Privacy and your data

Backpack Troops is a private travel planner and journal, operated by TechFusionLab. Guest trips and photos stay on your device. Signing in enables cloud planning and text journal sync; guest trips are never uploaded automatically.

Supabase hosts our PostgreSQL database in Mumbai. Firebase Authentication handles sign-in. Vercel hosts our website and API. Trip collaborators can see the shared plan and bookings. Your journal entries are visible only to you. Journal text and local photos are not sent to the AI planner.

Voice notes are optional and require microphone permission. Recordings stay in this browser or the mobile app’s private device storage; they are not sent to the AI planner and do not automatically sync between devices. If you explicitly choose cloud backup in Profile, a private snapshot includes those recordings for recovery on another device. You can play, export or delete a recording. Clearing browser/app data or uninstalling can remove local recordings, so save a separate copy of anything you want to keep. Dictation is a separate, optional feature: your browser or device speech service may process audio using its provider’s servers. The resulting text is editable before you save it; saved trip journal text follows the journal sync rules above.

When trip email forwarding is enabled, Resend receives emails sent to your trip address. We store the sender, subject, a limited text copy, attachment names and supported original ticket files in that trip’s inbox. Organizers, editors and contributors on the trip can read and review it. Forward only confirmations you want to share with those members. We keep delivery and per-ticket processing status so you can recover failed downloads or reads, and send a receipt to the recognised trip member’s email with a private trip link. If a notification arrives but its contents cannot be downloaded or its sender is not recognised, we retain a delivery-status entry without that email’s body. Receipt delivery records are kept to prevent duplicate acknowledgements. Forwarding a confirmation authorizes automatic reading of its text and supported attachments by OpenRouter and its model providers. This is free and does not use account credits. Extracted bookings are added to the trip; uncertain details and possible duplicates need review. Confirmed bookings may be added to the editable itinerary. An agreed shared plan stays unchanged until the organiser publishes the proposed changes. All members with booking access can see these records. Failed reads remain visible with recovery options; receiving a receipt does not mean extraction or itinerary placement has finished. Dismissing it clears the stored email body and sender from the inbox record; unlinked original files are removed once no other active inbox message references them. Original files attached to a booking or another active message remain with that record. Interrupted unlinked downloads are eligible for cleanup after one hour. Provider-held email copies follow Resend’s retention policy.

When you request a generated plan or import a booking, relevant planning inputs or booking contents are sent to OpenRouter and its model providers. Destination research may use Tavily, Google Places and OpenStreetMap. These services may process data outside your country. You can enter plans and memories manually instead. We do not collect background location. When you share or submit a link to save places, the app can save that source to your signed-in Places library and start processing it without first choosing a trip. You can later add found places to a trip or remove them from your library.

When Google Maps is enabled, place searches and the places displayed on a map are processed by Google Maps Platform. We save the place you select with its Google place ID so the same location can be reopened. Search suggestions are not saved as a search history. Google receives the map viewport and normal connection information when its map loads. If you tap My location, the app asks for foreground location permission and obtains your current coordinates to show your position and centre the map. This is optional; you can use maps without granting it. The current position is held in the map screen’s memory and cleared when you hide it or change accounts. Displaying that position uses the map provider; we do not run a background location service. Google Maps use is subject to the Google Maps terms and Google privacy policy.

For supported Instagram, TikTok and YouTube links, we use ScrapeCreators to retrieve public post information and available video content. We send the submitted URL to that provider. Available captions, transcripts, images or video content may be sent through OpenRouter to its model provider to identify places. We store the submitted source, processing status, extracted place information and available source evidence or previews in your library or trip. Access and extraction can fail, and we do not require your social-network password for this flow. These providers may process content outside your country and apply their own retention policies. Share only content you want processed.

In-app notifications show updates about itinerary builds, saved links and booking imports. If you enable phone notifications, we associate a device push token with your account and send notification titles, message text and identifiers through Firebase Cloud Messaging on Android or Expo’s push service on iOS. Notification text can include a trip name and may be visible on your lock screen according to your device settings. You can disable notifications in the app or your phone’s settings. Disabling them in the app marks that device registration inactive; its token and delivery records are not immediately deleted. In-app updates remain available.

Creating a first day requires sign-in and sends your city, chosen start and finish, and chosen visit to our API and Google Places. The preview is kept in your browser or mobile library until you explicitly save it to an account. The signed online-save link expires after 7 days; local copies remain until you clear them. Abuse prevention stores daily hashed network-address counts for up to 2 days, cleared on the next preview request. These counts contain no trip content.

Stories keeps re-encoded copies of your selected photos, captions, dates and city timeline in your current guest or account library on this device or browser. Stories do not automatically sync between devices. An optional private cloud snapshot in Profile can back up photos, captions, cover history and voice notes for recovery. Download a PDF or offline storybook to keep a copy with its photos. Photo dates are read locally; missing dates are left blank. When photo GPS is available, coordinates rounded to two decimals are sent to our API and the Photon/OpenStreetMap geocoder to suggest a city centre. Exact photo coordinates and original EXIF are not saved in Stories or included in exports. You can remove or change cities. AI captions are optional: only after you choose Suggest a caption are your caption text and selected city sent to OpenRouter and its model provider. The photo itself is not sent. Generated words are shown as a draft for you to accept or discard. AI captions require sign-in and use account credits.

Cloud media backups are opt-in snapshots stored in a private Firebase/Google Cloud Storage bucket. They are not sent to AI. You can restore copies or remove individual snapshots from Profile; removing a local memory does not remove historical cloud snapshots. Restore skips a copy previously recovered instead of overwriting later edits. Account deletion removes those cloud objects; a content-free hash of the removed account identifier is retained to prevent interrupted uploads from recreating them. Account JSON exports include backup metadata, not photo/audio bytes: restore media to a device before deleting your account if you want to retain it. Backups are not encrypted with a user-held key; authorized service operators can access storage.

Saved tickets are optional device copies. The web offline wallet must first be enabled while signed in; sign-out or switching accounts locks its offline access. Saved files remain in that browser until you remove them or clear browser data. Native ticket copies are isolated by account and can be removed in Profile. Offline access cannot immediately reflect remote membership revocation; reconnect to refresh permissions. Anyone with access to your unlocked device may access its local files.

AI photo-book covers are optional. Only when you choose Create cover are up to six selected, resized photos and the book title sent through our API to OpenRouter and its image model provider. We remove original EXIF and GPS metadata before transmission. The generated artwork is shown for you to accept or keep your photo cover instead. The credit cost is shown before each new cover request, including another version. Source photos are processed for that request, not stored in our application database. The generated image is retained with the credit receipt to recover interruptions; provider retention follows their own policies. Manual books and maps require no AI credits.

Generated results are temporarily stored with your account to recover interrupted requests without charging twice. Result copies older than seven days are cleared when you next use the credit service. Credit receipts remain in your account history; account export includes generation receipts, and account deletion removes them. Manually creating Stories or postcards does not use AI or credits.

If you join the Travel Together coming-soon list, we store your email, the purpose you agreed to and the signup date in our private database. This is only for launch updates about these trips, not a public profile or an account. We retain it for up to 12 months, or until you request removal at the contact address below. Expired records are cleared when the signup service next runs. Abuse protection uses short-lived hashed network counts; your email is never included in usage analytics.

Usage insights are optional and off by default. This version asks for a fresh opt-in. With your permission, we record web, Android or iOS; a broad referral category such as Instagram, search or invite; and fixed feature actions such as opening Places or saving an expense. A coded account identifier connects these insights across signed-in devices. This is pseudonymous, not anonymous. We do not include contact details, photos, journal text, trip identifiers, destinations, precise location, full referral URLs or arbitrary campaign text. A new signup’s platform and broad referral category may be held locally until you opt in; they are not sent beforehand. Missing or historical signup sources remain unknown. Events are retained for up to 90 days and cleaned daily. The consent preference remains until you change it or delete your account. Turning sharing off stops this device immediately and, once synced, removes account-linked events and stops collection on other devices. If offline, the app asks you to retry; it also retries before sending any more events. Account export includes these insights; account deletion removes them. Older app versions may still send previously consented, unlinked anonymous counts, which are not connected to your account.

Profile lets you export your cloud account data and permanently delete your account. Deletion removes your owned trips, private journal including deletion records, uploads, memberships and account from the active database and both Firebase and the migrated Supabase identity store. Deleting an owned shared trip also removes it for collaborators. You must sign in again immediately before deletion. If removal cannot finish, the app asks you to retry.

During our invite-only launch, we keep a hashed account identifier, a keyed hash of your verified email, invitation relationships and the number of invitations used. These records survive account deletion to prevent invitation limits being reset. Raw invitation codes are not stored. New read-only trip links require a passphrase, which is stored as a salted password hash; recipients can still save or forward information they can view. Older links retain their previous protection until the organiser revokes and replaces them.

Copies previously exported or saved by other people cannot be recalled. Clear guest data and cached libraries on each other device separately. Native photos are copied into the app’s private storage and removed when their memory or current device library is deleted. Uninstalling also removes that app storage. The operating system protects local files; Backpack Troops does not add separate file encryption. JSON exports contain device photo references, not photo bytes. Share photos separately. Temporary native export files are removed after the share sheet closes; files you save or share remain under your control.

To prevent repeat introductory-credit claims after account deletion, we retain keyed hashes of the account and verified sign-in identities. These records do not contain the original email address or sign-in identifier and are used only to check introductory-credit eligibility. Purchase and refund records are retained as needed to prevent duplicate credit grants and reconcile store transactions.

Other application records remain until you delete them. Our current Vercel Hobby runtime-log window is one hour, and Supabase Free log retention is one day. Our Supabase Free project has no automatic daily database backups available for restoration. Release migration backups are removed after verification. These application settings do not govern the providers’ separate security, abuse-prevention or billing records, which follow their own policies.

Read the Vercel runtime-log documentation, Supabase log-retention documentation, Supabase backup documentation, Firebase privacy information and OpenRouter privacy policy.

Contact contact.techfusionlab@gmail.com for data requests, access or deletion help.