Privacy Policy · Travobear

This Privacy Policy explains how Xense Limited ("Xense", "we", "our", or "us"), a company incorporated in Hong Kong SAR, collects, uses, discloses, and protects your information when you use the Travobear mobile application and related services (collectively, the "Service").

1. Information we collect

Account information. Email address, display name, username, profile photo, and authentication identifiers when you sign up or sign in (including via third-party providers such as Apple or Google).
Trip & content data. Itineraries, places, notes, journal entries, photos, videos, and any other content you create or upload to the Service.
Camera & photo library. With your permission, the Service can open your camera or photo library so you can attach photos and videos. We only receive the items you actually choose to add — we never browse or upload your library in the background. You can change this permission at any time in your device settings.
Location data. With your permission, the Service may access your device location to suggest nearby places or tag trip entries. You can disable this at any time in your device settings.
Purchase & subscription data. If you buy a subscription, we receive a record of the purchase from the app store via our subscription provider — the plan, its status, renewal and expiry dates, and an anonymous purchase identifier. We never receive or store your card number or other payment credentials; those stay with Apple or Google.
Device & usage data. Device model, OS version, app version, IP address, language, and basic usage events used for security, debugging, and product improvement. From your connection we also record the approximate country you use Travobear from (never your precise location), to understand where our community is and to keep the service running well.
Diagnostics & crash reports. If the app crashes or errors, we receive a diagnostic report containing device state and a technical stack trace, so we can fix the problem.
Communications. Messages you send us (e.g. support requests, feature suggestions, content reports) and waitlist signups.

2. How we use information

To provide, maintain, and improve the Service;
To personalise itinerary suggestions and recommendations;
To authenticate users and protect against abuse;
To operate subscriptions — unlocking paid features, applying usage limits, and restoring purchases across your devices;
To review reported content and enforce our Terms of Service;
To communicate with you about your account or the Service;
To comply with legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising or cross-app tracking.

3. AI processing

Travobear uses large language models and other AI systems to generate itineraries and recommendations. Trip prompts and limited context may be sent to AI model providers acting as data processors on our behalf. We do not use your private trip content to train third-party foundation models.

4. Third-party services

We rely on the following categories of processors to operate the Service:

Supabase — authentication, database, and file storage.
Cloud hosting & CDN providers — to deliver the app and serve media.
AI model providers — to generate itinerary content.
Subscription management (RevenueCat) — to validate in-app purchases made through the Apple App Store or Google Play and keep your subscription status in sync across devices.
Analytics & crash reporting (Google Firebase Analytics and Crashlytics) — in the app, to understand which features are used and to diagnose crashes.
Website analytics (Vercel Web Analytics) — page views on travobear.com. Cookieless; see section 5.
Push notification services — to deliver notifications to your device (e.g. Apple Push Notification service, Firebase Cloud Messaging).
Mapping & places data providers — to surface location information.

5. Cookies and similar technologies

Reading this website stores nothing in your browser. We use no advertising, profiling or tracking cookies on travobear.com, and set no cookie at all for a visitor who is only looking around — which is why the site never asks you to accept anything.

We do measure how the site is used, with Vercel Web Analytics. It counts page views and where they came from, and it is deliberately cookieless: it writes nothing to your browser, keeps no identifier that follows you between visits or across other websites, and is never used for advertising. That is why measuring here still costs you no consent banner.

A cookie appears only once you sign in. Supabase, our authentication provider, then stores a session cookie so you stay signed in as you move between pages. It holds a sign-in token and nothing else, it is tied to your browser, and it is cleared when you sign out. It is strictly necessary — the signed-in area cannot work without it — so it does not require consent.

The Travobear app is not a browser and uses no cookies, but it does include the analytics and crash-reporting services named above, which identify a device rather than a person. Your device settings control what those may collect.

If we ever add technology to this website that does store something on your device, or that follows you beyond it, we will ask for your consent first where the law requires it — and this section will say so before it happens.

6. Sharing

We do not sell your personal information. We share content you explicitly choose to share (e.g. a public journey or journal). We disclose information to processors above, and to authorities where required by law.

7. Data retention & deletion

We retain your information for as long as your account is active or as needed to provide the Service.

You can delete your account yourself, from inside the app — Profile → Settings → Edit profile → Delete account. It takes effect immediately. Deleting removes your profile (name, photo, bio and username), your sign-in details, your journals and their photos, saved places and collections, follows, likes and comments, AI chats and memory, and any trip only you are in. If you signed in with Apple, we also revoke Travobear's access to your Apple ID.

Trips are shared with other people, so some shared trip content is kept: the expenses, settlements, chat messages and itinerary items you added to a trip that has other members stay, so the other members' records and balances remain accurate. They are shown as from a “Deleted user”, without your name or photo. A trip you created that has other members is handed to the member who joined first. We also keep records we are required to (for example, transaction records for tax and accounting, or content-report records needed for safety and abuse investigations), and backups are purged on our normal rotation. If you would rather we did it for you, or you can no longer sign in, email hello@travobear.com.

8. Security

We use industry-standard safeguards to protect your information, but no method of transmission or storage is fully secure. You are responsible for keeping your account credentials confidential.

9. Children

Travobear is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect information from them.

10. International transfers

We operate from Hong Kong and may transfer information to processors in other jurisdictions. We rely on appropriate safeguards for these transfers.

11. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict processing of your personal information. Contact us at hello@travobear.com to exercise these rights.

12. Changes

We may update this Privacy Policy from time to time. We will indicate the "Last updated" date above and, where appropriate, notify you in the app.

13. Contact

Xense Limited (Hong Kong) · hello@travobear.com