Privacy Policy

How Tastefarer collects, uses, and protects your personal information when you use the iOS app and related services.

The Tastefarer app and services are operated by Spare Time Ventures LLC, a Wyoming limited liability company (30 N Gould St, Ste R, Sheridan, WY 82801, United States), which is the data controller for the personal information described here. "Tastefarer", "we" and "us" in this policy refer to Spare Time Ventures LLC.

1. What we collect

Tastefarer collects only what's needed to learn your travel taste, help you plan trips and hand you off to the venue or partner to book:

• Account information. Email address and display name when you sign in with Apple or email/password.
• Travel preferences. Swipe events on hotel, dining, and experience cards; structured profile fields (party size, budget caps, tempo); free-text notes you type during onboarding. Aggregated into your "Travel DNA" profile.
• Trip history. Trips you book or import, including hotels, flights, restaurants, activities, and post-trip ratings.
• Trip backup (snapshot sync). When you're signed in, the app keeps a copy of each trip as you see it in the app (its days, the places in it, your notes on it) on our server, so your trips come back in full when you sign in on a new or reinstalled phone. The copy is stored with the trip, is used only to restore it to you (it isn't read by our recommendation models or sent to AI providers), and is deleted with the trip or your account.
• Saved traveler info. Optionally, the names of the people you travel with, their relation to you (for example partner or child), and their loyalty programs. The app doesn't ask for or send passport numbers, Known Traveler Numbers (KTN), dates of birth, emergency contacts, dietary or health details, or payment cards for travelers. If an earlier test version of the app saved any of those, they stay encrypted at rest with Fernet (AES-128 CBC + HMAC), aren't used, and are deleted with your account.
• Payment methods. The app doesn't collect payment cards; you pay partners directly when you book. If an earlier test version saved a card, we hold only its brand and last four digits (the card itself was tokenized by Stripe and never stored on our servers), and it is deleted with your account.
• Location. When you allow location access ("While Using the App"), the app sends your approximate or precise location (accurate to about 100 metres) with a request for places near you — in Explore, Near You and the assistant — and we use it to answer that request. We don't save it to your account, your taste profile or your trips. To answer, our server may pass the coordinates to the service that searches for places (Google Places) or fetches the forecast (Visual Crossing). Our server's request logs, which we keep for troubleshooting, keep coordinates only rounded to about 1 km.
• Push token. An APNs token so we can deliver arrival, morning, post-trip, and concierge notifications.
• Device integrity (abuse prevention). To stop automated misuse of the features that cost us money to run (the assistant, AI planning, sign-up), the app uses Apple's App Attest: your iPhone creates a key that Apple certifies as belonging to a genuine copy of our app, and we store that key's identifier, its public key, a usage counter and Apple's certificate receipt, linked to the account last signed in on that device. The app also sends a random install identifier with its requests (created by the app and kept in your phone's Keychain), which stands in for App Attest where it isn't available. Neither is your device's advertising identifier or serial number, and we use them only for abuse prevention and per-device usage limits, never for advertising or tracking across apps.
• AI consent. Your answer to the app's AI permission question (allowed or not now) and when you gave it. It is stored on your device and, when you're signed in, with your account, so our server can honour it too (see "AI providers" below).
• Reports on assistant replies. When you tap Report on a reply: the reason you pick, your optional note, and identifiers of the conversation and reply (not the conversation's text). We store them with your account (included in your export, deleted with your account) and alert our team through a private Telegram channel so someone reviews it.
• AI usage records. For each call we make to an AI provider on your behalf: which feature made it, the model, the number of tokens, its cost, the time, and your account id (or the device identifier above when you're not signed in). We use these records to enforce fair-use limits and keep our AI spending in check. They don't contain your text. When you delete your account, your account id and device identifier are removed from them; the anonymous cost lines stay in our accounts.
• Waitlist. If you join the waitlist on tastefarer.com, your email address, when you joined, and the consent line you agreed to. We use it only to email you about Tastefarer's launch and early access; every such email has a one-click unsubscribe link and our postal address, and once you unsubscribe we keep the address only on a do-not-email list so it can't be added back by mistake.
• Subscription status and feature usage. For every signed-in account: a monthly count of how often you've used features that have free-tier limits (for example assistant messages) and how often a free-tier limit applied. If you subscribe to Tastefarer Pro, also which plan you're on, whether you're in a free trial, when it renews or expires, and whether the purchase was made in Apple's test environment. Apple handles the payment; we never receive your card or Apple ID payment details.

2. How we use it

• To learn your taste profile and rank hotels, restaurants, and experiences against it.
• To help you plan trips and hand you off to the venue or partner to book. We don't book or pay for anything on your behalf.
• To send you trip-related notifications you have opted into.
• To improve our recommendation algorithms in aggregate (we do not sell or share individual user data).

3. Third parties

Tastefarer integrates with travel and infrastructure providers strictly for the trip features the user has invoked:

• Places and travel search. Google Places (place details, opening hours and photos, fetched by our server), Hotelbeds / Nuitée and Viator (hotel and experience availability for a destination, dates and party size), AviationStack (status for a flight number you add). These lookups don't carry your name or contact details.
• Booking partners. Booking.com, hotels' own sites, Viator, OpenTable, Resy, SevenRooms and restaurants' own booking pages. When you tap a booking link you leave the app and book directly with that partner, under its own terms and privacy policy.
• AI. Anthropic and Google, as described in "AI providers" below.
• Push delivery. Apple Push Notification service (APNs).
• Subscriptions. Apple (App Store payments) and RevenueCat, Inc., which validates App Store purchases for us and tells our server your Tastefarer Pro status. RevenueCat receives your Tastefarer account id (a random identifier, not your name or email) and the App Store purchase records for that account; no payment details reach us.
• Forecasts. Visual Crossing, queried by our server with a destination or approximate coordinates and no personal details. Earlier test versions of the app also fetched forecasts directly from Open-Meteo; current versions don't contact Open-Meteo.
• Abuse prevention. Apple App Attest (see "Device integrity" above): Apple certifies that requests come from a genuine copy of the app.
• Crash reports and analytics. Google (Firebase Crashlytics and Google Analytics for Firebase), as described below.

Each integration is gated on the user invoking the feature that requires it — we do not silently call third parties in the background, with these exceptions: usage analytics (below); when you're signed in, a check with RevenueCat when the app starts so we know whether you have Tastefarer Pro; weather forecasts for your upcoming trips (Visual Crossing, no personal data); and AI work we start for you after you've used a feature — ranking a city's places against your taste the first time you browse it, and preparing "Picked for this trip" for a trip you created — which goes to the AI providers below like any other AI feature.

AI providers. Some features send text to an AI model that runs at one of two providers, which process it on our behalf to produce the answer and return it to us:

• Anthropic, PBC (the Claude API) — most features: the assistant chat, reading your onboarding note and a trip you describe in words, trip planning, reading confirmation PDFs you import, ranking places against your taste.
• Google LLC (the Gemini API, a paid Google Cloud service) — laying out your days, checking restaurants against dietary needs, and standing in for Claude when it is unavailable or over our monthly budget.

Some features can instead run on open-source models (Ollama) running on our own servers — not on your device; text handled that way doesn't leave our servers.

What is sent: the text you type into those features (your onboarding note, chat messages, trip notes, a trip described in words), the trip details the feature needs (destination, dates, who is travelling incl. children's ages, the places on your plan), the parts of your taste profile the feature uses, and the contents of confirmation PDFs you import. We don't send your email, password or payment details, and we don't send the encrypted traveler documents (passport, KTN). Which provider handles a feature can change as we tune quality and cost; a third-party AI provider is always one of these two.

Your permission. Before the app first sends your text to either of them, it asks your permission and names both (Allow / Not now). "Not now" keeps AI features off (the app asks again the next time you start one) — the rest of the app works without them, your onboarding note and trip notes stay on your phone instead of being sent with planning requests, and our server makes no AI call for you, including the background work described above. You can change your answer at any time in Profile → Settings → Data & Privacy → AI processing. Your answer is stored on your device and, when you're signed in, with your account, and the app sends it with every request so our server applies it too. Every assistant reply has a Report button: use it to tell us about a reply that is wrong, unsafe or offensive.

Neither provider may use what we send to train its models. Anthropic's commercial terms say it "may not train models on Customer Content" and it deletes API inputs and outputs within 30 days, except content flagged for a usage-policy review (Commercial Terms, retention). Google doesn't use prompts or responses of the paid Gemini API to improve its products, and logs them for a limited period only to detect abuse and meet legal obligations (Gemini API Additional Terms). We keep AI answers on our server for a limited time so the same question doesn't cost twice.

Usage analytics. The iOS app sends pseudonymous usage events to Google Analytics for Firebase — which screens you open and which features you use (for example "trip created, 3 nights" or "restaurant saved"), with a random app-instance id and, once you sign in, your Tastefarer account id. We never send your name, email, notes, chat messages, search text, or the places you pick by name, and we do not use analytics for advertising: advertising storage and personalization are switched off and the app does not read your device's advertising identifier. You can turn analytics off at any time in Profile → Settings → Data & Privacy → Share usage analytics.

Crash reports. The app uses Firebase Crashlytics (Google) to send a report when it crashes: the technical crash details, your device model, iOS version and app version. Crash reports carry no user id and aren't linked to your Tastefarer account. They follow the analytics switch: nothing is sent until your analytics choice applies, and turning off Share usage analytics turns crash reports off too. In the app, that switch reads "linked to your account when you're signed in, plus crash reports that aren't".

4. Storage & security

• Database: PostgreSQL hosted on private infrastructure.
• Loyalty member numbers, and any sensitive traveler fields an earlier test version saved (date of birth, passport, KTN): encrypted at rest with rotating Fernet keys.
• Authentication tokens: stored in iOS Keychain on the device.
• Transport: TLS 1.2+. The app talks to our API only over HTTPS.

5. Your rights

You can:

• Export your data. Profile → Settings → Data & Privacy → Export my data. Returns a single JSON file with everything we hold about your account.
• Delete your account. Profile → Settings → Account → Delete account. Cascade-deletes account, preferences, swipe history, trips, bookings, feedback, traveler profiles, payment methods and subscription usage counters server-side; on success, also wipes local storage and Keychain. Deleting your account doesn't cancel a Tastefarer Pro subscription (cancel it in your Apple ID settings), and Apple and RevenueCat keep their own purchase records under their own policies.
• Wipe local data only. Profile → Settings → Data & Privacy → Delete local data. Clears device state without touching the server (useful when sharing a device).
• Stop marketing email. Use the unsubscribe link at the bottom of any Tastefarer email, or write to us at the contact address below.
• Change your AI consent. Profile → Settings → Data & Privacy → AI processing. Withdrawing it stops the app from sending new text to the AI providers; what was already sent is handled under their retention terms above.
• Stop notifications. Profile → Settings → Preferences → Notifications, or via the iOS Settings app.

6. Children

Tastefarer is intended for users 18 and older. Before an account is created, the app asks for your date of birth; the check runs on your device, the date itself is never sent to us, and we keep only the time you confirmed. If the date shows you're under 18, no account is created and that device stays blocked from creating one. We do not knowingly collect personal information from children; if we learn that an account belongs to someone under 18, we delete it and its data. Parents or guardians who believe their child has given us information can write to the contact address below. If a child traveler is added to your saved traveler list, that data is treated as belonging to the parent or guardian operating the account.

7. Changes

We may update this policy as features evolve. Material changes will be surfaced in the app prior to taking effect.

8. Contact

Questions about privacy: [email protected].

Postal: Spare Time Ventures LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States.