Privacy policy

1. What the Service Is

Traveler.md lets you create and manage natural-language memory files — your “Traveler.md” profile and individual “Trip.md” files — and connect them to supported third-party services you choose. These files are generated and refined from information you provide directly, through a voice onboarding interview, a chat onboarding interview, or by manually creating or editing fields yourself. The content of your profile comes from you. We do not build your profile from external or purchased data sets.

2. Information We Collect

Account information. When you register, we collect your name and email address. If you sign up or sign in using Google, we receive basic profile information from Google (such as your name, email address, and account identifier) as permitted by your Google settings. If you create a password directly with us, we store it only as a cryptographic hash, never in plain text.

Profile and trip content you provide. We collect and store the information you supply to create and edit your Traveler.md and Trip.md files. Depending on what you choose to share during onboarding or editing, this may include travel preferences, past and planned trips, interests, dietary or accessibility needs, companions, and similar details. You decide what to include, and you can edit or remove it.

Voice data. If you use voice onboarding, your speech is captured and processed to generate a transcript and populate your files. Audio is processed by our voice sub-processor (see Section 5).

Connected services. If you connect a supported third-party service, we collect the information needed to establish and maintain that connection (such as authorization tokens) and exchange data with that service at your direction. You control which services you connect and can disconnect them. Connected services include AI assistants (such as Claude, ChatGPT, and others) that you authorize through OAuth to read or update your Traveler.md and Trip.md files. The scopes you approve during authorization determine what each connection can read or change, and disconnecting a service revokes its access without deleting your files.

Usage and device information. We collect standard technical information such as IP address, browser and device type, and how you interact with the Service, for security, diagnostics, and to understand and improve usage. When you use a connected service, we also log connector requests (such as timestamps, the action performed, and your account identifier) for security and diagnostics. See Section 9 on cookies.

3. How We Use Information

We use the information we collect to:

• create, generate, store, and let you edit your Traveler.md and Trip.md files;
• operate, maintain, secure, and improve the Service and develop new features;
• establish and maintain the connections you choose to set up with third-party services;
• authenticate you, maintain your session, and protect against fraud and abuse;
• respond to your requests and provide support; and
• comply with legal obligations.

As a public beta product, we may use aggregated or de-identified usage information to evaluate and improve the Service.

4. AI Processing

The Service uses artificial intelligence to conduct onboarding interviews, generate natural-language memory files from what you tell us, and help you manage them. To do this, the content you provide (including voice transcripts and text) is processed by AI sub-processors identified in Section 5. We do not sell your information, and we do not use your personal content to train third-party foundation models outside of providing the Service to you. AI-generated output can be inaccurate or incomplete; you are responsible for reviewing and editing your files.

5. Sub-processors and Third Parties

We use a limited set of service providers to operate the Service. They may process personal information only to provide services to us and are bound by confidentiality and data-protection obligations. Current sub-processors include:

• Amazon Web Services (AWS) — cloud hosting and storage;
• Anthropic — AI language processing used to conduct interviews and generate and manage your files;
• ElevenLabs — voice processing for the voice onboarding experience;
• Microsoft — Microsoft Clarity, used for product analytics (session replay and heatmaps) to understand and improve how the Service is used;
• OpenAI — AI language processing used to conduct interviews and generate and manage your files;
• Sentry — user feedback and bug tracking.

This list may change as the public beta develops. We may also disclose information to law enforcement or government authorities where required by law or valid legal process, and to an acquirer or successor as part of a merger, acquisition, financing, or sale of assets, provided the recipient agrees to protect the information consistent with this Policy.

Feedback. Feedback you submit about the Service (for example, through in-product feedback or bug reporting) is handled as described in our Terms of Service and is not treated as confidential.

Services you connect. When you choose to connect a third-party service, information is shared with that service at your direction and is then governed by that service’s own terms and privacy policy. We are not responsible for how connected third parties use your information.

No sale of personal information. We do not sell your personal information.

6. Data Storage, Retention, and International Transfers

Information is stored using our cloud infrastructure provider. We retain your account, profile, and trip information for as long as your account is active or as needed to provide the Service, and afterward as required for legitimate business or legal purposes. You may request deletion of your account and associated files (see Section 8).

The Service is available internationally. Your information may be processed and stored in the United States and other countries where we or our sub-processors operate, which may have data-protection laws different from those in your country. Where required, we take steps to provide appropriate safeguards for such transfers.

7. Security

We maintain reasonable physical, technical, and administrative safeguards designed to protect personal information against accidental or unlawful destruction, loss, unauthorized alteration, disclosure, or access. We also use encryption in transit and store account passwords only as cryptographic hashes. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You use the Service, and transmit information to us, at your own risk. If you believe your account or information has been compromised, please contact us using the details in the Contact section.

8. Your Choices and Rights

You can review, edit, or delete the content in your Traveler.md and Trip.md files at any time within the Service, and you can disconnect connected services. Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to object to certain processing. To exercise these rights or to request account deletion, contact us using the details in Section 12. We will respond as required by applicable law. You may also have the right to lodge a complaint with your local data-protection authority.

To request deletion of your account and associated files, email privacy@travelai.com with the subject line “Data Deletion Request” and include the email address associated with your account so we can verify your identity and process your request promptly. You can also delete your profile and trip content directly within the Service.

Individuals in the EU/EEA and UK (GDPR/UK GDPR). If you are located in the European Economic Area or the United Kingdom, the legal bases on which we process your personal information are: performance of our contract with you to provide the Service; our legitimate interests in operating, securing, and improving the Service; your consent, where we ask for it (for example, certain cookies); and compliance with our legal obligations. You may withdraw consent at any time where consent is the basis for processing, without affecting processing already carried out. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you. The Service uses AI to generate and refine your memory files from what you provide, but it does not use automated processing to make decisions producing legal or similarly significant effects about you. You must be at least 18 years old to use the Service, as described in Section 10.

9. Cookies and Analytics

We use cookies and similar technologies to keep you logged in, maintain your session, secure the Service, and measure and improve usage. You can block or remove cookies through your browser settings, but some features of the Service may not function properly without them. Useful information about cookies is available at https://allaboutcookies.org.

Google Analytics. We use Google Analytics, a web analytics service provided by Google, to understand how visitors use the Service and to improve it. Google Analytics uses cookies and similar technologies and may transmit the information collected (such as a truncated IP address) to Google servers. We use IP anonymization so that IP addresses are processed only in truncated form. Where applicable, we use Google Consent Mode, which adjusts analytics data collection based on your consent choices; when consent for analytics storage is denied, data is limited to aggregate, non-identifiable information or not collected. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout. For more information, see Google’s privacy policy.

Microsoft Clarity. We use Microsoft Clarity, a product analytics service provided by Microsoft, to understand how visitors interact with the Service through metrics such as session replays and heatmaps. Clarity uses cookies and similar technologies to record interactions such as clicks, scrolls, and navigation, and transmits this information to Microsoft. We use Clarity only where you have consented to analytics, consistent with the consent controls described above. You can withdraw consent at any time through your cookie settings. For more information, see Microsoft’s privacy statement.

10. Children

The Service is not directed to and may not be used by anyone under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, please contact us and we will delete it.

11. California Privacy Rights (CCPA/CPRA)

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). It supplements the rest of this Policy. Under the CCPA, “personal information” means information that identifies, relates to, describes, or could reasonably be linked with a particular consumer or household.

As a California resident, you have the right to: (1) know the categories and specific pieces of personal information we have collected about you, the sources of that information, our purposes for collecting it, and the categories of third parties with whom we share it; (2) request deletion of personal information we have collected from you, subject to certain exceptions; (3) request correction of inaccurate personal information; and (4) not be discriminated against for exercising your privacy rights. You may exercise these rights, no more than twice in a 12-month period for access requests, by contacting us using the details in the Contact section. We will verify your request using the email address associated with your account and respond as required by law. You may use an authorized agent to submit a request on your behalf.

No sale or sharing of personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we do not sell or share personal information, we do not offer a financial incentive for its collection. If this changes, we will update this Policy and provide any required opt-out method.

12. Changes and Contact

Because this is a public beta product, we may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above and, where appropriate, by additional notice. Your continued use of the Service after an update means you accept the revised Policy.