Draft: this policy is not yet in effect.

ttfriday Privacy Policy

This policy explains what data ttfriday (the "App") handles when you use it, why, who receives it, where it is kept, how long it is kept, and how you can exercise your rights. It describes what the current version of the App actually does; if that changes, we will update this policy first.

If this English version and the Traditional Chinese version differ, the Traditional Chinese version prevails. This policy is not legal advice.

1. Who we are

The App is developed and operated by the individual developer WEI KAI LIAO ("we", "us"), who is responsible for the data described in this policy.

Contact: support@ttfriday.com (we accept contact by email only; we do not provide a phone number or postal address)

2. What data we handle

You can use the App without signing in: viewing the sample trip, creating trips that stay only on your phone, and tracking expenses all work without an account. You only need to sign in to invite travel companions, join someone else's trip, or sync a trip across several phones. We never ask for your phone number, address or location. The current version touches the following data:

When you sign in (with Apple or Google)

• Account identifiers: an account code that Apple or Google gives the App (not your Apple ID or Gmail password), and an account number we generate for you.
• Name: the name Apple or Google provides at sign-in. Apple provides it only the first time, and you may choose not to share it. You can change your name in the App later.
• Email address: the address Apple or Google provides at sign-in, and whether it has been verified. If you choose "Hide My Email" with Sign in with Apple, we receive a relay address created by Apple, not your real mailbox.
• We do not obtain or keep your password or profile photo, and we do not keep the sign-in credentials (tokens) that Apple or Google issue to the App. Avatars in the App are always shown as initials.
• Sign-in state: so you don't have to sign in again and again, we issue our own sign-in credential, stored in your phone's secure storage (Keychain on iPhone, Keystore on Android); our server keeps only a hash of it.

What is stored on our servers once you sign in

• Trips you host: the full content of the trip, including places, times, expenses, notices, and the names you enter for your companions. Only the host can edit a trip; when you edit it, the App uploads the whole trip so your other phones and your members see the latest version. If two phones edit at the same time, we keep the 3 most recent conflicting versions so you can recover overwritten content.
• Memberships: who is the host or a member of which trip, and when they joined.
• Invite links: we store only a hash of the link code and its expiry time; links expire after 30 days.
• Suggestions: change suggestions members make on trip items (field, old and new value, reason), and whether the host accepted or declined them.
• Member expenses: expenses that members add themselves in a shared trip.
• Reports, blocks and suspensions: which content or user you reported, whom you blocked, and suspension records we create when handling abuse.

Data that stays on your phone

• Trips and expenses you enter (itineraries, places, spending, member names, etc.), kept in the App's storage on your phone and retained after you close the App. When you are not signed in, they are stored only on your phone and are not sent to our servers.
• Cached exchange rates and weather: the most recent rates and forecast, kept in the App's storage on your phone so the App can show the last known values when you are offline.
• Installation ID: the first time you use "AI trip suggestions", the App creates a random code on your phone. It contains no personal information and is not a hardware identifier. It is sent with each use of that feature, only to count daily usage.
• Receipt photos: when you use "Scan receipt", text recognition runs on your phone and the photo itself is not uploaded. On iPhone, the App uses Apple's built-in text recognition (Vision), which sends no data during recognition; on Android, the App uses Google ML Kit with the recognition model bundled in the App, so the photo also stays on your phone, but that component separately sends diagnostic information to Google (see section 5).

Data that leaves your phone

• When you check the weather: the code of the city you selected.
• When you use AI trip suggestions: the request text you type (up to 600 characters), the interface language, and the installation ID described above.
• When you check exchange rates: an exchange-rate request with no parameters, sent to our server (our server decides which currencies to look up; it contains no data about you).
• When you use "Scan receipt" on Android: the ML Kit diagnostic information and per-installation identifier described above (not the photo or the recognized text).
• When you sign in and sync (only after signing in): the proof of identity Apple or Google hands to the App at sign-in (we use it to confirm it's you and discard it after verification); after that, the trips, suggestions, member expenses, memberships, invites, reports and blocks listed above.
• When you delete an account created with Sign in with Apple on iPhone: a one-time authorization code from Apple, which we use to ask Apple to revoke the App's authorization (see section 9).
• When the App crashes or hits an error: a crash report (which part of the code failed, the error message, App version), device information (manufacturer, model, OS version, memory size, time zone, etc.) and a random installation code generated by the crash reporting component, sent to Sentry (see section 5). It does not include your name, email address, account identifier, IP address, trips, expenses or photos.
• Sent with any connection: your IP address and ordinary technical information needed to make the connection (for example, the time of the request).
• When you email us: your email address and the content of your message.

We do not collect precise or approximate location, contacts, your photo library, profile photos, health data, payment data, advertising identifiers or passwords. The App has no ads and no cross-app tracking; apart from the diagnostic information the Android text-recognition component sends to Google (see section 5), it has no third-party analytics (Sentry receives only crash and error reports so we can fix bugs; it does no usage analytics), and we do not sell any data.

3. How we obtain it

• What you type or tap in the App.
• When you sign in, the account identifier, name and email address that Apple or Google provides to the App with your consent.
• Other users in the same trip: the trip content the host enters, suggestions and expenses members add, and the record of them inviting you.
• Network requests the App makes automatically when you use the weather, AI trip suggestion or exchange-rate features.
• Emails you choose to send us.

Apart from these, we do not obtain or buy data about you from any other source.

4. Why we handle it

We do not use this data for any purpose other than those listed above.

If you prefer not to provide this data: if you do not use the weather, AI trip suggestion or exchange-rate features, the corresponding data is not sent. The rest of the App (trips, expenses, etc.) keeps working, and weather and rates fall back to built-in or previously fetched values. If you do not sign in, there is no account data and your trips are not uploaded; the trade-off is that you cannot invite companions, join someone else's trip or sync across phones.

5. Who we share data with

Each of the following receives only what is needed for that feature:

About AI trip suggestions: according to AWS's public documentation, Amazon Bedrock does not store model inputs or outputs by default, and the model developer (Anthropic) cannot access them. We have also turned off logging of AI request content. Please do not put personal details such as ID numbers or phone numbers in your AI request text.

According to Frankfurter's public statement, it does not log personal data, IP addresses or request URLs. According to OpenWeather's public policy, it does not store API request parameters or IP addresses.

We require or select service providers that provide the same or equivalent protection of data as described in this policy. Except where required by law, we do not provide data to anyone else.

6. Where data is stored

Data is stored primarily in the United States; content delivery network nodes are located worldwide.

Specifically: our server, the account and trip database and its backups are in the AWS US East (Northern Virginia) region; AI trip suggestions are processed in AWS data centers in the United States; the content delivery network receives your request at the node nearest to you; crash reports are stored in Sentry's data center in the United States. Frankfurter, OpenWeather, Cloudflare and our email provider process data according to their own infrastructure, which may be outside your country or region.

7. Who other than you can read this data

Plainly:

• People in the same trip (only when you sign in and create or join a shared trip): see the table below. People who are not in that trip cannot read any of its content, or even find out whether it exists.
• Data on your phone: anyone with access to your phone, and the phone's operating system. The App has Android automatic cloud backup turned off; an iPhone iCloud or computer backup may include the App's data, and that backup is controlled by your Apple account.
• Data on our server (see section 8): (1) anyone with administrative access to our cloud account; (2) administrators of the organization that the cloud account belongs to; (3) anyone authorized to restore server data or backups. Today all three are the developer personally, but that is a matter of permissions, not a technical limitation.
• Service providers: the companies listed in section 5 can access the data they receive while processing it, subject to their own policies and our settings.
• Email you send us: the developer, and the forwarding and mailbox providers.

Who sees what in a shared trip

• Someone who has an invite link and signs in sees the trip name, the host's name and the current number of members before tapping "Join"; after joining they become a member. Only share invite links with people you trust; the host can create a new link at any time, which invalidates the old one, and can remove members from the trip.
• Once a member is removed or leaves, they can no longer read the trip, and the copy on their phone is removed at the next sync. We cannot take back anything they already saw, screenshotted or copied before that.

8. How long we keep it

Our server does not keep your raw IP address. The firewall and content delivery network use IP addresses in real time to block abnormal traffic.

Backups exist to restore data if the server fails; up to the most recent 24 hours of changes could be lost. Data you delete is removed from the server database immediately, but copies remain in backups already taken and disappear completely only when those backups are deleted automatically at the end of their 30-day retention (cloud storage usually carries out automatic deletion within one or two days after that). Until then we do not use backups for any other purpose; if we ever have to restore from a backup, we delete again any data you had asked us to delete.

9. Your rights

You may ask us to: let you see or review your data, give you a copy, supplement or correct it, stop collecting, processing or using it, or delete it.

• Access and correction: once signed in, you can change your name in the App; you can edit or delete the trips you host at any time. For anything else, write to us.
• Data on your phone: uninstalling the App, or clearing the App's data in your phone's system settings, deletes it. Signing out does not delete trips on your phone.
• Hashes and technical records on our server: deleted automatically within the periods in section 8. Because these records contain no account identifier and we do not keep raw identifiers, we usually cannot tell which record is yours; if you still have questions, write to us and we will explain what we can do.
• Support email: deleted on request.

Deleting your account

• In the App: Settings → "Delete account" → confirm. No email or phone call is needed. For an account created with Sign in with Apple, your iPhone asks you to confirm once more with your Apple Account; we use that to ask Apple to revoke the App's authorization. If revocation fails, we still delete your data on our side, and you can stop the App from using your Apple ID yourself in iPhone Settings → your name → "Sign in with Apple". For an account created with Google, you can remove the App under "Third-party apps & services" in your Google Account.
• Without opening the App: go to https://ttfriday.com/delete-account and email us as described on that page.
• What is deleted: your account identifiers, name, email address and sign-in credentials; all trips you host (members of those trips lose access too — the App tells you how many before you confirm); your membership in other people's trips, the suggestions you made, the expenses you recorded, and the reports and blocks you made.
• What is not deleted: content a host typed into their own trip (for example a name the host entered for you, or an expense the host recorded) belongs to that host's trip and is not changed by your account deletion. Data on your phone is deleted by uninstalling the App or clearing its data.
• How long it takes: in-app deletion takes effect immediately, and your old sign-in state no longer gives access to anything; copies in backups are deleted within 30 days as the backups expire (see section 8). For requests made on the web or by email, we process them after confirming the request comes from the account holder, and email you when it is done.

Write to support@ttfriday.com. We will reply within a reasonable time.

10. Children

The App is not designed for children under 13, and we do not knowingly collect personal data from children. If you believe a child has given us data, write to us and we will delete it.

11. Changes to this policy

If this policy changes, we will update the version and effective date at the top of this page and keep every previous version available. Material changes (for example, a new recipient of your data) will be reflected in this policy before they take effect.

Change log:

• 1.2: exchange rates are now fetched from Frankfurter by our server (sections 2, 4 and 5). Your phone no longer connects to Frankfurter directly, so there is one fewer recipient of your IP address.
• 1.1: adds sign-in, trip sync and sharing, backups, account deletion and crash reporting.

Previous versions: 1.0 and 1.1 were internal drafts that were never published, so there is no earlier version to view.

Version 1.2 · Effective on the date the App is first published in an app store