Effective: October 22, 2026
This policy covers the ToTourist mobile app (Google Play: com.evanorllp.totourist). It explains what data the app handles, where, why and for how long, and how you can delete it.
1. Who we are
Evanor LLP (Canada). Privacy contact: evanor@evanorstudio.com
2. In short
- The app has no sign-up and no user accounts.
- Your profile, journal, photos, budget, checklists and travel documents stay on your phone. Travel documents (e.g. a passport photo or document number) are stored encrypted (AES-256) with a key kept in the phone’s secure key store.
- Our server only receives what a feature needs to work (see section 4), and not linked to your name.
- You can delete all your data at any time: in the app via Settings → Delete my data, or at totourist.com/delete-data.
3. Data stored on your phone
We cannot see this data; it stays on your phone:
- travel profile (first name, gender, age group, interests, travel style, preferred accommodation, optional e-mail address);
- journal (notes, photos, saved places) and visited places on the map;
- budget (trips, expenses), checklists, quiz progress, favourite fun facts;
- travel documents and their attached images/PDFs — encrypted;
- expiry reminders (local notifications, not sent from our server).
4. Data that reaches our server
The server (api.totourist.com) runs in the European Union, in France.
- Install identifier: a random identifier the app creates on first launch. It contains no name, e-mail or device identifier. Your allowance is tied to it (free AI plans used, rewarded videos watched, ad-free expiry).
- App integrity check: the Google Play Integrity result telling whether the app comes from Google Play and runs on a trusted device, to prevent abuse (e.g. mass use of our paid services).
- AI plans: the destination, dates, duration, budget, currency and travel preferences you enter. We forward them through the OpenRouter AI service to a language model to generate the plan. We do not store the request text; we only record that a plan was made (for your allowance). OpenRouter receives a pseudonymised (hashed) identifier, not the install identifier.
- Nearby search: your position at the moment of the search (latitude, longitude) and the category. We forward it to Google Places for results and do not store the position. Place photos also pass through our server without being stored.
- Location for “visited places”: if you add your current position, the coordinates are sent to Google to look up the city name; we do not store them.
- Purchases: the purchase token issued by Google Play and the purchase time, to verify the purchase with Google and grant ad-free time. We never receive payment details (e.g. card numbers); Google handles them.
- Newsletter (only if you opt in): first name, e-mail address, language and your consent, kept until you withdraw consent or ask for deletion.
- Server logs: IP address, time and requested address, for security and troubleshooting. Web server logs are kept for 14 days; application logs for at most a few weeks (size-limited, then overwritten).
5. Other providers
- Google AdMob (ads): to show and measure ads, Google collects the advertising ID (and app set ID), IP address, ad interactions and diagnostic data. You can reset or delete the advertising ID in Android settings. Details: policies.google.com/technologies/ads
- Google Maps SDK (maps): when a map is shown, Google collects the IP address, technical and crash data and a pseudonymous SDK identifier.
- Google Places and Geocoding: nearby search and city lookup (section 4).
- Google Play: purchases, payment and app integrity checks.
- OpenRouter and the language model provider it routes to: generating AI plans (section 4).
- Exchange rate source (jsDelivr / currency-api): rates for the currency converter and budget; it only sees your IP address.
- Trip.com: only if you tap a booking link; their website opens under their own privacy policy.
Google and OpenRouter may process data outside the EU (e.g. in the USA).
6. Permissions
- Location (only while the app is in use): for nearby search and adding your current place. No background tracking.
- Camera and photos: only when you add a photo to the journal or a document. Images stay on your phone.
- Notifications: for document expiry reminders (scheduled on the phone).
7. Legal basis
Providing the features (contract), preventing abuse and keeping the service secure (legitimate interest), and your consent for the newsletter and personalised ads.
8. Your rights
You can ask for access, correction, deletion, restriction, object to processing and withdraw consent. Contact evanor@evanorstudio.com. You can also complain to the data protection authority where you live.
9. Deleting your data
- In the app: Settings → Delete my data. Deletes all data on your phone, the data tied to your phone on our server, and your newsletter subscription.
- On the web: totourist.com/delete-data — to remove your newsletter address without the app.
- By e-mail: evanor@evanorstudio.com; we complete requests within 30 days.
Purchase identifiers (without name or payment details) are kept for refunds, fraud prevention and accounting.
10. Children
The app is not directed to children under 13, and we do not knowingly collect their data.
11. Changes
If this policy changes, we publish the new version here with its effective date.