Privacy Policy

1. Introduction

This Privacy Policy explains how Journi ("we", "us", "our") collects, uses, discloses, and protects your personal data when you use our travel-planning service (the "Service"). Journi is the "data controller" for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.

2. Data We Collect

2.1 Account data (via Google OAuth)

When you sign in, Google provides us with your email address, full name, profile picture (avatar URL), and a unique Google user identifier. We do not receive or store your Google password.

2.2 Content you create

We store the trip-planning content you add to your account — for example, your destinations and travel dates, the places you save, your itineraries and plans for each day, your accommodation and packing information, and any notes or tags you attach. This is kept so you can access and edit it across sessions.

2.3 Shared content

When you choose to share a list, we store the information needed to make that share link work and to expire it after a limited period. Anyone with the link can view the shared content until it expires.

2.4 Technical data

• Session cookies used solely to keep you signed in
• Your IP address, processed to validate requests and prevent abuse
• Minor interface preferences (such as which sections you've collapsed) stored in your browser and cleared when the tab closes

2.5 What we do not collect

We do not use analytics trackers, advertising cookies, tracking pixels, or session-replay tools. We do not collect payment information. We do not send marketing email.

3. How We Use Your Data

We process your personal data to:

• Provide, operate, and maintain the Service
• Authenticate you and keep your session secure
• Store and display the trip content you create
• Compute travel times, distances, and optimised routes between places you select
• Enable the sharing feature at your request
• Diagnose, debug, and prevent abuse of the Service

Our lawful bases under the UK GDPR are:

• Performance of a contract— to deliver the Service you've signed up for
• Legitimate interests — to keep the Service secure, reliable, and free of abuse
• Consent — where you actively choose to share content via a share link

4. Third-Party Services and Data Sharing

We do not sell your personal data and we do not share it with advertisers. To operate the Service, we rely on a small number of trusted third-party providers who act as our processors:

• A cloud hosting and database provider, who stores your account, trip content, and share links on our behalf.
• An authentication provider, used to verify your identity when you sign in.
• Mapping and routing providers, used to display maps, suggest places, and calculate travel times and routes between the places you select.

Each of these providers processes data under their own privacy terms. We may also disclose data where required by law, court order, or to protect the rights, property, or safety of Journi, our users, or others.

5. Data Retention

• Account and trip data are retained until you delete the relevant destination, item, or account.
• Share links expire automatically after a limited period.
• Backups held by our hosting provider are retained according to their standard backup policy.

6. Your Rights

Under the UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data
• Restrict or object to processing
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time (where consent is the basis)
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email us at [[email protected]]. We will respond within one month.

7. Account Deletion

Deleting your account removes your profile and cascades deletion across all trip content, itineraries, packing lists, and share links linked to your user ID. Because a self-service deletion interface is not yet available, please email [[email protected]] to request account closure and we will process the request promptly.

8. Cookies

Journi uses only strictly-necessary cookies to keep you signed in. Under the UK Privacy and Electronic Communications Regulations (PECR), strictly-necessary cookies do not require a consent banner. We do not use advertising, analytics, or tracking cookies. Some short-lived interface preferences are held in your browser's session storage and cleared when you close the tab.

9. Security

We take reasonable technical and organisational measures to protect your personal data, including encryption in transit, access controls that limit each user to their own data, and safeguards against common web threats. We do not include sensitive data in our application logs. No system is perfectly secure; you use the Service at your own risk.

10. International Transfers

Our third-party providers may process your data outside the United Kingdom, including in the United States and the European Economic Area. Where such transfers occur, we rely on mechanisms recognised under UK data-protection law, such as the UK International Data Transfer Agreement, standard contractual clauses, or adequacy decisions.

11. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data to us, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top and, for material changes, notify you on your next sign-in. Continued use of the Service after a change means you accept the updated policy.