Privacy Policy

The data controller is Alisa Halamai, Individual Entrepreneur, Yunatska Street 10, 03066 Kyiv, Ukraine.

You can reach us about anything in this policy at privacy@madhopper.app.

We have not appointed a Data Protection Officer — the scale and nature of our processing does not require one. A message to the address above reaches the person who can act on it.

Each purpose below names the legal basis we rely on under Article 6 GDPR, and how long the data stays.

•Running your account — your email address and password, or your Google email, name and profile picture if you sign in with Google. Basis: performance of our contract with you (Art 6(1)(b)). Kept until you delete your account.

•Your profile and travel settings — a profile picture if you add one; your citizenship (up to two) and passport expiry dates, and the countries and expiry dates of passports you have replaced; countries you tell us you have visited; your language, time zone, units and display preferences; and your notification settings together with the push token of each device you allow notifications on. We use your citizenship to work out which visa rules apply to you, your passport dates to warn you before they expire, and your time zone to decide what "today" means for your reminders. Basis: contract (Art 6(1)(b)). Kept until you change or remove them, or delete your account.

•Building your timeline — booking confirmation emails you forward, or booking files (PDFs / screenshots) you upload: the sender, subject and message body, or the file’s contents, from which we extract flights, stays, cars, trains, buses, ferries and tickets. The email itself is not kept — only the sender and the details we extracted. While a draft waits for your review, the file you uploaded (or a PDF attached to the email) is held with it, so that you can decide there whether to keep it ("Keep the original file"). If you keep it, it is stored privately — readable only by you and anyone you share that trip with — and removed when you delete that item or your account; if you do not, it is deleted together with the draft when you approve or discard it, or automatically after about 90 days if you never review it. Tickets and confirmations only, never identity documents. Basis: contract (Art 6(1)(b)), because forwarding or uploading is you asking us to do this; keeping the file is your explicit choice. Kept until you delete the trip or your account; unreviewed drafts are deleted automatically after about 90 days.

•Visas and days of stay — if you forward, share or upload a visa document (an e-visa PDF, or a photo or screenshot of one): the country, validity dates, permitted days of stay, visa type and number of entries we read from it. We read visa documents only if you have turned visa reading on — with the switch in Settings → Passports & Visas, or by choosing "Allow" when the app asks you, once, in your review queue. It is off until you choose. Without it, anything that looks like a visa is not sent to any AI provider and nothing from it is stored (a photo does have to be read before we can tell it is a visa — see "Automated parsing" below); the rest of a forwarded email, such as a booking in it, is still read as usual. Basis: your consent (Art 6(1)(a)) for the reading, which you can withdraw at any time with the same switch in Settings; contract (Art 6(1)(b)) for keeping the visa you confirm. Kept until you delete the visa or your account. We do not store the document itself, your passport number, your name or your date of birth.

•Your map and calendars — places you save (with any notes and photos you add), events from calendar feeds you subscribe to (ICS) and from calendars you connect — Google Calendar, TickTick, or the calendars on your iPhone — GPX tracks (kept in your browser only), and Strava activities if you connect Strava. Calendar access is read-only. For Google Calendar, TickTick and Strava we keep the access token the service gives us, so your data can stay in sync until you disconnect. Basis: contract (Art 6(1)(b)). Kept until you remove them or delete your account.

•What you send us to read, and what came of it — for each link, text or file: the link (or the kind of input), when we processed it and the outcome (how many places or bookings we found, or why it failed); names we found but could not place on the map; links waiting until you have import credit; and, if you upload an export of your saved posts or places, the list of links in it. This lets us show you progress, avoid charging you twice for the same link, and enforce the daily limit. When you correct or remove a place we found, we also record the correction, so we can improve how places are recognised. Basis: contract (Art 6(1)(b)); for the corrections, our legitimate interest in improving recognition (Art 6(1)(f)). Kept until you delete your account.

•Trips you share and people you invite — the email address of each person you invite to a trip, their role and whether they accepted; and, if you invite friends with your invite code, who joined with it and the credit it earned. Basis: contract (Art 6(1)(b)). Kept until the invitation is removed, the trip is deleted, or you delete your account.

•Feedback and support — the message you send us, any screenshot you attach, and your app version, screen, language, timezone and browser. Basis: our legitimate interest in fixing defects and improving the app (Art 6(1)(f)). Kept indefinitely, because a report may still be the reason a fix is in progress; see "If you delete your account" below.

•Reports about visa rules — if you tell us that a visa limit we show is right or wrong: the country, your citizenship, your verdict and any note you add. We use them to correct the rules for everyone. Basis: our legitimate interest in keeping the rules accurate (Art 6(1)(f)). Kept until you delete your account.

•Keeping the service secure — our server logs (what was requested and when, and the errors that happened) and abuse prevention, such as the counters that enforce daily limits; our database provider’s own logs also record the IP address a request came from. Basis: our legitimate interest in keeping the service available and free of abuse (Art 6(1)(f)). Our server logs are deleted after 30 days, the database provider’s logs after 7 days at most, and daily-limit counters after 7 days.

•Error reports and usage statistics — when something breaks, the app and our servers send an error report to Sentry: what failed and where, the app version, and your browser or device model; we do not attach the content of your trips or documents. We also count a few events with PostHog, such as errors and the start of a checkout. Nothing is stored on your device for this, and the events are not linked to you or your account. We do not record your screen or your keystrokes. Basis: our legitimate interest in keeping the app working and knowing whether checkout works (Art 6(1)(f)); you can object — see "Your right to object". Error reports are deleted after 90 days at most, usage events after one year at most.

•Subscriptions and purchases — if you buy MadHopper Pro or an import pack: your plan, its billing period, the store it was bought in, and the payment provider’s transaction identifier. We never see or store your card number — payment details go directly to the payment provider. Basis: contract (Art 6(1)(b)). Kept while your account exists. The sale itself is made by Creem (on the web) or by Apple or Google (in the mobile apps) as the seller, and they keep the accounting records for it under their own policies.

We do not sell your data, we do not use it for advertising, and we do not profile you.

An email address is required to create an account — without it we cannot identify you or let you sign back in.

Everything else is optional. If you do not forward booking emails, you can enter trips by hand. If you do not connect Strava or subscribe to a calendar, those parts of the app simply stay empty. Declining any of this does not limit the rest of the service.

Recognising a booking or a visa from a document is done automatically. We first try structured data and pattern rules on our own servers.

When that fails, the content may be sent to Anthropic (Claude) to extract the fields. From text — emails, PDFs, and the captions and transcripts of posts you share — we remove payment card numbers, security codes and passport numbers before it leaves our servers. Screenshots and photos are different: to read them at all we send the image itself to Anthropic, and we cannot remove a number from a picture — so crop out card and passport details before you upload one. For visa documents the extraction tool can only return the country, the start and end dates, the permitted days, and the visa type and number of entries picked from fixed lists — it has no field for a name, passport number or date of birth, and no free-text field. Anthropic processes the content to return a result under a data processing agreement and does not use it to train its models.

Bookings and visas are never applied on their own. Every booking and every visa read automatically lands in a review queue, and a person — you — confirms or corrects it before it is used. Places we find in a link or post you share are the exception: they are added to your map straight away, marked as new finds, and you can correct or remove any of them. None of this decides anything about you, so it is not automated decision-making within the meaning of Article 22 GDPR, and you are never subject to a decision made solely by a machine.

You can correct any parsed field before or after it is saved.

When you share an Instagram post, a TikTok video or a Google Maps saved list, we may ask a specialist provider (Apify) to read that page for us — for Instagram and Google Maps lists because those platforms offer no way for applications to read them directly, and for TikTok when its public page cannot be read. We send the link you shared and nothing else about you.

That content is written by other people and can mention them. We use it only to find place names, we keep only the places, and we do not build profiles of the authors — creator handles and any names attached to shared lists are discarded deliberately. Contacting every such author individually would be impossible, which Article 14(5)(b) GDPR recognises; if you are one of them and want your details removed, write to us and we will remove them.

If you sign in with Google, we receive your Google email address, name and profile picture and use them only to create and run your account, as described under "Running your account" above.

If you connect Google Calendar, we ask Google for read-only access to your calendars (the "calendar.readonly" permission). With it we read the list of your calendars — their names and colours — so you can choose which ones to show, and from the calendars you choose we keep, for a window of past and upcoming dates, only each event’s title, its start and end time, and whether it is an all-day event. Descriptions, attendees, attachments and locations are not stored. We never create, change or delete anything in your Google account.

We use this data for one purpose: showing your own events on your MadHopper timeline and calendar, next to your trips. It is not used for advertising, not used to build a profile of you, not sold, and not used to train AI models. No person at MadHopper reads it, except with your permission to fix a problem you ask us about, or where the law requires it.

To keep your calendars in sync while the app is closed, we keep the access token Google gives us on our servers in the EU (hosted by Supabase in Frankfurt), encrypted at rest, together with the events we have read. This data is shared only with the processors named under "Who else sees your data", who host it for us; we never pass it to any other app or service.

You stay in control. Disconnecting Google Calendar in Settings → Integrations revokes our access at Google and deletes the stored token and the events we had read; deleting your account does the same. You can also withdraw the permission at any time at myaccount.google.com/permissions, after which we can no longer read your calendars.

MadHopper’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

These providers process data only on our instructions, under a data processing agreement ("processors"):

•Supabase — database, authentication and file storage. Data is stored in the EU (Frankfurt); the company is Singapore-based.

•Anthropic (US) — AI reading of forwarded documents, screenshots and the text of posts you share, as described above.

•Apify (Czechia) — reading an Instagram post, a TikTok video or a Google Maps list when you share one.

•Cloudflare (US) — routing your forwarded emails to us, and storing our encrypted backups (in the EU).

•netcup (Germany) — application hosting. The servers are in the EU (Nuremberg).

•Resend (US) — sending you emails: trip invitations, reminders and account notices.

•Expo (US) — delivering push notifications to your phone. It receives your device’s push token and the notification text, and hands them to Apple or Google for delivery.

•Sentry (US; data stored in the EU) — error reports from the app and our servers.

•PostHog (US; data stored in the EU) — anonymous usage statistics.

•RevenueCat (US) — keeping your subscription status in sync across devices, if you buy Pro or a pack in a mobile app. It receives your account identifier and the store’s purchase token, never your card details.

These decide for themselves how they use data, so they are independent controllers rather than our processors — their own privacy policies govern, and we cannot instruct them on your behalf:

•Google — sign-in, if you choose it; Google Calendar, if you connect it; the YouTube Data API when you share a YouTube link; and, in the mobile apps, the map itself (Google Maps), which receives your device’s IP address and the part of the map you are viewing.

•Apple — Sign in with Apple, if you choose it.

•TickTick — your tasks, only if you connect it.

•Strava — your activities, only if you connect it.

•OpenStreetMap Foundation (UK) — turning place names into map coordinates, and the map you see on the web. Your browser contacts it directly, so it sees your IP address.

•komoot (Germany) — a second place-name lookup (Photon) that our servers use when the first finds nothing. It receives place names only.

•Open-Meteo (Switzerland) — weather for the places on your trips. The app asks it directly, so it receives those coordinates and your IP address.

•Creem (merchant of record for web purchases) — if you buy on the web, your purchase is made through Creem, which collects your payment details and billing information under its own privacy policy. We receive confirmation of the purchase, not your card details.

•Apple App Store and Google Play — if you buy in a mobile app, the purchase and your payment details are handled by Apple or Google under their own terms and privacy policies.

Separately from these providers, our administrators can see three things, each for a stated reason: feedback you send us — the message, the screenshot and your account’s email address — because that is how a bug report gets acted on; reports you send about visa rules, with your account’s email address and citizenship, so a disputed rule can be checked and followed up; and, only when you ask us for a copy of your data, the archive of everything in your account, which an administrator generates to send to you. Every such export is logged — who made it, for which account and when. Beyond this we do not look into your account, except where the law requires it or to investigate a security incident.

Sharing is off until you use it. When you do, other people see part of your data:

•Inviting someone. We email an invitation to the address you enter, with your name and the trip’s title. Once they accept, they see that trip — or only the hop you shared with them — including its bookings and any tickets attached to it; if you make them an editor, they can also change it. You can change a person’s role or remove them at any time.

•A public link. If you turn on a public link for a trip, anyone who has the link can open a read-only page with the trip’s title, dates and stops, and the times and places of its bookings — including where you stay — without signing in. It never shows attached tickets, confirmation codes or your contact details. Turning the link off stops it working at once.

Several of the providers above are in the United States, so your data is transferred outside the European Economic Area. The United States has no general adequacy decision from the European Commission.

Where a provider is not covered by an adequacy decision, we transfer on the basis of the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), together with the technical measures described in this policy — encryption in transit, and removal of payment and passport identifiers from text before it is sent for parsing.

You can obtain a copy of the clauses we rely on by emailing privacy@madhopper.app.

The United Kingdom (OpenStreetMap Foundation) and Switzerland (Open-Meteo) are covered by adequacy decisions, so no additional safeguard is needed for those transfers.

We do not use advertising cookies or anything that tracks you across other sites.

To work, the app keeps a few things in your browser (in the mobile app, on your phone):

•Your sign-in session, so you stay logged in between visits. Kept until you sign out or it expires.

•An offline copy of your trips and saved places, so they open without a connection. It stays on the device after you sign out, so the app still opens offline, until you clear this site’s data in your browser or delete your account on that device. On a shared computer, clear it when you are done.

•Tickets and files you have opened, so they are available offline. Removed when you sign out.

•Changes you made while offline, until they reach our servers.

•Something you shared into the app from another app, until it has been imported.

•Your preferences — colour theme, light or dark mode, language, map view and filters, place categories, the tips you have dismissed — and a cache of place-name lookups, so the map does not look up the same place twice.

•GPX tracks you upload, which never leave your device.

•The app itself, cached by your browser so it loads quickly and works offline.

Under the ePrivacy rules, storage strictly necessary to provide a service you requested does not require consent — everything above is of that kind — but you are entitled to know it happens, which is what this section is for. Clearing your browser storage signs you out and removes all of the above from that browser.

Retention is listed per purpose above. In short: your own content stays until you remove it or close your account; unreviewed booking drafts are deleted automatically after about 90 days; feedback is kept indefinitely and unlinked from your account if you close it.

Backups. So that the service can be restored after a failure, we keep encrypted backups of the database in Cloudflare’s storage in the EU: hourly copies for 2 days, daily copies for 30 days and monthly copies for 12 months. Copies of uploaded files are kept for 30 days after a file is changed or deleted. Something you delete — or a whole account — therefore disappears from the database at once and from the backups when the last copy holding it expires, at the latest 12 months later. Backups are used only to restore the service; if we ever restore one, we delete again whatever had been deleted since.

You can delete your account at any time in Settings → Account. If you have an active subscription bought on the web, cancel it first: deleting the account does not cancel it, and once the account is gone we can no longer reach it for you — so deletion becomes available as soon as the subscription is no longer set to renew. Subscriptions bought in the App Store or Google Play are managed by Apple or Google; deleting your account does not cancel them, so cancel them in the store.

Deleting your account permanently removes your trips, places, calendars, visas, drafts, uploaded files and sign-in record — with one exception: a trip you shared with people who accepted your invitation is not deleted. It stays with them, one of them becomes its owner, and the items you added stay part of it.

One more thing is kept: feedback you sent us — the message and any screenshot — stays, with your account no longer linked to it. The report describes the app rather than you, and it may already be the reason a fix is underway; once your account is gone we can no longer tell whose report it was.

Under the GDPR you can ask us to:

•give you a copy of your data (Art 15);

•correct anything inaccurate (Art 16);

•delete your data (Art 17);

•restrict how we use it while a dispute is resolved (Art 18);

•hand it over in a machine-readable format, or send it to another provider (Art 20) — this covers data you gave us that we process by automated means on the basis of your contract with us;

•stop processing based on our legitimate interests (Art 21) — see the separate section below.

Some of these have limits in the law: we may have to keep something to comply with a legal obligation, and portability does not cover data we derived ourselves. We will always tell you which limit applies rather than refusing without a reason.

Some of this you can do yourself in the app: you can edit your profile, and you can delete your account and its data in Settings → Account. For a copy of your data, or to hand it over in a machine-readable format (Art 15 and 20), email privacy@madhopper.app — we send you a structured archive of the data you gave us. For anything else, write to privacy@madhopper.app. We answer within one month, and will tell you if a complex request needs longer, as the GDPR allows. Exercising your rights is free.

You have the right to object, at any time and on grounds relating to your particular situation, to our processing of your data based on our legitimate interests — that is, feedback handling, reports about visa rules, error reports and usage statistics, and service security.

To object, email privacy@madhopper.app. We will stop that processing unless we can show compelling legitimate grounds that override your interests.

If you think we have handled your data unlawfully, you can complain to a data protection supervisory authority. You may go to the authority in the country where you live, where you work, or where the problem happened.

The list of national authorities is published by the European Data Protection Board at edpb.europa.eu. We would rather hear from you first and fix it — but this right exists whether or not you contact us.

Data is encrypted in transit and at rest. Your trips, places, calendars and visas are scoped to your account at the database level, so no other user can read them unless you share them — see "When you share a trip" above. Passwords are hashed by our authentication provider — we never see them.

Screenshots you attach to feedback are stored privately and are not reachable by any public link. Please keep in mind before attaching one that it shows whatever was on your screen.

No system is perfectly secure. If a breach affects your data and is likely to put you at risk, we will tell you.

MadHopper is not intended for anyone under 16, and our Terms set 16 as the minimum age. We do not knowingly collect data from children.

If you believe a child has an account, write to privacy@madhopper.app and we will delete it.

We may update this policy. The date at the top always reflects the current version, and for any change that affects your rights or introduces a new recipient of your data we will tell you by email and in the app, with a summary of what changed, before it takes effect.

Questions about this policy, your data, or to exercise any right: privacy@madhopper.app.

Postal: Alisa Halamai, Individual Entrepreneur, Yunatska Street 10, 03066 Kyiv, Ukraine.