The Travel Binder is a fully local app. Your trips, flights, hotels, bookings, confirmation codes, places, packing lists, checklists, notes, documents and loyalty numbers are stored only on your device, in a database no one else can reach. There is no account, no login, no server of ours and no cloud sync. We cannot see, access, or recover your data — including if you lose the device. The app can keep its own backup in your iCloud Drive or Google Drive, described below; that copy is yours, not ours.
When you attach a photo or a PDF — a passport scan, an insurance certificate, a rail pass, a booking confirmation — the app opens your camera or file picker only at the moment you choose the file. The file is then copied into the app's own storage on your device. Attachments are never uploaded, scanned, or read by us.
You can share a booking confirmation, a PDF, a screenshot, an email file or a boarding pass into the app from another app, import one from your files, or scan a printed one with the camera. On iPhone and iPad the Travel Binder share extension receives only the item you choose to share and hands it to the app inside your device; it reads nothing else. The app reads the item on your phone with a set of fixed rules (and, for a PDF, a picture or a scan, text recognition that runs on the device: Apple's Vision on iPhone and iPad, and on Android Google's ML Kit text recognition model, which Google Play services downloads once, when the app is installed, and shares with other apps; from then on it works without a connection), shows you what it found, and saves nothing until you tap Add. The text is never sent anywhere, never seen by us, and never used to train anything. On Android, ML Kit may send Google anonymous figures about how the feature performs and is used, never the picture or the words in it. A shared PDF or picture is kept with the booking as its ticket; a shared email is not kept. An audio file or voice memo you share in is kept in that trip's Docs as it is. The app never reads your inbox.
If you record a voice note, the app asks for the microphone the first time and uses it only while you are recording. The recording is stored in the app's own storage on your device, like your other documents; it is never uploaded or heard by us. You can decline the microphone, or revoke it later in your system settings, and the rest of the app carries on working.
For a trip that starts within the next ten days, the app fetches a short daily forecast for the places on its route, about once a day: from Apple Weather on iPhone and iPad, and from the Norwegian Meteorological Institute (MET Norway, api.met.no) on Android. Each request carries only a place's coordinates — never the trip, its name, its dates or anything else you entered — and is governed by that provider's privacy policy. Sunrise and sunset are worked out on your device. You can switch the forecast off in Settings → Forecast, and the app then makes no weather requests at all.
With Premium, Fill in writes a country's emergency numbers, plugs and driving side, and a phrase list for its language, into a note. All of it is bundled inside the app (country facts from Wikidata, released into the public domain), so filling a note sends nothing. When you tap a phrase to hear it, your device's own voices speak it on the device.
If you turn on Lock Docs, the app asks your device to confirm it is you (Face ID, Touch ID, a fingerprint, your face or your passcode) before it shows a trip's documents. That check is done entirely by your device's operating system: the app only learns whether it succeeded, and never receives or stores your face, fingerprint or passcode.
Your pins are coordinates saved in your own trip and drawn by the app, so they appear correctly with no connection at all. Background map imagery is different: those tiles come from your device's map provider — Apple Maps on iOS, Google Maps on Android — and fetching them requires a connection to that provider, governed by their privacy policy rather than this one. Typing coordinates directly, or pasting a full map link, is read on your device and sends nothing. A short map link (maps.app.goo.gl) is opened once, when you add it, to read where it points. For a stay, finding its town from a pasted link asks your phone's built-in map service, which sends that pin's coordinates to Apple or Google. The towns you add to a route are looked up in a list bundled inside the app (town data © GeoNames, used under CC BY 4.0), so choosing a destination sends nothing anywhere. None of these requests carries your trip. Each one sees a map area, a link or a single pin — never your itinerary, your bookings, or your other pins. Nothing else about your places leaves the device. The Atlas, the route diagram on a finished trip, and every share card are drawn by the app from your own data with no map imagery whatsoever, so nothing you share is ever assembled by, or routed through, a map provider. If you tap Directions, a single destination is handed to your own maps app and you leave The Travel Binder entirely. From that point onward that app's privacy policy applies rather than this one. On iPhone and iPad, when you type where an entry is, the app may suggest matching places: the words you type, and the approximate location of that day's place on your route, are sent to Apple Maps to find them. The Android app does not search for places as you type. Nothing is sent until you have typed three letters, and nothing about the rest of your trip goes with it. The app does not ask for location permission, does not use your device's location, and does not record your movements.
Checklist due dates and trip-day reminders are scheduled locally by your device. Nothing about a reminder is sent to any server. You can decline the notification permission, or revoke it later in your system settings, and the rest of the app carries on working.
With Premium you can add a trip's bookings to your device's calendar. The app asks for calendar access the first time, writes each booking as an event in your default calendar, and keeps a reference to the events it created so it can update or remove them later; it does not read your other events. If your calendar is synced (for example with iCloud or Google), that sync is done by your calendar provider under its own privacy policy. You can remove the events from the export sheet, or revoke calendar access in your system settings.
The home-screen widget and the countdown card on your lock screen show your next trip and departure from a small file the app writes on your device. They read nothing else and send nothing anywhere. A departure's confirmation code and cost are never shown on them.
Exporting your trip — as PDF, Markdown, JSON, CSV or a trip bundle — produces a file that is handed to whichever app or destination you pick from your device's share sheet. Where that file then goes, and who can read it, is entirely your decision. We never receive a copy. Share cards are images you generate and send yourself. Because a booking reference on a public post is a genuine leak, confirmation codes are replaced with dots on every share card by default, and costs are left off unless you deliberately switch them on.
The app backs up your trips automatically to your own cloud storage, so a new or reset device can bring them back. On iPhone and iPad the backup goes to the app's own folder in your iCloud Drive; it is not shown in the Files app. On Android it goes to a hidden app folder in your Google Drive, after you choose Back up and allow it on Google's own screen; the app asks only for access to that hidden folder, which it alone can read, and never to your other files or to your Google account details. Each backup is a single file holding your trips with their documents, photos, voice notes and covers, plus your lists, loyalty programmes and stamps. Each backup also carries a small summary — the date, the app version, how many trips, bookings, places and files it holds, and each trip's name and dates — so the app can list your backups and show what is in them. The sample trip is never included. The app keeps the three newest backups from each device and removes older ones. The backup travels from your device straight to Apple or Google; we never receive a copy, and it is stored under their privacy policies like your other files there. Restoring always adds trips beside the ones you already have and never changes or removes anything. You can turn automatic backup off in Settings, which stops uploads. To delete the backups themselves, use iOS Settings → your name → iCloud → Manage Storage → The Travel Binder, or Google Drive → Settings → Manage apps → The Travel Binder → Delete hidden app data. Deleting the app does not delete these backups.
The Travel Binder uses Firebase Crashlytics to collect anonymous crash diagnostics: device model, operating system version, and the technical state of the app at the moment it failed. No personal information, trip data, documents, photos, or coordinates are ever included. Crash reports exist solely so we can find and fix defects.
The Travel Binder uses Google Analytics for Firebase to understand which features are used, so we can improve the app. It records anonymous, pseudonymous signals only — which screens you open, how often core features are used, the app version, your device model, and your coarse region (country level). It never records anything you type, attach, or photograph: not a trip, an itinerary entry, a confirmation code, a note, a document, or a cover photo. Where a stamp is earned, only that it was earned is recorded — never which countries it represents. Analytics is never used for advertising: advertising-personalisation signals are switched off, and analytics does not read your advertising identifier. Crash reporting, above, is separate and covered under our legitimate interest in keeping the app working.
From version 1.2.58, the free version shows a single banner advertisement. It appears on the trips list and across a trip's sections, and never as a full-screen ad. Versions 1.1.31 to 1.2.57 show no advertisements and contain no advertising software. Versions 1.0.30 and earlier showed a banner served by Google AdMob, which may collect device identifiers to serve ads, after asking for consent where the law requires it. Ads are served through Appodeal, an advertising mediation platform, and the ad networks it works with (including AppLovin, BidMachine, Digital Turbine, InMobi, ironSource, Liftoff, Mintegral, myTarget and Unity Ads). To choose, show and measure ads, they may collect your device's advertising identifier, your coarse location (derived from your IP address), your device type and operating system, and which ads you see and tap. None of your trips, documents, photos or notes is ever shared with them. Before any ad is requested, you are asked for your consent choices where the law requires it (for example in the EEA, the UK and Switzerland). On iPhone and iPad, Apple's tracking prompt then asks whether ads may use your activity across other companies' apps and websites. If you decline either, ads are still shown, but they are not personalised. You can change your consent choices at any time from Settings → Manage Ad Consent, and your tracking choice in your device's Settings. Appodeal's own policy is at https://appodeal.com/privacy-policy. Premium — the one-time unlock or the monthly subscription — removes advertising entirely: the ad software is not started at all.
Premium, whether the one-time unlock or the monthly subscription, is processed by Google Play or the Apple App Store. We never see or handle your payment details. A subscription is managed and cancelled in your store account.
Everything in the app is yours. You can export it in open formats at any time, and deleting the app removes every trip, document and photo it held from your device; backups in your own iCloud Drive or Google Drive stay until you delete them there. There is no central copy of ours to request, correct, or erase, because one was never made.
If this policy changes, the revised version will appear on this page with a new date, and the copy inside the app will be updated to match.
Questions about this policy are welcome at admin@eritech.studio.