Optitrips — Privacy Policy
Last updated: 2026-11-02
Optitrips (formerly MyTravelPal): the app has a new name. The service, the data controller and your rights are unchanged.
Optitrips (“we”, “the App”) is an Android app that helps you plan road trips across Europe. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (nFADP).
Data controller: José Javier González García
Route de Saint-Cergue 24bis #1028 · 1260 Nyon (VD) · Switzerland · hello@optitrips.com
Privacy contact: privacy@optitrips.com
1. Data we collect
Data you provide directly
- Account: the email address and public name from the provider you sign in with (Google), together with an internal user identifier and the dates of sign-up, last sign-in and last activity. We do not store your password: authentication is handled by the provider. The App keeps your session with an access token that expires after 30 days.
- Travel profile: number of travellers, whether you travel with children or pets, vehicle type, estimated consumption, meal preferences, driving pace and usual departure time.
- App settings and data synced with your profile: App settings (theme, units, currency, language), your Hall of Fame nickname and country, your “My places” (name, coordinates, category and note), your recent searches (place name, coordinates and country), the vehicles in your garage (model, tank, fuel) and, if you add them, your emergency contacts (name and phone number). All of this is stored on the server so you can restore it when you reinstall the App or change device.
- AI profile (optional): explicit preferences you enter under “AI Personalisation” (scenic routes, dietary restrictions, interests) and implicit data derived from your use (countries visited, number of plans made). They are used only to personalise the answers of the driving assistant and the trip inspirations.
- Trip requests: the origin, destination, departure time and preferences of every plan you calculate. They are sent to our server to calculate the plan and are kept only if you save, share or monitor the trip (see below), apart from temporary technical caches.
- Saved trips: when you save a trip, we store on the server its summary (origin and destination labels and coordinates, countries, dates, distance, estimated costs), your selections (hotels, stops, fuel stations), a compressed copy of the plan and, for each night, the hotel choice or booking you mark (name, coordinates, price, check-in date, nights, link and status).
- Trip monitoring and alerts (Premium plan): if you turn on monitoring for a saved trip, we store the simplified route geometry, its bounding box, the daily driving windows, the countries and your alert preferences. Our server periodically checks the weather and adverse events along that route, starting 7 days before departure and until arrival, and stores the alerts it generates in your inbox.
- Push notifications (if you enable trip alerts): when you turn on monitoring for a saved trip, the App first explains what will happen. Only if you accept and allow notifications in the system dialog, we store your device’s notification identifier (a push token issued by Firebase Cloud Messaging, a Google service), the platform, language, time zone and App version, linked to your account, up to a maximum of 10 devices per account. The token is used only to deliver your trip alerts. You can turn alerts off in the App or revoke the notification permission in your phone’s system settings at any time; the token is removed when you sign out, when you turn alerts off and when you delete your account.
- Shared trips: when you share a trip we store a copy of the plan and of the request under a 6-character code. Anyone who has the link can view it for 30 days.
- Suggestions and feedback: the free text you send from “Send a suggestion”, up to 3 screenshots you choose from your gallery and, if you tick the corresponding box, your email address so we can reply. Sending is always voluntary. We store the text, your reply email (if provided), your account identifier, the App version and the language, and we send a copy by email to our mailbox together with your account email and the screenshots.
- Subscription: the subscription tier, its expiry date and the purchase token that Google Play passes to us, stored in your profile.
- Companion group session: if you create or join a group session, the driver periodically sends their position (coordinates), speed, next stop, estimated arrival time, remaining kilometres, upcoming speed camera and the list of planned stops. That data is stored on the server and can be read by anyone who has the access code while the session is active.
- Hall of Fame (optional): only if you tick “I want to take part in the Hall of Fame”, your alias and your country flag become public together with your totals (kilometres driven in Companion mode, euros saved on fuel, euros saved on tolls and hazards avoided) and your position in each ranking. Your name, email, routes and positions are not published, and nothing is linked to any social network. To compute the totals we store on the server, unpublished, a record of each Companion drive (drive identifier, date, start and end time, kilometres, top speed and the number and quality of GPS fixes, not the fixes themselves), the saved trip it belongs to and the hazards already counted (type, a grid cell of about 11 km and departure date). Other users can report an alias: a reported alias is hidden until we review it, and we keep who reported it. When you leave the Hall of Fame your alias and all those statistics are deleted at once (a cached copy of the ranking may keep showing it for up to a minute); deleting your account removes them too.
- Drive summary (optional): when a Companion drive ends, the App keeps a summary on your phone only; nothing is sent to us. If you then tap “Save to my profile” after reading the explanation shown, we store on the server the start and end time, kilometres, driving and stopped minutes, average and top speed, planned kilometres, estimated fuel and toll costs, the countries crossed, an optional reference to the copy on your phone, the version and time of your consent and up to 40 stops that have a name (stops without a name, and generic names such as “Stop” or “Parking”, stay on your phone and are never uploaded; each has a type such as fuel, restaurant or hotel, brand, place identifier, coordinates, arrival time, minutes stopped, whether it was planned and whether you marked it as a favourite). We never keep the GPS trace of the drive: it is discarded when the drive closes. If you do not save it, the summary exists only on your phone and is lost if you delete the App’s data or uninstall the App. Separately, and only for the stops you mark one by one, we add to your learning profile a reduced preference (type of stop, brand, time-of-day slot — morning, lunch, afternoon, dinner or night) with no coordinates, country, name or place identifier, so that suggestions fit you. This does not need the summary to be saved: each mark travels with a random identifier that we store only as a hash, so sending it twice does not count twice. Unmarking a stop removes its contribution; deleting a saved summary does not, because these marks belong to your learning profile. You can remove everything the assistant learned from your stops at any time with Settings → “Forget what the assistant learned from my stops”, and it is also removed if you delete your account. The summary is not used to compute Hall of Fame totals.
- Trip story (Premium): the story with photos and short texts about the places on your route is kept on your phone next to the saved trip, so you can read it offline. It holds only text, links and the author and licence of each photo (no images and no audio), is not sent to our server when trips sync, and is deleted with the trip or when you sign out. Reading it aloud uses your device’s own voice, and the text is not sent to any service.
- Anonymous App usage (on by default, you can turn it off): while the option "Help improve the app" (Settings) is on, which it is by default, the App sends which screens you visit, which sections you open, hide or customise, the detail mode (Simple or Advanced) and the App version. This data is stored under a random identifier of this feature only, different from your installation's and unrelated to your account; it does not include your name, email, location, routes or any text you write, and the time is stored rounded to the hour. We use it only to decide what each screen shows. It is kept for 6 months. The first time you see a plan, the App tells you that this option is on and lets you turn it off with one tap. You can turn it off at any time in Settings > "Help improve the app": doing so deletes the data sent and discards the identifier. We do not share this data with third parties or use it for advertising. Legal basis: our legitimate interest in improving the App in a way that does not identify you, with your right to object at any time from Settings.
Data we collect automatically
- Installation identifier and activity: a random identifier generated on your phone the first time you open the App (it is not tied to the hardware or to the advertising identifier and disappears when you clear the App’s data), the App version and the date of last activity, linked to your account when you are signed in.
- Usage and cost accounting: for each paid call to an external provider (language model, routing, places, etc.) we record the provider, the feature, the number of units or tokens, the estimated cost, the subscription tier and your account identifier, without the content of the query. We also keep daily call counters per provider and per user (for users who are not signed in, a short code derived from the IP address) to apply daily limits and control cost.
- Crash and diagnostic reports via Sentry (EU region) and, in the App, also via Firebase Crashlytics (Google). Crashlytics receives, when the App crashes, the stack trace, device model, system and App version information, the state of the device at the moment of the crash and an installation identifier generated by Firebase; we attach no account identifier, name or email to it. We do not use Firebase Analytics. Sentry reports come from both the App and the server. They include stack traces, device, system and App version information and, for the server, technical details of the request that failed (for example the request path and its parameters, which may include coordinates). In Companion mode, if no GPS position is obtained for 60 seconds, the App sends a diagnostic report with the technical state of the GPS.
- One-off location when you tap “Use my location” or “Leave now”: the coordinates are sent to our server to calculate the route. They are kept only if they become part of a trip you save, share or monitor.
- Real-time location during Companion mode: while Companion mode is active, the App reads your GPS position on your device, including with the screen off or the App in the background if you grant the “all the time” location permission, and shows a persistent notification while it does so. About once a minute the App sends our server your position, speed, heading, driving time and your alert settings to receive recommendations (breaks, weather, fuel, adverse events, border crossings). The server uses that position to query external providers and does not write it to our database, except in the group session described above.
- Impact detection (Companion): your device’s accelerometer and GPS are processed on the device itself to detect a sudden stop consistent with a crash. If one is detected and you do not cancel the alert within 15 seconds, the App prepares an SMS in your messaging app for your emergency contacts with a link to your position; your phone sends it. This sensor data is not sent to our servers.
- IP address: like any Internet service, our hosting provider processes it to serve requests, and we use it in memory to limit abuse.
Device permissions
- Location (precise, approximate and background): for “Use my location” and for Companion mode. You can deny or revoke it in the system settings.
- Contacts: only if you tap “Pick from contacts” when adding an emergency contact. The App reads the address book on your device to show you the picker and stores only the name and phone number of the contacts you choose. You can add them by hand without granting the permission.
- Notifications: for stop reminders and alerts, and for the persistent Companion notification.
- Photos: the App does not request general access to your photos. It receives only the images you manually choose to attach to a suggestion.
Data we do NOT collect
- No advertising identifier (GAID or similar).
- No behavioural analytics for targeted advertising.
- No microphone or camera.
- The content of conversations with the AI assistant beyond the request in progress (the server does not keep chat history).
- Card or other payment data: Google Play handles it entirely.
2. Why we collect it
- Calculating trip plans: the origin, destination and profile feed the routing, POI, fuel cost and toll algorithms.
- Personalising the AI assistant: the user profile is included as context in the calls to the language model so the answers are relevant to you.
- Syncing across devices: the profile, settings and saved trips persist on the server so your data can be restored if you reinstall the App or change device.
- Driving alerts and trip monitoring: the real-time GPS position lets Companion mode warn you about speed cameras, adverse events, route changes and upcoming stops; trip monitoring warns you about problems on a future route.
- Safety: impact detection and alerting your emergency contacts.
- Managing your account and subscription: identifying you, validating your subscription tier and restoring your data.
- Improving reliability: crash reports help us fix bugs in production.
- Replying to your suggestions: if you gave your email when sending us feedback, we use it only to reply to you.
- Running the service, cost control and abuse prevention: usage accounting, per-installation activity and the daily counters let us size the infrastructure, control the cost of external APIs and limit abuse.
We never sell your data or share it with advertisers.
3. Third-party services and processors
Optitrips relies on the following providers. The data they receive is strictly what their function requires. Calls to route, place, weather and event data providers are made by our server, so they do not receive your account identifier, email or name. Exceptions: some resources are requested directly by your device (OpenStreetMap map tiles, Wikimedia Commons and Mapillary photos, Frankfurter exchange rates and the Google Places card); those services receive your device’s IP address and the usual technical data of a connection, and, for map tiles, the area you are viewing, but not your account identifier, email or name.
| Service | Purpose | Data received | Country or region |
|---|---|---|---|
| Fly.io | Hosting of the server and the PostgreSQL database | All request data and the stored data described above | Servers in Paris (France) |
| Sentry | Crash and diagnostic reports (App and server) | Traces, device information and technical request details | EU data region (Germany) |
| Resend | Emailing suggestions to our mailbox | Suggestion text, screenshots, your account and reply emails, account identifier | United States |
| Mapillary (Meta Platforms) | Street-level photos near hotels and restaurants when the place has no photo of its own | Our server queries the place coordinates, with no account data; your device downloads the photo directly from Meta’s servers, which receive your IP address and the usual technical data of a connection, but no account identifier, email or name. Photos come from the Mapillary community under CC BY-SA 4.0 | United States |
| Anthropic (Claude) | Language model for AI Inspiration, the Companion assistant, the trip narrative and the trip story wording | Your message and a summary of the trip context and your preferences, without name, email or account identifier | United States |
| Google Places (server) | Identifying restaurants and hotels and obtaining their place identifier | Venue name and coordinates; from the response we store only the place identifier (place_id) | United States and other countries |
| Google Places UI Kit (on your device) | Card with ratings and photos for a place, with Google’s attribution | The place identifier; Google serves the request directly to your device, with the usual technical data of a connection | United States and other countries |
| Google Sign-In | Sign-in | Email, name and account identifier from the provider you choose | United States and other countries |
| Google Play (billing) | Essential and Premium subscriptions | Google handles the payment; we only receive and store the purchase token | United States and other countries |
| Firebase Cloud Messaging (Google) | Push notifications for trip alerts, if you enable them | The device notification identifier and the content of the alert | United States and other countries |
| Firebase Crashlytics (Google) | Crash reports of the App | Stack traces, device and system information and a Firebase installation identifier, without account data | United States and other countries |
| HERE Technologies | Routing, tolls, fuel prices and places | Coordinates of origin, destination, route geometry and stops | Netherlands and other countries |
| Geoapify | Hotels, restaurants, fuel stations and charging stations | Coordinates of the route corridor | EU |
| OSRM (public server) | Route calculation | Coordinates of origin, destination and stops | Germany |
| OpenStreetMap (Nominatim and Overpass) | Address search, reverse geocoding, speed cameras and toll data | Search text and coordinates | Europe (several public servers) |
| OpenStreetMap (map tiles, on your device) | Displaying the App’s maps | Your device downloads tiles directly from tile.openstreetmap.org: it receives your IP address, the App identifier and the coordinates of the tiles for the area you are viewing | OpenStreetMap Foundation (United Kingdom) and its content delivery network |
| Open-Meteo | Weather forecast and heatwaves | Coordinates sampled along the route and time | Switzerland and EU |
| MeteoAlarm, EFFIS, NASA FIRMS, USGS | Weather warnings, fires and earthquakes | MeteoAlarm is queried by country and receives no data about you; EFFIS, FIRMS and USGS receive the geographic area of the route | EU and United States |
| Wikipedia, Wikidata and Wikimedia Commons | Short texts and photos of the places in the trip story (Premium), and photos of hotels and restaurants | Our server queries coordinates, place names and the language, with no account data; your device downloads the photos directly from Wikimedia (upload.wikimedia.org), which receives your IP address and the usual technical data of a connection, but no account identifier, email or name | United States |
| Frankfurter (on your device) | Exchange rates to show prices in another currency | Your device queries api.frankfurter.app directly (about once a day): it receives your IP address and the usual technical data of a connection, with no personal content in the request | Public service |
| Cloudflare | Hosting and DNS of the optitrips.com website | Technical data of visits to the website | United States and global network |
| Cloudflare Web Analytics | Cookie-free, aggregated visit statistics for the optitrips.com website (not the App) | The page address (without query string), the referring page, browser, operating system, device type and the country derived from the connection, plus page load timings; see section 10 | United States and global network |
| Viator (Tripadvisor) | Things to do at your destination (the “Things to do” sheet) and affiliate links to its activities | From our server: only the city name, the country, the App language and the display currency, with no account data and no coordinates. If you tap an activity, your device opens Viator’s tracked link, which carries our partner identifiers | United States and other countries |
| Stay22 | Affiliate links for stays: “Book this night”, the hotel booking panel (“Book on…”) and the Companion hotel suggestion. Stay22 forwards you to Booking.com, Expedia, Hotels.com, Vrbo or Agoda | Only if you tap a link: what is in the link (see “Partner links” below). From then on Stay22’s policy and the booking site’s own policy apply | Canada and other countries |
| Booking.com, Expedia, Hotels.com, Vrbo, Agoda (reached through Stay22), GetYourGuide, TheFork, Google Maps | Booking sites for hotels, activities and restaurants, and maps | Only if you tap a link: public search parameters and, where applicable, our affiliate code. From then on the destination site’s own policy applies | Depends on the provider |
We do not send your personal data to any other third party. Providers acting as processors handle the data to provide us with the service and under our instructions.
Partner links (affiliate links): some buttons in the App open a partner’s site: Stay22 (which forwards you to Booking.com, Expedia, Hotels.com, Vrbo or Agoda) for hotels, Viator and GetYourGuide for things to do. If you book through one of these links, we may receive a commission from the partner, at no extra cost to you. Nothing is sent when the button is shown; the link is opened only when you tap it, inside the App’s browser view, and it carries only what is visible in its address: the hotel name (if you picked one), the coordinates of the hotel or of the overnight area (never your GPS position), the check-in and check-out dates, the number of adults (and, for a direct Booking.com link, of rooms), the city name for activities, our affiliate identifier and a label naming the App screen the link came from. It never carries your name, email, account identifier or trip history. Once the page opens, the partner may set its own cookies and process your data under its own privacy policy, as on any website you visit. The TheFork and Google Maps links carry no affiliate code. More on the affiliate disclosure page.
Note on language model calls (Anthropic): when you use AI Inspiration or the Companion assistant we send Anthropic the text of your query together with a summary of the trip context (for example destination, remaining kilometres, upcoming stops or number of days) and of your travel preferences, but no name, email or account identifier. If you ask the assistant a question while driving, the summary also includes your approximate position as the name of the nearest town (or, if none is found, coordinates rounded to about 100 metres), your direction of travel, speed, local time, fuel level and the names of the places found near you; your exact position is never sent to Anthropic. Conversations are not used to train models under Anthropic’s API terms of use.
4. Subscriptions and payments
The Essential and Premium subscriptions are managed entirely through Google Play. Optitrips does not store card data or payment information. When you subscribe, Google passes us a purchase token, which we store in your profile together with the tier and the expiry date in order to unlock the corresponding features. To cancel, download invoices or request refunds, use the Google Play subscription management.
5. How long we keep it
- Anonymous App usage: 6 months, or until you turn the option off in Settings, whichever comes first.
- Account, profile, synced settings, vehicles, places, emergency contacts and subscription: until you delete them or delete your account.
- Saved trips: until you delete them or delete your account. The detailed copy of a trip’s plan is removed 90 days after its arrival date; the trip summary stays until you delete it. A deleted trip leaves for 30 days a minimal record (identifier and dates, no personal data) so that your other devices learn about the deletion.
- Trip monitoring and alerts: monitoring is removed 30 days after the trip’s arrival (or when you delete the trip) and its alerts go with it; the state of an already resolved alert is removed after 7 days.
- Push notification identifiers: until the device is removed from your account, until the notification service reports them as no longer valid, or until you delete your account.
- Shared trips: the link works for 30 days from the moment you create it; the copy is then deleted by a periodic cleanup. It is deleted at once when you delete your account.
- Companion group sessions: the code works for 12 hours at most. If the driver ends the session, it is deleted at that moment. A session that simply expires is no longer shown to anyone and is deleted automatically by a periodic cleanup; it is also deleted when you delete your account.
- Saved drive summaries: 12 months after you save the summary, or until you delete the summary or delete your account, whichever comes first. The copy on your phone stays until you delete it or the App’s data.
- Learning counters from marked stops: until you unmark the stop, use “Forget what the assistant learned from my stops” in Settings, or delete your account. They do not expire with a saved summary.
- Recent searches and local settings: on your device until you clear the App’s data; the synced copy until you delete your account.
- Suggestions and feedback: kept for as long as they are needed to handle them and improve the App, and deleted when you delete your account (the copy in our mailbox is deleted when you ask by email).
- Usage accounting and per-installation activity: the installation record and the daily counters are deleted when you delete your account. The usage records (provider, feature, units, estimated cost) are kept for as long as they are needed for cost control, but without your account identifier after you delete your account.
- Deletion marker: when you delete your account we keep for 31 days a one-way cryptographic hash of your account identifier and the time of the deletion, so that a sign-in token issued before it (for example on another phone) cannot recreate data. It cannot be reversed to your account, and it is deleted automatically afterwards.
- Crash reports (Sentry): rolling 90 days.
- Crash reports (Firebase Crashlytics): kept by Google for 90 days, as documented by Firebase.
- Backend logs: rolling 7 days on Fly.io.
- Backups: database dumps; the 14 most recent are kept.
What is deleted when you delete your account, and the little that is kept without any link to you, is detailed on the account deletion page.
6. Your rights (GDPR and nFADP)
You can, at any time:
- Access your data: Settings → “Download my data”. For data that download does not include, write to privacy@optitrips.com.
- Delete your account: Settings → “Delete my account” deletes your account record (email, name and sign-in provider), profile, saved trips, monitoring and alerts, notification identifiers, vehicles, installation records, suggestions, shared trips, group sessions, saved drive summaries and learning counters. Usage statistics are kept without your account identifier. Details are on the account deletion page. If you cannot use the App, write to privacy@optitrips.com.
- Correct your data: edit your profile at any time from the App.
- Withdraw your consent: for the AI profile, you can delete your preferences under Settings → AI Personalisation. For feedback with an email, write to privacy@optitrips.com. Trip alerts can be turned off in the App, and device permissions (location, contacts, notifications) can be revoked in the system settings.
- Object to processing and request its restriction: write to privacy@optitrips.com, or sign out and uninstall the App.
- Lodge a complaint: with your national data protection authority (in Spain, the AEPD — aepd.es) or with the Swiss Federal Data Protection and Information Commissioner (FDPIC).
For requests you cannot resolve from the App, write to privacy@optitrips.com. We reply within 30 days at most.
7. Children
Optitrips is not directed at children under 13. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a child, contact us so we can remove it immediately.
8. International transfers
The server and the database run in the EU (Fly.io’s Paris region), and the data controller is based in Switzerland. Sentry stores reports in its EU data region. Some providers in the table above (among them Anthropic, Resend, Google, Cloudflare, HERE, NASA, USGS, Wikimedia and Meta/Mapillary) are headquartered or process data outside the EU and Switzerland; in that case they act under the European Commission’s standard contractual clauses or equivalent mechanisms. Stay22, the booking sites behind it (Booking.com, Expedia, Hotels.com, Vrbo, Agoda), Viator, GetYourGuide and TheFork receive only the URL parameters described above when you tap their links; Viator also receives from our server the city name, country, language and currency of a things-to-do search.
9. Security
All communication between the App and our server uses HTTPS; the hosting redirects any HTTP connection to HTTPS. The App’s optional biometric lock works only on your device.
10. Website
The optitrips.com website is static and hosted on Cloudflare. It sets no cookies. It stores only the language you choose in your browser (local storage). Like any web server, the hosting provider processes technical connection data, such as the IP address, to serve the pages.
Web Analytics: to know how many people read the site and which pages are useful, the website pages load Cloudflare Web Analytics (a script from static.cloudflareinsights.com). It gives us only aggregated statistics: number of visits and page views per page, the referring site, browser, operating system, device type, country and page load times. According to Cloudflare, it does not use cookies or local storage, does not “fingerprint” visitors through their IP address or user agent, does not log the query string of the address, and does not track individual visitors across websites. We cannot see who you are or build a profile of you, and the data is not used for advertising. The country comes from the connection Cloudflare already processes to serve the page. This analytics runs on the website only; the App does not use it. See Cloudflare’s privacy policy and its Web Analytics description. Our legal basis is our legitimate interest in measuring the reach of the site in a way that does not identify you; you can block the script with any content blocker without losing any function of the site.
11. Changes to this policy
We may update this policy as the App evolves. Material changes will be announced inside the App before they take effect. The “Last updated” date reflects the version in force.