Privacy Policy

1. Introduction

At VoyaZen (“we,” “us,” “our”), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our mobile application, website, and related services (collectively, the “Services”).

VoyaZen is an AI-powered travel companion designed to help you plan, experience, and reflect on your trips. The application is offline-first, meaning the vast majority of your data is stored locally on your device. Cloud services are used selectively for AI processing, analytics, crash reporting, subscription verification, place discovery, and media retrieval.

2. Data We Collect

2.1 Information You Provide Directly

VoyaZen does not require an account to function. You may use the app entirely offline with a local profile. When you use VoyaZen, you may voluntarily provide:

2.2 Information Collected Automatically

• Device Information — OS version, device model, app version, build type;
• App Usage Events — Screen views, feature usage (e.g., trip_created, budget_revision_created) — only with explicit consent;
• Crash Logs — Stack traces, error messages, breadcrumbs;
• Network Information — IP address (ephemeral, processed at edge);
• Location Data — GPS coordinates — foreground only, when you explicitly grant permission and use map features;
• Currency Preferences — For exchange rate fetching;
• A/B Experiment Variants — Onboarding variant, lens quota variant, etc. (product optimization).

Analytics consent: Analytics collection is off by default. No analytics events are emitted until you explicitly grant consent during onboarding. You may withdraw consent at any time in Settings.

2.3 Information from Third Parties

• Apple / Google App Stores — Subscription status, purchase receipts (via RevenueCat);
• Exchange Rate Providers (TCMB / Frankfurter) — Live rates fetched based on your configured currencies;
• Pexels / Unsplash — Place and destination images for POI discovery (via backend servers);
• Nominatim / OpenStreetMap — Geocoding data for place search;
• Firebase Remote Config — Feature flags and A/B experiment configuration.

VoyaZen does not use Facebook authentication or any social login provider. No account is required to use the app.

3. Legal Basis for Processing

For KVKK users in Türkiye: Processing is conducted in accordance with Law No. 6698 on the Protection of Personal Data. Explicit consent is obtained where required, and data subjects are informed per Article 10.

4. How We Use Your Data

1. Provide the Services — Store and display your trips, budgets, expenses, itineraries, and journal entries; generate AI recommendations and itineraries; calculate expense splits; provide place discovery and culinary intelligence.
2. Improve the Services — Analyze anonymous usage patterns, A/B test variants, and crash reports to fix bugs and enhance features — only with your explicit consent.
3. Process Payments — Verify subscription status through RevenueCat and the app stores.
4. Send Notifications — Deliver trip reminders, budget alerts, and daily summaries (only with your permission).
5. Provide AI Assistance — Send your trip context and queries to OpenAI via our backend servers to generate travel recommendations, itineraries, cultural insights, and conversational responses.
6. Provide Place Discovery — Query our backend servers and geocoding providers to find places, restaurants, and attractions near your destinations.
7. Retrieve Media — Fetch destination and place images from Pexels and Unsplash via our backend servers.
8. Collect Feedback — Receive user-submitted feedback via our backend servers.
9. Ensure Security — Monitor for errors, fraud, and unauthorized access. All API calls are encrypted and authenticated.
10. Comply with Legal Obligations — Respond to lawful requests from authorities.

5. Data Storage & Architecture

5.1 Local Storage

• App Database — All structured data (trips, expenses, budgets, chat history, journal, itineraries, saved people, expense splits, lessons learned, checklists);
• Local Cache — Cached place data for offline use (automatically cleared when expired);
• App Settings — Your preferences, notification settings, analytics consent state, and permission states;
• File System — Receipt photos, journal photos, backup files, and exported documents.

5.2 On-Device Processing

The following data is processed entirely on your device and never transmitted to external servers:

• Receipt OCR — Google ML Kit Text Recognition processes receipt images on-device;
• Voice Transcription — Whisper (on-device) and speech recognition process spoken input locally;
• Trip Creation by Voice — Speech recognition for hands-free trip creation is processed on-device.

5.3 What Leaves Your Device

The following data is transmitted to external services — only when the relevant feature is used and, where applicable, with your consent:

• Analytics events (anonymous, consent-gated) to Firebase Analytics;
• Crash logs to Firebase Crashlytics;
• AI queries & trip context to OpenAI via our backend servers;
• Lens URL processing requests to our backend servers for POI extraction;
• POI discovery queries to our backend servers for place search;
• Media image requests to our backend servers for place and destination images;
• Saved places to our backend servers to improve itinerary generation and place discovery;
• Geocoding queries to Nominatim / OpenStreetMap;
• Exchange rate requests to TCMB and Frankfurter;
• Subscription data to RevenueCat and Apple/Google;
• Feedback submissions to our backend servers;
• Firebase Remote Config fetches for feature flags and A/B experiment configuration;
• Font requests to Google Fonts CDN.

All API calls to our backend servers are encrypted and authenticated. API keys for third-party services are stored exclusively on our servers and are never embedded in the app binary.

6. Third-Party Processors & Data Sharing

We do not sell your personal data to any third party.

VoyaZen does not integrate with Facebook, Meta, or any social login provider.

7. AI Data Processing

7.1 How AI Works

When you use AI features (itinerary generation, travel chat, cultural insights, culinary suggestions), your trip context and query are sent to our backend servers, which forward them to OpenAI’s API. The response is displayed in the app. AI conversation history is stored locally on your device. All API calls are encrypted and authenticated.

7.2 AI Data Retention

Per OpenAI’s policies, data sent via API is not used to train OpenAI’s models unless explicitly opted in. We do not opt in on your behalf.

7.3 On-Device AI / ML Processing

The following AI/ML processing occurs entirely on your device:

• Receipt OCR — Google ML Kit Text Recognition (no images leave your device);
• Voice Transcription — Whisper (on-device) for trip creation and Lens audio processing;
• Speech Recognition — Spoken input for hands-free trip creation.

7.4 AI Guardrails

We implement domain guardrails to prevent the AI from responding to off-topic queries (e.g., medical, legal, coding, political). The AI is restricted to travel-related topics only.

7.5 AI Cost Discipline

AI features are designed with cost discipline: cloud LLM calls are reserved for high-value moments (itinerary generation, conversational assistant, content synthesis). Rule-based logic, cached data, and on-device ML handle the majority of app intelligence without cloud AI calls.

8. Cookies & Tracking

8.1 Mobile App

The VoyaZen mobile app does not use traditional cookies. We use:

• Firebase Analytics to track anonymous app usage events — only after you explicitly consent during onboarding;
• Firebase Crashlytics to collect crash reports;
• Firebase Remote Config to fetch feature flags and A/B experiment configuration;
• Local storage to store app settings, consent state, and preferences on your device.

8.2 Website

If you visit our web pages (e.g., Terms of Service, Privacy Policy hosted at voyazen-bxu.pages.dev), standard web server logs and any cookies set by the hosting platform (Cloudflare Pages) may apply. See Cloudflare’s Cookie Policy.

9. Data Retention

When you delete the app, all local data is removed from your device. Anonymous analytics data and crash logs already transmitted to Firebase may be retained according to Firebase’s policies. Feedback already submitted to our backend servers is retained for product improvement purposes.

10. Your Rights

10.1 GDPR Rights (EU/EEA)

• Access — Request a copy of your personal data;
• Rectification — Correct inaccurate or incomplete data;
• Erasure — Request deletion of your data;
• Restrict Processing — Limit how we use your data;
• Data Portability — Receive your data in a structured format (JSON/ZIP export supported);
• Object — Object to processing based on legitimate interests;
• Withdraw Consent — Withdraw consent at any time;
• Lodge a Complaint — File a complaint with your local data protection authority.

10.2 KVKK Rights (Türkiye)

Under Law No. 6698, you have the right to learn whether your personal data is being processed, request information about processing, learn the purpose of processing, know third-party recipients, request correction or deletion, object to automated decision-making, and claim compensation for damages from unlawful processing.

10.3 CCPA/CPRA Rights (California)

• Right to Know — Request disclosure of categories and specific pieces of personal data;
• Right to Delete — Request deletion of your personal data;
• Right to Opt-Out — Opt out of the sale of personal data (we do not sell data);
• Right to Non-Discrimination — We will not discriminate for exercising privacy rights;
• Right to Correct — Correct inaccurate personal data;
• Right to Limit Use of Sensitive Personal Information — We do not collect sensitive personal information as defined by CPRA.

10.4 PIPEDA Rights (Canada)

• Access — Request access to your personal information;
• Challenge Accuracy — Challenge the accuracy and completeness of your information;
• Withdraw Consent — Withdraw consent for collection, use, or disclosure.

10.5 How to Exercise Your Rights

11. International Data Transfers

VoyaZen is operated from Türkiye. Your data may be transferred to and processed in the United States (Firebase, RevenueCat, OpenAI, Cloudflare, Google, Pexels, Unsplash, Resend), the European Union (Cloudflare edge locations, Frankfurter), and Türkiye (TCMB, developer operations).

For transfers outside the EEA, we rely on Standard Contractual Clauses (SCCs) and adequacy decisions where applicable. Most user data remains on your device and is not transferred internationally.

For KVKK compliance, cross-border transfers are conducted in accordance with Articles 9 and 10 of Law No. 6698.

12. Security Measures

• Local-only storage for sensitive trip and financial data;
• Standard device encryption relying on iOS/Android full-disk encryption;
• Encrypted HTTPS connections for all network communications;
• Encrypted and authenticated API calls to all backend services;
• No plaintext storage of passwords or financial credentials;
• API key protection — keys for third-party services are stored server-side, never exposed in the app binary;
• Analytics consent gating — no analytics data is collected without explicit user consent;
• Foreground-only location — location is accessed only while the app is in use;
• Offline-first architecture — the majority of your data never leaves your device.

No security system is impenetrable. You are responsible for securing your device (e.g., using a passcode or biometric lock).

13. Children’s Privacy

VoyaZen is not intended for children under 16. We do not knowingly collect personal data from children under 16. If we learn that we have collected data from a child under 16 without parental consent, we will delete it promptly. Parents or guardians may contact us at voyazen2026@gmail.com.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be communicated through in-app notifications and updates to the “Last Updated” date. Your continued use of the Services after changes take effect constitutes acceptance of the revised Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

For EU residents, you may lodge a complaint with your local data protection supervisory authority.

For Türkiye residents, you may file complaints with the Personal Data Protection Authority (KVKK) at www.kvkk.gov.tr.

By using VoyaZen, you acknowledge that you have read, understood, and agree to this Privacy Policy.