Privacy Policy

Traveltogether is operated by Vibe Everything Company Limited, Hong Kong. This Policy covers our iOS and Android apps, expense portal (a browser page for submitting an expense for trip members to review through a private link) and product website at traveltogether.vibeeverything.co. Features and information collected depend on the platform, app version and features you use. Our corporate website has a separate Website Privacy Notice.

Privacy overview

• We store the account, trip, expense and optional image information needed for the features you use. Shared trip records can include information supplied by another participant, including about family members who do not have an account.
• AI receipt scanning sends, after the applicable permission, the selected photo to an AI service: Apple Private Cloud Compute on supported iPhones (with the receipt text read on the device and the trip's destination and dates), otherwise Gemini through Google Cloud Vertex AI. Extracted fields and completion records reach Firebase, even without saving an expense.
• Optional app and receipt-scanning improvement needs its separate choice. It does not currently authorise model training. You can withdraw; identifiable improvement samples and private analysis copies then require cleanup under section 6.
• Permitted AdMob requests may include up to two standardised city or country names from the selected trip. Turning off personalised ads or Apple tracking permission (ATT) does not by itself remove those keywords. Other information collected by advertising software development kits (SDKs) and applicable choices are described in section 7.
• We do not promise permanent receipt storage. Account deletion, shared records, AI records, private copies, backups and provider records have different rules in section 9.
• You can exercise applicable rights or complain through legal@vibeeverything.co. The full explanations, limits and regional rights follow below.

1. Who is responsible for your information

Vibe Everything Company Limited is responsible for the processing described here. You can contact our Privacy Contact about privacy, legal and data-rights requests. Our postal and email details are in section 14: Company and privacy contact.

This Policy explains our processing; reading or acknowledging it is not consent to optional advertising, analytics, cloud AI receipt scanning or AI receipt scanning improvement. Those choices are separate from agreeing to the Terms of Service. Camera or photo-library permission is not permission to send a receipt to an AI provider.

2. Information you provide

• Account and preferences: an account identifier, sign-in provider, name and email supplied through Apple or Google, profile image, language, currency and app preferences, and records of legal-document versions and privacy choices. Apple may supply a private relay email address.
• Trips and shared financial records: trip names, destinations you enter, dates, participant names and identifiers, groups and family arrangements, expenses, amounts, currencies, exchange rates, payers, allocations, recorded payments, notes, comments, mentions, changes and proposals. A recorded payment describes a payment made outside Traveltogether; it is not a bank transfer through us.
• Images: receipts, payment evidence, profile or participant avatars and trip backgrounds you choose to add. Receipts can contain merchant details, addresses, item descriptions and information about other people.
• Support and safety: your messages to us, reported content, report reasons and evidence needed to investigate abuse, respond to requests or resolve disputes.

Guest use can create an anonymous cloud account and synchronise data; it is not necessarily confined to your device. Offline drafts and cached data can also stay on your device. Linking Apple or Google helps with recovery and use across devices.

Providing information is voluntary, but account identifiers and the records needed for a requested trip or expense are necessary to provide that feature. Without them, we may be unable to create, recover, synchronise or share the relevant record. A receipt image is optional for manual entry. Declining optional AI, improvement or advertising permission does not itself authorise collecting the same information for that purpose under another choice.

We do not ask for a date of birth, gender or a demographic advertising profile. We do not request GPS access. A destination you enter is different from your device's location; providers may infer an approximate location from an IP address. Uploaded images may be resized, compressed or re-encoded for storage and delivery, and receipt thumbnails may be generated. We do not promise to store your receipt's original file or its original resolution. Re-encoding removes embedded image metadata, but visible text or content can still reveal personal information. Avoid uploading unnecessary identity documents, full payment-card details or sensitive information about yourself or others.

3. Technical, subscription and advertising information

• Operation and security: IP addresses, browser or device characteristics, app/OS versions, installation or device identifiers, authentication and app-integrity signals, request identifiers, timestamps, consent records and service errors. Where notifications are enabled, Firebase Cloud Messaging processes a notification token and installation information.
• Reliability: Firebase Crashlytics receives crash and non-fatal error reports, installation identifiers and device/app information. Our application diagnostics use limited operational fields rather than deliberately recording receipt contents, financial notes or sign-in credentials in diagnostic messages.
• Purchases: where subscriptions are available, the app store and RevenueCat process product, purchase, renewal, expiry, refund and entitlement information (the paid features and allowances a purchase unlocks). We use our account identifier as the RevenueCat app user identifier, so this purchase information is linked to your account. RevenueCat provides purchase validation, entitlement management and subscription analytics. We do not receive your full payment-card details from native-store checkout.
• Ads: when the app shows ads, we use Google AdMob and the Google Mobile Ads SDK. Whether ads are shown depends on your plan, regional requirements, privacy choices and ad availability. The SDK can process IP-derived approximate location, device or advertising identifiers, ad impressions and interactions, performance and diagnostic information. Declining tracking or personalised ads does not mean that all advertising-related processing stops.

4. Why we process information

We use information to create and secure accounts; store, synchronise and share trips; validate financial changes; deliver notifications you enable; process expense proposals; provide AI receipt scanning and subscription access; display and measure ads subject to applicable choices; produce aggregate statistics about how features are used from existing service records; investigate errors and abuse; respond to you; and meet legal obligations.

Where the EU General Data Protection Regulation (GDPR) or UK General Data Protection Regulation (UK GDPR) applies, our bases are contract for the service you request, consent for optional processing where required, legitimate interests for proportionate service security, fraud prevention, reliability, aggregate statistics about feature use that do not single you out, and preservation of other participants' shared ledger records, and legal obligations where applicable. We assess those interests against your rights. Consent can be withdrawn without affecting the lawfulness of processing before withdrawal. A contract or legitimate interest does not replace consent where law requires it. AI receipt scanning suggestions and balance calculations do not make decisions with legal or similarly significant effects about you; participants review and act on the records themselves.

5. Shared trips and the expense portal

Trip participants can access the shared records and images made available to that trip. Other participants may add your name or record an expense involving you before you have an account. Share only information you are entitled to provide, and tell affected people about this Policy where appropriate.

Family or participant records can include information about children who do not use the app, and uploaded receipts or other images can contain their information. The participant supplying it must have authority and obtain parent or guardian involvement where applicable law requires it. Provide only information needed for the shared expense. Adding a child to a record does not permit an under-16 account or remove our own legal duties. A participant's optional improvement choice does not waive the rights or required permission of other people whose information appears in a receipt.

If another participant provides information about you, the sources are that participant and the shared trip records they submit. The information is used for the trip, expense and safety purposes described here and follows the applicable retention schedule. You can contact us about that information and your applicable rights without creating an account. We remain responsible for any additional notice we are legally required to provide; asking participants to share this Policy does not transfer that duty to them.

An expense-portal link gives its holder access to the trip information needed to submit a proposal, such as the trip name, destination, currency and participant roster. The link does not provide the full expense ledger or make the visitor a trip member. Anyone who receives or is forwarded the link may use that access. Treat the link as private and disable or revoke that link within the trip if it should no longer be usable.

The portal uses a temporary anonymous identity to protect submission and retry handling. Your submitted amount, currency, selected payer/participants, description and optional receipt go to the shared trip for review. Removing that temporary identity does not delete the proposal or receipt. See account deletion and data requests for help.

6. AI receipt scanning and optional improvement

This feature uses artificial intelligence (AI) to read a receipt photo and suggest editable merchant, date, currency, amount and text fields. You check the result and save the expense yourself.

Google cloud processing: when you request a scan and permit this route, your selected receipt image, processing instructions and requested output language are sent to Gemini through Google Cloud's Vertex AI service to extract editable expense fields. The image can contain merchant, transaction and other visible personal information. Google receives the submitted image for this purpose; it does not need your permission for optional app improvement to perform the scan you request. Manual expense entry remains available.

Apple processing: on iPhones where Apple Intelligence and Apple's Private Cloud Compute are available to Traveltogether, AI receipt scanning first asks Apple's Private Cloud Compute model to read the receipt. For that scan, the app reads the receipt's text on your device and sends Apple the receipt image (reduced to at most 1,600 pixels on its longest side), up to 120 lines of that text, our processing instructions, and, when the trip has them, the trip's destination names and start and end dates, together with your device's current date and time zone. Apple states that Private Cloud Compute uses this data only to fulfil the request, does not make it available to anyone else, including Apple staff, and does not retain it after the response. If this route is unavailable, returns nothing or fails, the same scan can continue with Google cloud receipt scanning. When a scan completes, extracted result fields (such as merchant, date, currency, amount and text) and operational usage records (such as scan status, timing and the route that answered) are sent to our Firebase backend, even if you do not save an expense. Apple's on-device model, when we use it, analyses the receipt on your device and does not send it to Apple for cloud inference. Apple sign-in, device services and app-store processing have their own purposes.

Review AI results before saving. Cloud-processing permission, local analysis, saving to a shared trip, optional improvement and store purchase authorisation are separate. The AI receipt scanning and your data gives further details. Reading a policy, allowing the camera, accepting Terms or continuing to use the app does not replace explicit permission to disclose a receipt to a third-party AI service.

AI receipt scanning processing records can include request state, timing, the model and settings used, extracted fields, quota and cost information and account/trip references. These operational records are separate from optional improvement participation.

If you opt in to Help improve Travel Together, we record the device model, iOS version and app version used for each scan made while you take part. When you change something the AI filled in, we can compare what AI suggested, what was placed into the editable expense form and the first changes you save, including amounts and text, and use associated receipt references (records that locate receipt images) and images available for that sample for analysis and evaluation of extraction quality and app improvements. When you save without changing anything, we keep only a record that no change was needed. We may pause this collection at any time. Authorised reviewers may keep private analysis copies, including receipt images. These copies are separate from the receipt saved with your trip and have their own retention limit. This choice does not currently authorise training or fine-tuning a model. If we offer that use, we will explain the data, model/provider, purpose and safeguards separately and obtain any required permission before it begins. The ordinary content licence does not supply that permission.

For feedback comparing your first saved corrections, an eligible sample must come from a completed scan made under your valid improvement choice and still be covered by that choice when feedback is collected. It is matched to the first saved expense. An image is included only when it is available and can be matched to that sample.

You can turn participation off in Settings. Withdrawal stops new optional improvement collection and use, including further optional use of your identifiable earlier samples. We delete or irreversibly anonymise identifiable improvement samples and private analysis copies without undue delay, unless a separate lawful retention obligation applies. Backend deletion, private-copy cleanup and restricted backup expiry are separate steps; withdrawal is not instant deletion of every copy and does not delete your ordinary expense or saved receipt. Retention for another necessary purpose must have its own lawful basis and cannot be used to continue optional improvement after withdrawal. See AI receipt scanning and your data and the retention schedule below.

Optional app-usage analytics is off by default. It operates only when the feature is enabled and you have opted in. Google Firebase Analytics then receives the basic usage information it collects automatically, such as sessions, engagement time, app version, device model, operating system, language and approximate location derived from the IP address, plus one event recording which feature opened an upgrade screen and whether it was closed or led to a subscription. It uses a generated app identifier; we do not set your Traveltogether account identifier as the Analytics user ID, and advertising identifiers and advertising use are switched off. This does not make provider-held device or installation information anonymous. We use a two-month retention setting for detailed analytics data; combined statistical reports may be kept longer. Withdrawing stops future collection and clears analytics data waiting on your phone; it does not delete data already sent. Crash reporting and subscription analytics are separate from this optional choice.

7. Ads and your choices

Personalised advertising depends on the applicable consent choices, the app's personalised-ad setting and, on iOS where required, Apple's App Tracking Transparency (ATT) permission for tracking across other companies' apps and websites. We use Google's consent tools for applicable regional ad choices. Where advertising cannot lawfully be requested without consent, declining consent may prevent ads from loading. Non-personalised or limited ads can still involve storage, identifiers, security and measurement.

For contextual ads, some permitted Google AdMob requests include up to two standardised city or country names derived from your selected trip's destination, using a standard spelling. Unrecognised free text is omitted from these keywords. Turning off personalised ads or declining ATT does not by itself remove these contextual keywords from an otherwise permitted request. This is selected-trip context, not permission to build a travel-history advertising profile. We do not send the trip name, dates, participant roster, expense text, receipt contents, amounts, account/trip identifiers or an optional demographic profile as these ad keywords. Providers' own SDK processing is described above. We do not deliberately use sensitive characteristics to target ads. Contextual or non-personalised advertising remains subject to applicable consent and opt-out requirements.

Use the app's ad/privacy controls, Google's privacy-options screen where available, and your device's tracking controls to change choices. We do not sell personal information for money. Advertising-related disclosures can nevertheless be a legally defined sale, sharing or targeted advertising in some US states. You can request an applicable opt-out through Your Privacy Choices. An email request does not itself change your device's ATT or Google consent settings.

8. Service providers and other disclosures

• Google/Firebase: account authentication, database and image storage, backend processing, app-integrity and abuse protection, notifications, crash reporting, optional Analytics and AI receipt scanning, according to the features used.
• Google AdMob and advertising partners: advertising, measurement and security, subject to the applicable consent and privacy choices. Google's consent screen identifies the applicable advertising vendors.
• RevenueCat and the purchasing app store: subscription validation, account-linked entitlements, purchase history and subscription analytics.
• Cloudflare: website/portal delivery and security, and website traffic/performance measurement.
• Resend and email/routing services: where safety-report email notifications are enabled, Resend delivers messages containing the report category, identifier and restricted backend reference to the authorised review mailbox, rather than attaching the reported content or a receipt. Email and routing providers also deliver and store correspondence you send to us. Report identifiers and references can still relate to personal information; delivery does not make them anonymous.
• Apple or Google sign-in: authentication information needed for the action you request. The provider also processes information under its own terms.

Apple Private Cloud Compute, Google cloud AI receipt scanning and the hosting providers process submitted service data to perform the requested service. Advertising vendors, sign-in providers and stores can additionally process information for their own purposes under their applicable terms. These roles are different from trip participants receiving shared records. AI receipt-scanning providers are listed in AI receipt scanning and your data; a provider is listed there before it receives receipts.

Providers process information under the agreements applicable to their services; some also process their own service or advertising data for their own purposes. We can disclose necessary information to authorities or advisers when law requires it, or to investigate abuse and protect rights or safety. If the business is transferred, information can be transferred subject to applicable privacy obligations and notice.

Provider information: Firebase privacy and retention, Google's partner-services information, Vertex AI data governance, Apple Private Cloud Compute security, Apple Foundation Models, RevenueCat privacy, RevenueCat data-processing terms, Cloudflare privacy, Resend privacy and Resend data-processing terms. Google states that it does not use customer data to train or fine-tune its managed models without the customer's prior permission or instruction. This is separate from our optional improvement choice and does not mean every provider request has zero retention. Applicable logging, abuse monitoring and service configurations still matter.

9. Retention and deletion

Different records have different purposes and deletion triggers. Deleting an account does not erase every copy at the same time. The following schedule separates records used to run the service from recovery copies and records held by providers. A hashed or pseudonymous identifier can still be personal information.

During final account deletion we remove your account identity, authored content and uploaded media, or remove identifying details from them, as part of account-deletion processing. Minimal shared expense and payment facts may remain where needed to preserve other participants' balances and history; other members' content is not deleted merely because you delete your account. If you believe a retained shared record is unnecessary or unlawful, contact us so we can assess it.

An offline device may display an old cached snapshot until it reconnects. This does not mean the account still has server access; queued changes from a pending-deletion account are not accepted. We cannot remotely erase copies independently saved by another person.

Backups expire on their own cycles and are restricted to recovery. Restoring a backup must not restore an account's ordinary access after a deletion request. Necessary legal, billing or safety holds are limited to the information needed and reviewed; they are not an automatic extension for every record.

Provider-held records do not all expire on our app's schedule. Firebase says Authentication information, and installation information where the corresponding deletion API is used, can take up to 180 days to leave live and backup systems after the relevant deletion call. Crashlytics retains crash records and associated identifiers for 90 days before beginning removal. RevenueCat purchase data requires a separate provider-erasure step; deleting the app account or cancelling a subscription does not by itself prove that those records have been erased. Contact us to ask which provider-specific steps apply to your request and their status. Stores may retain transaction records under their own legal and accounting obligations. Advertising and AI-provider retention follow the applicable service configuration and agreements; we do not promise zero provider retention or a universal 14-month limit.

Use Settings or the account-deletion page to request deletion. Contact us if you need erasure sooner, cannot access the app, or want to exercise another legal right. A voluntary recovery period does not override a statutory deadline or an applicable right to erasure. Where needed and permitted, we verify identity proportionately and explain any information we must retain. We do not require identity verification for an opt-out where law prohibits it.

10. Website storage and security

The expense portal uses session storage for retry/request coordination and local storage for remembered manual exchange rates. Browser storage is separate from shared trip records. Clearing it can remove those local values and does not erase server submissions. Temporary account-action credentials or downloaded deletion-status files should be kept private; clearing a local file is not account deletion.

Firebase App Check and reCAPTCHA Enterprise help prevent automated abuse and validate requests. Google processes browser/device and risk signals for this purpose, and reCAPTCHA sets a necessary security cookie when it runs. This is separate from optional advertising consent. Cloudflare delivers and secures the websites; its Web Analytics measures visits and performance through a small measurement request (a beacon) without using advertising cookies or cross-site visitor profiles. We use HTTPS for data transfers and account, trip and administrative permissions to restrict access; no system or independently forwarded copy can be guaranteed completely secure. Browser/device settings can restrict storage, but doing so can affect submission, sign-in or security checks. See Your Privacy Choices.

11. International processing

We are based in Hong Kong. Google/Firebase, RevenueCat, Cloudflare and other providers may process information in the United States and other countries where they operate. Firebase Authentication is operated from US data centres. We do not promise that information stays in your country or in one region simply because a database has a selected storage location.

Our Google cloud receipt-scanning route uses Vertex AI's global endpoint. That route can process a request in different regions and does not itself guarantee processing in one selected country or region. Google's deployments and endpoints documentation explains the distinction. Apple Private Cloud Compute runs in Apple's Private Cloud Compute data centres and, as Apple announced in June 2026, on Google Cloud systems that Apple says meet the same requirements. We cannot choose where a request is processed, and it can be processed outside Hong Kong or your country or region. Database storage, AI processing and other provider operations have separate location arrangements.

Information is used electronically through our apps, websites, backend, authorised review tools and the providers described in section 8, and can be made available to authorised trip participants. The periods are in section 9; the territory includes Hong Kong, the United States and the relevant provider processing locations. If a particular transfer requires a country-specific notice or consent, we provide the required recipient, country and protection information before that transfer rather than treating this general statement as sufficient permission.

Where international-transfer safeguards are required, applicable arrangements can include contractual safeguards such as the EU Standard Contractual Clauses and the UK Addendum, or an applicable adequacy mechanism (a legal finding that a country or region provides sufficient data protection). Ask our privacy contact for the arrangement, covered recipient/service and relevant safeguards or an available copy. We apply the mechanism required for the particular transfer; optional AI permission does not waive transfer-protection obligations. A provider's certification does not by itself cover every transfer or service.

12. Your rights

Depending on where you live and the law's applicability, you may request access, a copy, correction, deletion, restriction (limits on how we use information), portability (a copy in a reusable format), withdrawal of consent or objection to certain processing. Some US states also provide opt-outs for sale/sharing, targeted advertising or certain profiling, and an appeal where an applicable rights request is refused. You can use an authorised agent where law permits, subject to proportionate verification. We do not discriminate for exercising an applicable privacy right.

• European Economic Area (EEA) and UK: the GDPR/UK GDPR rights described above, and the right to complain to your national supervisory authority or the UK Information Commissioner's Office (ICO).
• Hong Kong: access and correction under Hong Kong's Personal Data (Privacy) Ordinance (PDPO), and complaints to the Office of the Privacy Commissioner for Personal Data (PCPD). Information is voluntary, but a feature may require particular information to work.
• Taiwan: applicable inquiry, review/copy, supplementation or correction, cessation of collection/processing/use and deletion rights. The purposes, categories, use methods, recipients, territories, periods and consequences of not supplying information are described above. Necessary local collection notices remain separate.
• Singapore and Malaysia: applicable access, correction and consent-withdrawal rights, direct-marketing choices and complaints to Singapore's Personal Data Protection Commission (PDPC) or Malaysia's Personal Data Protection Commissioner, respectively.
• Thailand and Indonesia: applicable access, correction, deletion, restriction, objection, portability or consent-withdrawal rights under the relevant law. Required guardian involvement, local notices and cross-border safeguards remain applicable.
• The Philippines: applicable information, access, correction, objection, blocking/erasure and portability rights, and complaints to the National Privacy Commission.
• South Korea and Japan: applicable access/disclosure, correction, suspension/cessation, deletion and consent rights. Recipient-country notices, entrusted processing and third-party provision must be treated according to the relevant local rules.
• Canada, including Quebec: applicable access, correction and consent-withdrawal rights, additional Quebec rights where they apply, and complaints to Canada's Office of the Privacy Commissioner (OPC) or Quebec's Commission d’accès à l’information (CAI). You may ask about automated processing, portability or cessation of dissemination/de-indexing where the applicable law provides those rights.
• Switzerland: applicable information, access, correction, objection or deletion rights and complaints to the Federal Data Protection and Information Commissioner (FDPIC) under Swiss law; Swiss rights do not depend on treating every GDPR legal basis as a Swiss requirement.
• Australia and New Zealand: applicable access and correction rights, other rights under the relevant law, and complaints to the Office of the Australian Information Commissioner (OAIC) or New Zealand Privacy Commissioner. New Zealand's applicable indirect-collection notice duties are separate from a participant's promise to inform you.

Send requests to legal@vibeeverything.co. Include the sign-in method or account email if available and the request you want to make. Do not send a password, sign-in code, identity document or full card number unless we specifically explain a necessary, secure verification step. We do not require identity verification for an opt-out where law prohibits it. We respond within the period required by applicable law and explain any permitted extension, refusal and appeal route.

You can raise a data-protection complaint at the same address. You do not need an account, a particular form or legal terminology to complain. Explain your concern in your own words; if you need help making a complaint, tell us what accessible way of communicating you need. Where UK data-protection law applies, we acknowledge receipt within 30 days, make appropriate enquiries, keep you informed of progress and communicate the outcome without undue delay. This is an acknowledgement period, not a fixed resolution period. You also retain the right to complain to the UK Information Commissioner's Office (ICO) or another competent privacy authority.

13. Children and changes

Traveltogether is intended for people aged 16 or over. Do not use it if you are under 16. If applicable law requires parent or guardian authorisation for your information or a particular consent, that authorisation is also required; the 16+ rule does not replace it. If we learn that a child has provided information contrary to these requirements, we will assess and remove it as required. Contact us if you believe that has happened. This age restriction does not waive protections that apply to 16- and 17-year-olds or permit personalised advertising to minors contrary to law or provider rules.

The account age rule is distinct from records about a child supplied by an authorised participant, described in section 5. Contact our privacy contact about a child's information in those records, including a request to correct or remove it. Optional uses remain subject to applicable children's privacy and consent requirements; general Terms acceptance does not supply a child's or guardian's required permission.

We can update this Policy when the service or law changes. We identify its version and last-updated date, give material-change notices as required, and seek a new optional permission when required for a changed purpose. Continued use is not blanket consent to new optional processing.

14. Company and privacy contact

Vibe Everything Company Limited, incorporated in Hong Kong.

Registered address: Flat J, 15/F, Maxgrand Plaza, 3 Tai Yau Street, San Po Kong, Hong Kong.

Privacy Contact — privacy enquiries, complaints, and requests to access, correct or delete personal information: legal@vibeeverything.co. You may also write to the Privacy Contact at the registered address above.

General product support: hello@vibeeverything.co.