Privacy Policy

What we collect

• Account data: email address and display name, used to authenticate you and label your account.
• Trip data: the destinations, dates, flights, hotels, car rentals, train tickets, bookings, confirmation numbers, and prices you save or import.
• Imported email or document content: when you forward a booking confirmation tobooking@travcozy.comor upload a PDF, we process the content to extract structured trip information. The original document is stored securely in your account so you can re-extract from it later. You can delete it at any time.
• Technical data: standard web server logs (IP address, browser, timestamps) used for security, debugging, and abuse prevention.

AI processing

We use the Anthropic Claude API to parse the text of booking confirmations and extract structured data (airline, flight number, check-in date, etc.). Only the content of the document you sent us is passed to Claude for this extraction. Anthropic does not use this data to train their models; see Anthropic's data policy for details. No free-form chat with an AI takes place — the AI is used purely as a text parser.

How we use your data

• To provide the core service (building your itinerary, warning you about accommodation gaps, showing cover images, converting currencies).
• To send you transactional email about your account (password resets, import results).
• To debug problems and improve the product.
• We do not sell your data. We do not show advertising. We do not share trip data with third parties for marketing.

Third parties we rely on

• Supabase — database, authentication, storage, and edge functions.
• Google — OAuth sign-in, Gmail API (for the inbound forwarding address), Google Workspace SMTP (for outbound email).
• Anthropic — AI-powered booking extraction.
• Pexels — destination cover photos (no personal data sent).
• Vercel — application hosting.
• Google Analytics — anonymous usage analytics, only if you allow it in the consent prompt or Settings.
• Microsoft Clarity — session recordings and heatmaps with all on-screen text masked, only if you allow analytics (web app only, never in the mobile apps).
• Sentry — error reports when something breaks in the app, so we can fix it. A report carries the error, the page it happened on (with link parameters and share or invite codes removed), your browser or device model and operating system, the app version, and your account's internal id. In the Android and iOS apps a crash is reported the next time the app opens, and a crash report can include a random identifier for that app installation. Never your email, and your IP address is not stored.

Each provider has their own privacy policy. We share with them only what is necessary to provide the service.

Analytics and cookies

• Vercel Web Analytics — always on for the web app. It is cookieless and reports aggregate page views only; it does not identify you or follow you across sites.
• Google Analytics — off until you allow it. We ask once, and nothing loads unless you say yes. When enabled it sets_gacookies and sends anonymous usage events to Google. You can withdraw at any time in Settings → Privacy, which stops the sending and deletes those cookies.
• Microsoft Clarity — off until you allow it, same switch. When enabled it records how the screen is used (taps, scrolls, layout) with every text field masked before anything leaves your browser, and sets_clckand_clskcookies. It is web only: the Android and iOS apps never load it. Withdrawing in Settings → Privacy ends the recording and deletes those cookies. Microsoft describes its own handling in the Microsoft Privacy Statement.

Change analytics choice

Android app permissions

The TravCozy Android app requests the following permission:

• Internet access — required to sync your trips with your account and to fetch destination cover images and weather forecasts.

We do not request access to your contacts, location, camera, microphone, calendar, SMS, or stored files. If we add any of these in a future version, we will update this policy first and explain why.

Your rights

• You can view and edit every trip, segment, and booking from inside the app.
• You can delete any trip, segment, or uploaded document at any time.
• You can request full deletion of your account and all associated data — see "Deleting your account" below.
• If you are in the EU/UK, you have rights under GDPR (access, rectification, erasure, portability). Email support@travcozy.com to exercise them.

Deleting your account

See our dedicated Account deletion page for the in-app steps, the email fallback, and exactly what data is deleted.

Quick summary: tap Profile → Account → Delete account and type DELETE to confirm. There is a 30-day grace period for recovery; after that, your profile, trips, segments, bookings, documents, and import history are permanently deleted, with backups purged within 30 days.

Data retention

Trip and account data is retained for as long as your account exists. Deleted data is removed from active databases immediately and purged from backups within 30 days.

Children

TravCozy is not intended for users under 13 (or 16 in the EU). We do not knowingly collect data from children.

Changes to this policy

If we make material changes, we'll notify you by email and update the "Last updated" date at the top of this page.

Contact

Questions? Email support@travcozy.com.