Privacy Policy

1. Introduction

ONVA("we", "us", or "our") is a shared travel app for couples, nomads, and creators. It helps you plan trips together with shared maps, expense splitting, trip chat, a document vault, an AI trip planner, and live activities on iOS, Android, and the web.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have. By using ONVA, you agree to the practices described here.

2. Data Controller

The data controller responsible for your personal data under the General Data Protection Regulation (GDPR) is:

3. Data We Collect

We collect data when you register, use app features, grant device permissions, make purchases, or contact support — directly from you, automatically through your device, or from sign-in and payment providers.

3.1 Account and profile data

When you create an account, we process:

• Email address (required for sign-in and account recovery)
• Display name (optional)
• Profile photo (optional)
• Bio, home country, interests, and languages (optional)
• Social links you add (e.g. Instagram, TikTok, X — optional)
• Public profile setting — when enabled, other users can see your profile fields above (not your email or billing data)
• Authentication identifiers from your sign-in provider (e.g. Google on web, Firebase on mobile)
• Subscription and entitlement status (free, Trip Pass, or Nomad)

3.2 Journey and user content

When you use ONVA, you and your travel companions may create and share:

• Journey names, dates, and settings (e.g. home currency)
• Map pins, notes, and itineraries
• Expense entries, splits, balances, and settlement records
• Receipt and screenshot images you upload for expense scanning
• Travel documents stored in the vault (e.g. tickets, bookings, passports)
• Trip chat messages
• Live activity posts, participation, and status updates
• Companion invitations and journey membership
• Published pin collections you choose to share with the community (premium)
• Country stamps earned from your travels (shown on your profile)

Private journey content is visible only to members of that journey. If you enable a public profile or publish collections, that content is visible to other ONVA users as described in the app. Live activities require a public profile.

3.3 Location data

With your permission, we may collect location data to:

• Center the map on your current position
• Place pins and show nearby points of interest
• Provide context-aware AI trip planning suggestions
• Support live activities and shared map features

You can deny or revoke location access in your device settings at any time. Some features will not work without location permission.

3.4 AI planner interactions

When you use the AI trip planner, we process your messages, relevant journey context (pins, budget, itinerary, location), and the planner's responses. Receipt and document images you submit for AI-powered scanning are sent to our AI providers for processing and are not used to train public models beyond what those providers disclose in their own policies.

3.5 Payment and purchase data

• Web purchases: Processed by Stripe. We receive transaction status, plan type, and billing identifiers — not full card numbers.
• In-app purchases (iOS/Android): Processed by Apple App Store or Google Play via RevenueCat. We receive purchase and subscription status, product identifiers, and renewal information.

3.6 Device and technical data

• Device type, operating system, and app version
• Push notification tokens (if you enable notifications)
• IP address, browser type, and referrer URL (website visits)
• Server and error logs for security and troubleshooting
• Product usage events (e.g. feature usage, planner message counts)

3.7 Communications

If you contact support, we process your email address, message content, and any information you choose to provide.

3.8 Device permissions

The mobile app may request access to device features. You can deny or revoke these in your device settings:

• Location — maps, pins, AI planner, live activities
• Camera and photo library — receipt scanning, document vault uploads, profile photos, and chat images
• Notifications — trip updates and activity alerts

3.9 Sensitive information you upload

You may voluntarily store identity and travel documents (e.g. passports, tickets, insurance) in the vault. This may constitute sensitive personal data under GDPR. Only upload documents you are comfortable storing digitally, and avoid sharing vault access beyond your trusted journey members.

4. How We Use Your Data

We use personal data to:

• Create and manage your account
• Provide, sync, and secure core app features across devices
• Enable shared journeys, chat, maps, expenses, and documents
• Deliver AI trip planning and receipt scanning
• Process payments and manage subscriptions and Trip Pass access
• Share premium benefits with journey companions on your plan
• Send transactional emails (e.g. sign-in links, account notices)
• Send push notifications you have opted into
• Improve reliability, security, and product quality
• Comply with legal obligations and respond to lawful requests
• Resolve refund requests with Apple and Google (see Section 6)

We do not use your data for third-party advertising. We only send marketing emails if you have explicitly opted in. Transactional emails (e.g. sign-in links, billing notices) are sent as needed to operate your account.

5. Legal Bases (GDPR)

We process personal data on the following bases:

• Contract (Art. 6(1)(b)): To provide the service you signed up for, including account, journey, and premium features.
• Consent (Art. 6(1)(a)): For optional processing such as location access, push notifications, and sharing consumption data with Apple for refund requests.
• Legitimate interests (Art. 6(1)(f)): For security, fraud prevention, service improvement, and handling refund disputes — balanced against your rights.
• Legal obligation (Art. 6(1)(c)): For tax, accounting, and regulatory requirements.

6. Sharing and Third Parties

We use trusted service providers who process data on our behalf. We have data processing agreements in place where required:

• Supabase — database, authentication (web), and file storage
• Firebase (Google) — mobile authentication and push notifications
• Stripe — web payment processing (PCI DSS Level 1)
• RevenueCat — in-app purchase and subscription management on iOS and Android
• Apple App Store / Google Play — in-app payment processing on mobile
• OpenAI — AI trip planner and receipt/document image analysis
• Resend — transactional email delivery
• Crisp — customer support chat on our website (when enabled)
• Tavily — web search to enrich AI trip planning
• Apple MapKit — place search and map data on Apple devices
• OpenStreetMap / Nominatim — geocoding and place search
• Wikipedia — publicly available reference information for AI planning

We may also share data with journey companions you invite, when you choose to participate in shared features, or when required by law, court order, or to protect our rights and users' safety.

We do not sell your personal data.

Consent to Share Consumption Data with Apple

By using our app and making in-app purchases, you consent to our sharing of data regarding your usage and consumption of purchased content with Apple, as part of our efforts to resolve refund requests. This information may include details about how you have accessed and interacted with the purchased content. The purpose of sharing this data is to help Apple make an informed decision regarding refund requests. We ensure that such data sharing is done in compliance with Apple's policies and only as necessary to process your requests.

Similar consumption data may be shared with Google when you request a refund through Google Play, to the extent required by their policies.

7. International Transfers

Some of our service providers are located outside the European Economic Area (EEA), including in the United States. When data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms required under GDPR.

8. Cookies and Similar Technologies

On our website, we use strictly necessary cookies and similar technologies to maintain your sign-in session and operate the application. We do not use third-party advertising cookies.

When our support chat (Crisp) is enabled on the website, it may set its own cookies to operate the chat widget. You can control cookies through your browser settings. Disabling essential cookies may prevent you from signing in on the web.

The mobile app caches pins, expenses, and documents on your device for offline access. This data remains on your device until you delete the app, clear app data, or delete your account (which removes server-side copies).

9. Data Retention

We retain personal data only as long as needed for the purposes described in this policy:

• Account and journey data: Until you delete your account or the relevant journey, plus a short technical deletion period.
• Subscription records: For the duration of your subscription and as required for billing disputes and tax law (typically up to 10 years for tax-relevant records in Germany).
• Server and audit logs: For a limited period for security, troubleshooting, and product analytics.

You can delete your account at any time in the app under Settings → Delete account, or by emailing us. Deletion is permanent and removes your profile, journeys, and associated content from our servers. See Section 11 for your rights.

10. Security

We use technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), access controls, and secure cloud infrastructure. Travel documents in the vault are stored encrypted. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Your Rights

Under GDPR (and similar laws where applicable), you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Request erasure ("right to be forgotten", Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, without affecting prior processing (Art. 7(3))

To exercise your rights, contact: support@getonva.app. We will respond within one month, as required by GDPR (extendable by two months for complex requests).

You also have the right to lodge a complaint with your local data protection authority. In Germany, this is typically the authority in the federal state where you reside.

California residents (CCPA/CPRA): You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information. To exercise these rights, contact us at the email above.

12. Children's Privacy

ONVA is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available at getonva.app/privacy-policy. For material changes, we will notify you by email or in-app notice where appropriate.

14. Third-Party Links

ONVA may link to external booking and travel sites (e.g. Skyscanner, Booking.com, Airbnb, GetYourGuide). When you tap these links, you leave our app and their privacy policies apply. We may receive affiliate commissions from some partners; this does not affect the price you pay.

15. Contact

Questions about this Privacy Policy or your data? Reach us at support@getonva.app.