything you enter – trips, itinerary items, tickets, packing lists, expenses, journal entries, recordings – in a database on your device. We run no server holding this data and we have no access to it. That also means we can neither view it, hand it over nor restore it. What you delete is deleted; what you back up, you back up into your own cloud.

Some features need a counterpart on the network. The following sections state, for each of them, what is transmitted, to whom, for what purpose and on which legal basis. All of these features are optional or degrade gracefully without a network: the app works in airplane mode.

3. The Rutabi app

3.1 What stays on the device

All content you create lives exclusively on your device and is processed there: trips with days, places and times; imported tickets, boarding passes and documents including their barcodes; packing lists; expenses and budgets; journal entries; references to photos in your library (the app stores identifiers, not copies); GPS recordings you start yourself; the log of your AI requests (section 3.5); and the API key for the AI, which lives in the system keychain. You delete this data via the app's trash or, completely, by deleting the app.

3.2 Backup in your iCloud

If iCloud is enabled on your iPhone, the app places a backup of its data in a private area of your iCloud that belongs to your Apple ID. It is created when the app goes to the background, at most once a day and only if something changed; the last five snapshots are kept. The provider is Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland); iCloud's privacy terms apply. We have no access to this backup. You can also export it as a file and keep or pass it on yourself. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR); the backup can be switched off in the settings. The backup is encrypted with 12 words that exist only on your device. If you tap “Save to password manager” in the app, your iPhone stores them in Apple's Passwords storage under the entry rutabi.app. This happens only when you tap it. We never receive the words. An Android version will place its backup in your Google Drive storage accordingly; this policy will be amended then.

3.3 Maps

The app draws its maps from map data provided by OpenFreeMap. This is OpenStreetMap data that the app labels itself, in your language. When a map is displayed, the numbers of the visible tiles – roughly, the map section – and your IP address are transmitted to Hyperknot Software Kft. (Hungary), which operates OpenFreeMap. According to its own statement it does not store IP addresses in regular operation, sets no cookies and may use Cloudflare for delivery. If this data cannot be loaded, the app shows map images from OpenStreetMap instead; the recipient is then the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom), and the same data plus an identifier of the app is transmitted. Loaded tiles are cached on the device so the map remains visible offline. Some editions of the app may additionally offer a topographic map style from Tracestrack (tracestrack.com); the same applies there. When you create a photo book from your journal, the app draws each map section in it from the OpenStreetMap map images, or from Tracestrack's in editions that use Tracestrack. Images that are not already on the device are loaded from there. The same data as above is transmitted: roughly the section around the place, your IP address and the app's identifier. The app draws the day's route onto the map itself; the route is not transmitted. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) – you opened the map or created the photo book.

3.4 Place search

When you search for a place, or the app determines the place for a coordinate, it queries a geocoding service: Nominatim by the OpenStreetMap Foundation (address above) or Photon by komoot GmbH (Friedrich-Ebert-Straße 8, 14467 Potsdam, Germany). Transmitted are the search term you type or the coordinate of a place in your plan, plus your IP address and the app's identifier. When you search in the form of an item, the app also sends a reference point so that nearby results come first: the coordinate of the trip's destination for that day, not your location. If you paste a maps link without coordinates, the name and the address from the link are the search terms; for a short plus code it is the place after it. For a shared screenshot, they are the name and the address written on it. Coordinates and full plus codes are converted by the app itself, without a request. Responses are cached on the device. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

3.5 AI features with your own key

The app's AI features – trip suggestions, suggestions for days and packing lists, information on entry requirements, tipping and local specialities – are available only if you store your own API key of an AI provider in the app. In the settings you choose one of three: Claude by Anthropic, PBC (548 Market St, San Francisco, CA 94104, USA), Gemini by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) or ChatGPT by OpenAI, L.L.C. (1455 3rd Street, San Francisco, CA 94158, USA). Your requests go only to the provider you chose. The key lives in your device's keychain; we do not see it, and no request passes through us.

What is transmitted depends on the feature and is whatever the answer needs: the destination, the dates and your preferences; the items of your itinerary - for a question about a day, the place of that day, its items, the accommodation for the night, and the title and place of the items on the other days, so that nothing is suggested twice; for entry information your nationality and destination country; for tipping and local specialities the place. No tickets, no expenses, no photos. This transmission is governed by the contract between you and the chosen provider, including its privacy terms. Note that, according to Google, the free tier of the Gemini API uses inputs to train its models. By storing the key, by choosing the provider and with each individual action you decide whether a request is made. Before the app stores a key, it names the provider the requests will go to and asks for your consent. A monthly limit in the settings caps what the app requests on your bill, and the app shows you which provider each request went to.

You decide how much goes along. Wherever data from your trip would be sent - the trip plan, a question about a day, the packing suggestion - a Send data checkbox sits next to the question. Behind it is a list of four items: destination, travel time and length, planned items, packing list. You can switch off each one separately, and the app shows you there, in the exact wording, what would leave with your question. What you switch off does not leave your device. Your question itself is always sent - without it there would be nothing to answer. The answers on entry requirements, tipping and local specialities take nothing from your itinerary; they send only the destination country or place, and for entry requirements your nationality.

You can read back what was sent. Under Settings → AI history the app keeps a log of your AI requests: the question, the items sent along and the wording of the request. It lives on your device and goes neither to us nor to third parties; fellow travellers do not receive it when you plan together. Because it sits in the app's database, it is part of the backup in your iCloud (section 3.2). The app keeps the last 200 requests; you can clear the log at any time, and deleting a trip deletes its entries. The AI's answers are not part of it.

Outlook. In future, Rutabi might route AI requests through a relay service of its own so the AI can be used without a personal key. That service would then see the content of your request. It is not in operation; this policy will be amended before it is.

3.6 Wikipedia and Wikimedia Commons

For places and itinerary items the app can fetch Wikipedia articles and freely licensed images. To do so it asks Wikipedia in your language and Wikimedia Commons (Wikimedia Foundation, Inc., 1 Montgomery Street, Suite 1600, San Francisco, CA 94104, USA) for the name of the place or item; transmitted are that name, the language, your IP address and an identifier of the app that points to this website. Whether the app loads such content on its own is controlled by a switch in the settings; saved articles live on the device. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

In a shared trip a picture travels as an address, not as a file. Your device then loads it from that address itself, even when someone else created the item. Transmitted are the address of the picture, your IP address and the app's identifier. The same switch in the settings decides whether this happens on its own.

3.7 Preview of shared links

When you share a link from your browser or a maps app into Rutabi, or enter a link into the place field or the “Link” field of an item, the app fetches that page once to read its title, description and a preview image. In the “Link” field this happens on its own as soon as you stop typing. A full maps link is read without a request; only a short link is fetched to learn where it leads. For travel pages such as Trip.com or Tripadvisor it also reads the location the page names. If a Trip.com link leads to the order page of a booking, the app reads the product, date, meeting point and coordinate there. It does not read the name of the traveller shown on that page. The site's operator sees your IP address and the app's identifier – just as if you had opened the page in your browser. This happens for links you add yourself. In a shared trip your device also loads the preview image for a link someone else added; it fetches the image file then, not the page.

When you share a screenshot, the app reads the text on it with the iPhone's text recognition. Which part is the title, the date, the time and the place is decided by the Apple Intelligence language model on your device, where it is available. Neither the image nor the text leaves the device for this. If the image shows a link, the app fetches it like a shared link.

3.8 Exchange rates

To convert expenses, the app fetches European Central Bank reference rates through the service frankfurter.app. Only the two currencies, the date and your IP address are transmitted. Rates are stored on the device; without a network the app uses the last known rate and shows its date.

3.9 Travel warnings

At app start, for ongoing and soon-starting trips, two public lists are downloaded: the event list of the Global Disaster Alert and Coordination System (GDACS, run by the European Commission's Joint Research Centre and the United Nations, gdacs.org) and the travel and safety advice of the German Federal Foreign Office (open data interface, auswaertiges-amt.de). In both cases the app downloads the complete list and compares it on the device with the places of your trip; nothing about your trip is transmitted. The providers see only your IP address. Your location is never queried for this.

3.10 Weather

On the iPhone, the day view shows the weather for the next ten days at the place of the day, meaning the place that applies to that day according to your plan. The data comes from Apple Weather through Apple's WeatherKit service (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, and Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA). The app asks through an iOS interface when you open the day view of such a day. What is transmitted: the coordinates of that place, rounded to about one kilometre, and your IP address. No date, no trip name, no other items of your plan and not your location: the app loads the forecast from today and picks the day on the device. It does not ask for days further in the future or in the past. According to Apple, the location is used only to provide the forecast, is not associated with data that identifies you and is not tracked between requests. The app keeps the forecast in memory for at most three hours and does not store it. When you tap the weather, the app loads the Apple Weather mark from an Apple server; the link to the data sources leads to an Apple page. On Android the app shows no weather and makes no such request. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

3.11 Planning together

You can share a trip with others. The devices then sync directly with each other, and everything that leaves the device in the process is end-to-end encrypted: only those holding the invitation to the trip can read the contents – not us, and no service in between. The invitation contains the key; you decide whom you give it to. Names that fellow travellers choose travel inside the encrypted data. Booking confirmations attached to an item travel with the plan, for example a hotel voucher with booking number and name. Tickets stay on your device.

There are two ways to sync. The first is a file you pass on via AirDrop, the share sheet or any other route; no service of ours is involved. The second is the online storage. As soon as you share a trip, syncing also runs through it, so devices sync even when they are not online at the same time. A trip you do not share never passes through the online storage. The online storage is a service we operate at Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA – processor under Art. 28 GDPR on the basis of Cloudflare's data processing addendum). It sees no contents, no names, and not which devices belong together. What it does see, because every relay does: the encrypted data packets, a channel identifier derived from the trip key that cannot be attributed to you, the size class and time of each packet, and your IP address during transfer. The packets are held in storage with EU jurisdiction for as long as the trip is shared. When you stop sharing, the app deletes them there. If no new packet arrives for a year, they are deleted automatically; the service keeps no access logs. It counts requests per IP address for one minute to slow down abuse and overload; the address is not stored. Legal basis for this: our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The request itself is processed at the Cloudflare location closest to you. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Anyone who wants to join a shared trip leaves an encrypted request there. It contains the name you entered and public keys of your device; anyone who has the invitation can read it. The answer contains the key of the trip and can only be read by the requesting device. The online storage is part of sharing a trip. You decide whether you share a trip.

3.12 Purchases

You buy Pro as a subscription or a one-time purchase through Apple's App Store (Apple Distribution International Ltd., Ireland) or, later, through Google Play. Purchase and payment run entirely through your Apple or Google account; we receive no payment or account data. The app verifies the purchase receipt on the device. The privacy terms of the respective store apply.

3.13 Feedback and support

"Send feedback" in the settings opens your mail app with a prepared message containing the app version, your operating system version and your language – no trip data. Whether you send it is up to you. Mail to support@paloaltea.app is delivered via Cloudflare's email forwarding to a mailbox at Apple (iCloud Mail), where it is read and answered. We process your address and the content to handle your request (Art. 6(1)(b) and (f) GDPR) and delete the message once the matter is settled, at the latest twelve months afterwards.

3.14 Asking for a rating

After a few completed trips the app may use the system's rating feature (StoreKit) to ask whether you would like to rate it in the store. Whether the dialog appears is decided by the system; the request goes to Apple, and we learn nothing of it.

3.15 Links into other apps and websites

In some places the app opens, on your tap, another app or website: Apple Maps or Google Maps for a place, and Amap, Baidu Maps, Waze, Citymapper or Organic Maps if they are installed on your device (the app asks the operating system which ones are; that answer stays on the device, and the chosen app receives the name and coordinate of the place; Amap and Baidu Maps also receive a sender identifier of the app, “Rutabi” for Amap and “ios.paloaltea.rutabi” or “andr.paloaltea.rutabi” for Baidu Maps, which is the same for every user and says nothing about you), Flightradar24 or the railway for the status of a connection, the music service whose playlist link is stored in the trip, the official pages of the Federal Foreign Office. From then on the respective provider's privacy policy applies.

3.16 Permissions

The app asks for permissions only when you use the related feature, and explains beforehand what for. Location: for the GPS recording you start yourself and to show your own position on a map inside the app. If you switch on “Rough route in the background” in the settings, the app also notes roughly where you were on trip days, even when it is closed. For this it uses the system’s low-power location reports (significant location changes and visits, from cell towers and Wi-Fi, not GPS) and needs the permission “Always”. All of this stays on the device and is never uploaded. Compass: for the direction you are facing at that position. The compass needs no permission and its readings never leave the device. Photos: for cover pictures, receipts, tickets and the photo map. For the photo map the app stores references, not copies; a picture you pick as a cover, a receipt, a ticket or as a photo of an itinerary item or an expense is stored as a copy on your device. For photos of an item or an expense it also remembers where the original lies in your library, so that sharing uses the original. It reads location and time only of the photos you pick or that fall within the trip dates, and uses them for the photo map and to complete the route on the trip map. Camera: to scan an invitation as a QR code and to photograph a receipt or a ticket. The picture stays on the device. The app reads a barcode on it itself, without sending the image anywhere. Notifications: for reminders the app schedules on the device itself – there is no push server. Apple Health: only if you switch on “Steps from Apple Health” in the settings. The app then reads on the iPhone the step count of each day of your trip, to show it next to the weather. It reads nothing else, writes nothing, and does not store, back up or transmit the numbers. All permissions are optional and can be revoked in the system settings at any time.

3.17 What there is none of

No analytics or statistics services, no crash reporting, no advertising identifiers, no fingerprinting, no sharing with third parties for their own purposes. Should the app ever get crash reporting, it will be only with your explicit consent in the app, off by default – and this policy will be amended beforehand.

3.18 Beta via TestFlight

During the beta the app is distributed via Apple's TestFlight. Under the TestFlight terms Apple collects crash reports and usage statistics from test devices and makes crash reports available to us, together with the feedback you send through TestFlight yourself – including screenshots you choose to attach. Crash reports contain the device model, system version, app version and the technical trace of the crash, no trip contents. We use them to fix bugs (Art. 6(1)(f) GDPR) and delete them at the latest twelve months after the beta ends.

4. The website rutabi.app

4.1 Visiting the pages

The website is served by Cloudflare (address above; processor under Art. 28 GDPR). To deliver a page, Cloudflare necessarily processes your IP address, the time, the requested address and your browser's identifier. We keep no access logs ourselves; the service's logging is switched off. Cloudflare briefly retains its own logs for the secure operation of its network under its own terms. The pages set no cookies, embed nothing from third-party servers – no fonts, no scripts, no images – and contain no analytics tools. Legal basis: legitimate interest in a working, secure website (Art. 6(1)(f) GDPR).

4.2 The beta waiting list

The waiting list has not accepted new entries since 11 October 2026. For the entries received until then, what follows still applies.

When you joined the waiting list on the start page, we stored your email address, your language (German or English), the time and the version of the consent text you agreed to. Your IP address was not stored; it was only counted for a moment to slow down automated mass entries. The data is held in a database at Cloudflare located in Western Europe. We are notified of each new entry by email; that message contains the address and is delivered via Cloudflare to our mailbox, where it is read.

We use the address for exactly one purpose: to invite you to the beta and to tell you when it begins or when something essential about it changes. No newsletter, no advertising, no sharing. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time – with an email to support@paloaltea.app – and we delete the entry. Otherwise we delete the list once the beta has ended, at the latest twelve months afterwards. The beta itself runs on TestFlight; if you accept the invitation, Apple's terms apply to it (section 3.17).

4.3 Contact by email

Section 3.12 applies to mail you send us.

5. Recipients and third countries

The following parties receive data, each only to the extent described above and only when you use the related feature:

For recipients outside the European Economic Area we base the transfer on the European Commission's adequacy decision for the United Kingdom, on the EU-US Data Privacy Framework where the provider is certified under it (to our knowledge this applies to Apple and Cloudflare), otherwise on the European Commission's standard contractual clauses or on the transfer being necessary for the feature you requested (Art. 49(1)(b) GDPR). For the AI features you decide about the transfer to Anthropic, Google or OpenAI yourself by choosing the provider, storing your key and invoking the feature.

6. Your rights

You have the right to access the data we process about you, to rectification, erasure and restriction of processing, to data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time with effect for the future. Write to support@paloaltea.app.

For the contents of the app: we do not have them. Access, rectification and erasure you exercise yourself – in the app, in your iCloud and, for shared trips, towards your fellow travellers.

If you believe we process your data unlawfully, you can complain to a data protection supervisory authority. The authority responsible for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

7. Children

The waiting list and support are intended for persons aged 14 and over. The app itself creates no data with us; the store's age rules apply to purchases.

8. Changes

If a feature is added that sends data out, this policy is amended beforehand. The date above shows the current version; we announce essential changes in the app.