Traulo Privacy Policy

This Privacy Policy explains how we collect, use, share and protect your personal data when you use the Traulo mobile application and the website at www.traulo.com (together, the "Service").

We follow the European General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Slovenian Personal Data Protection Act (ZVOP-2), the Slovenian Electronic Communications Act (ZEKom-2) and the Slovenian Consumer Protection Act (ZVPot-1).

---

1. Who we are

The data controller responsible for your personal data is:

Računalniške storitve REK, Mihael Rek s.p. Ulica heroja Jevtiča 5, 2000 Maribor, Slovenia Matična številka: 7412037000 Davčna številka: 89184882 Privacy contact: [email protected] Postal contact: the address above

We act as the controller under GDPR Article 4(7) for personal data processed through the Service. We have not appointed a Data Protection Officer; under GDPR Article 37 a DPO is not required for our scale and processing activities. You can reach our privacy contact directly at the email or postal address above.

---

2. What we collect

We collect only the personal data we need to deliver the Service, comply with our legal obligations, and protect the Service against abuse. We never sell your personal data and we never share it for third-party advertising.

2.1 Identity and account data

When you create an account or sign in, we collect:

• Your email address
• A user-chosen handle (username) and optional display name
• An identifier from your chosen sign-in provider — the opaque Apple user identifier (Sign in with Apple), or your Google account ID and the email/name claims you choose to share (Google Sign-In)
• Passkey credentials (WebAuthn public key, credential ID) for two-factor authentication, if you enroll one
• An optional avatar image that you upload
• An optional phone number in E.164 format, if you add it in your profile — stored alongside a one-way SHA-256 hash to allow contact matching (see §2.7). Clearing the field in Settings removes both. We never use your phone number for marketing or SMS notifications.

Profile visibility. Profiles are private by default. If you choose to make your profile Public in Settings → Account → Profile visibility, your handle, display name and avatar become visible to all Traulo users and to any unauthenticated visitor of www.traulo.com/@<handle>. Your vlog count, follower count and following count are also shown on that public profile page. You can revert to private at any time; doing so immediately hides your profile page from non-followers.

Public profiles, public vlogs and published trip guides are also discoverable through in-app search and through the discovery and search features on www.traulo.com — including by visitors who are not signed in — and may be indexed by external search engines. Only content you have made public is exposed this way; private profiles, private vlogs and unpublished plans are not.

2.2 Device data

When the app connects to our backend, we collect:

• A device identifier generated locally on first launch
• The Apple Push Notification Service token that allows us to deliver push notifications you have asked for
• Your device's platform (iOS), app version, build number and locale (e.g., sl_SI)
• The IP address of API requests and a short User-Agent string (kept in session records to detect token theft and to revoke compromised sessions)

2.3 Content and media data

Traulo generates short vertical vlogs from media you choose. To do this we process, on your device:

• Photos and videos you select from your camera roll
• The technical metadata of those assets — creation timestamp, duration, resolution, frame rate, video codec, perceptual hashes (for deduplication), aesthetic scores (computed locally with Apple's Vision framework), and any EXIF location the camera embedded
• GPS waypoints (latitude, longitude, altitude, speed) sampled from location-tagged assets and used to compose the vlog's route
• Reverse-geocoded city and country names derived from those coordinates

When you save a vlog to the cloud (every account can save publicly shared vlogs within the free 1 GB allowance; paid plans can also save private vlogs, with more room), the following data is uploaded to our backend:

• The rendered vlog video file (MP4) and thumbnail image
• A composition snapshot in JSON form — the title, mood, music selection, captions, asset references, GPS waypoints, peak altitude and reverse-geocoded city/country
• The size of the file and our internal storage key

If you do not save a vlog to the cloud, none of this is uploaded — it stays on your device.

Trip plans and guides. Traulo can turn a trip into a structured trip plan or guide — a day-by-day itinerary with places and stops (their names and coordinates), a route, written notes and tips, and photos you attach to individual stops. A guide may also include GPS route tracks you import (for example from a .gpx file — a sequence of latitude/longitude/elevation points and the timestamps recorded with them) together with the type of activity (such as a hike or a bike ride). We store this so we can show and let you edit your plan. When you publish a guide it becomes public content that others can view and save (see §2.1 here and §8.8 of the Terms); a plan you keep private stays in your account and is not shown to other users.

2.4 Usage and behaviour data

To improve the auto-selection algorithm and protect against abuse we record, server-side:

• Feed and viewing activity — for each public vlog or guide shown to you in a feed we record, against your account, how many times it was shown to you, how long you watched it, whether you watched it to the end, and whether you opened it. We use this in two ways: to shape what your own feed shows you next (so you are not shown the same post over and over, and so posts closer to what you actually watch rank higher), and — in aggregate across all viewers, not as your individual record — to score how well a post holds attention, which feeds the Explore rankings and the weekly Editor's-choice selection described in §2.8 and §4. We store one row per viewer per post, not one per event, and delete it after 90 days.
• Auto-select telemetry events — anonymised at the algorithmic level (per-asset decisions, asset actions, composition completions and abandonments). Stored in monthly partitions and deleted after 30 days; aggregated rollups are retained for up to 2 years.
• Abuse signals — rate-limit breaches, schema rejections, deduplication storms, oversize batches. Used to detect and block automated abuse.
• AI quota ledger — a per-month count of AI editorial requests you have made, with a request identifier (no content).
• AI call log — for each AI editorial request: model used, token counts, cost, latency, error code (if any). The request body itself is not retained.

If you turn on telemetry opt-out in Settings, we no longer record auto-select telemetry for you. Feed and viewing activity is not covered by that switch — it is what makes a ranked feed work at all — but it is never shown to other users, never used for advertising or for tracking you across other apps and websites, and is deleted on the 90-day cycle above. Abuse signals and AI call logs are kept under our legitimate interest in operating the Service safely.

2.5 Diagnostics

We use Firebase Crashlytics and Apple's MetricKit to collect crash logs and performance diagnostics. These include:

• Crash stack traces and the application state at the moment of the crash
• Performance metrics (launch time, hangs, energy, disk space)
• Your user identifier (so we can correlate crashes with the affected account and reach you if there is an account-level problem)

2.6 Billing data

We use RevenueCat (and, for App Store purchases, Apple) to manage subscriptions and one-time in-app purchases. We receive, depending on the product:

• Your subscription status (active / trial / grace / expired / canceled / refunded), the plan you are on, the billing period and the anniversary day — for auto-renewing subscriptions (Traveler / Daily Vlogger)
• A record of one-time purchases — product ID, purchase date and the AI-vlog quota credited to your account — for consumable AI vlog packs (10 / 20 / 100)
• A non-financial purchase or subscription identifier issued by RevenueCat or Apple

Apple is the merchant of record for App Store purchases. We never see your payment card or bank account details.

2.7 Contacts (optional)

When you tap "Find friends from your contacts" in the Search tab, Traulo asks iOS for permission to read your address book. If you grant it:

• We compute a one-way SHA-256 hash of each contact's email address and phone number on your device.
• We send only the hashes to our servers. We discard them after the lookup completes.
• We never store your contacts, their names, their phone numbers, or their email addresses on our servers.
• If a contact's own Traulo account email or phone matches one of those hashes, we show them to you so you can follow them.

You can revoke contacts access at any time in iOS Settings → Privacy & Security → Contacts → Traulo. If you deny or revoke access, the feature is simply unavailable — no other functionality is affected.

2.8 Social graph and interactions

When you use the social features of the Service, we collect and store the following data:

• Follow relationships. When you follow another user, or when another user follows you, we record the follow relationship, the user identifiers involved, and the timestamp. Your follower count and following count are displayed on your public profile if it is public. The identities of your individual followers and followees are not currently shown to other users — only aggregate counts are.
• Hearts (likes). When you heart a vlog, we record the interaction linked to your account, the vlog identifier, and a timestamp. The vlog's total heart count is visible to the creator and, on public vlogs, to all viewers. We do not currently display which specific accounts hearted a vlog to third parties.
• Block relationships. When you block a user, we record the block so that it can be enforced consistently across the Service. Block relationships are not visible to the blocked user or to third parties.
• Comments. When you post a comment on a vlog, we store the comment text, your account identifier, the identifier of the vlog, and a timestamp. A comment on a public vlog is visible to anyone who can see that vlog. You can delete your own comments, and the creator of a vlog can delete comments on their vlog or turn comments off; deleting a comment removes it from the Service (subject to backup rotation). We may notify a creator that you commented on their vlog.
• Companion tags and trip groups. When you tag another user as a companion on a trip — or another user tags you — we record the tag and the identifiers of the participants, the trip and trip-group identifier, each participant's own point-of-view (POV) vlog reference, and timestamps, so the participants' POV vlogs of the same trip can be presented together. This means another user can associate your account with a trip by tagging you, and you can do the same to them. Each participant controls their own POV vlog and its visibility, may decline or remove a tag, and may leave the trip group; doing so removes their participation and POV vlog from the shared trip. Companion stat cards generated from this data (for example, "You & @handle") may include the other participant's handle, display name, avatar and aggregate trip statistics.
• Saved guides (bookmarks). When you save another user's published trip guide, we record that you saved it, the guide identifier and a timestamp, so you can find it again and so the creator can see an aggregate count of how many people saved their guide. We do not show creators the identities of individual savers.
• Guide lineage (remixes). When you create a trip guide inspired by another published guide, we record the link between the two guides ("inspired by") and may display that attribution publicly, so the original creator is credited.
• Public rankings ("Top travellers"). Explore shows a public ranking of travellers, ordered on aggregate statistics derived from your own public vlogs — the number of distinct countries and distinct places you have posted from, and how many of your vlogs qualify. Only accounts whose profile is public are eligible; if your profile is private you are never listed, and switching it back to private removes you. If you would rather not appear while keeping a public profile, write to [email protected] and we will exclude your account from the ranking.
• Editor's choice. Once a week the Service selects a small set of already-published public guides to feature in Explore, on the globe and in the feed. Selection is automated and is described in §4. If a guide of yours is selected we display it — with your handle, display name and avatar — to other users, notify you, and generate a short one-line blurb for it.

Social graph data is used solely to operate the social features of the Service and to protect users from harassment. We do not sell, license or share it with third parties for advertising, profiling or any purpose other than operating the Service.

2.9 What we do NOT collect

To be specific: we do not collect health or fitness data, browsing history outside our app, search history, sensitive personal data within the meaning of GDPR Article 9, or financial information beyond purchase history. We do not access your contacts without your explicit permission (see §2.7 for how contact matching works when you opt in). We do not use your data for tracking across apps or websites (see §2.10 for how third-party booking links work when you choose to tap one, and §2.11 for the website analytics you can accept or decline — which measures our own site only, with advertising features switched off).

2.10 Booking suggestions and affiliate links

Inside trip guides we may show booking suggestions — such as stays, flights, activities, airport transfers or eSIM data plans — from third-party travel partners. To produce them we send a partner, or our affiliate-link provider, only the non-personal inputs needed for the lookup: a guide's destination place names and coordinates and, for flights, the major airports nearest your home region. We do not send your name, email, account identifier or device identifier to these partners.

When a suggestion is an affiliate link and you tap it, you are redirected out of Traulo to the partner's own website or app. From that point the partner is the controller of any data you give it, and its own privacy policy and cookies apply. So that the click can be attributed for our commission, our affiliate provider receives an attribution code that identifies the guide and its creator — not you. We also keep an internal, append-only log of these clicks (the guide, the creator and the partner's domain, with a timestamp) to calculate earnings; that log contains nothing that identifies the person who clicked.

We do not sell your personal data and we do not share your identity with these partners for advertising. Tapping a booking suggestion is always optional. The processors and partners involved are listed in §5.

---

2.11 The website: cookies and analytics

This section applies to www.traulo.com — the website where you can browse Traulo, sign in, and view your own vlogs, guides and travel map. The iOS app does not use cookies; everything below is about the site.

Cookies we set to make the site work. These are set because the site cannot do what you asked without them. Under the ePrivacy rules they are strictly necessary or the direct result of a choice you made, so they do not require your consent.

We also keep a few small values in your browser's own storage. These are not cookies and are never sent to our servers with your requests: traulo.device, a random identifier for this browser so that a passkey registered here is recognised at your next sign-in; and av_home / av_region, the departure point and region you last chose when viewing travel suggestions in a guide. Clearing your browser's site data removes all of them.

Analytics, only if you say yes. We use Google Analytics to understand how the website is used — which pages people open, on what kind of device, and roughly where in the world they are.

Nothing analytics-related loads until you accept it. When you first visit, we ask. Until you answer, and permanently if you answer No, no analytics script is loaded, no analytics cookie is set, and no data reaches Google. Declining costs you nothing: signing in, your language, your map style and every feature of the site work exactly the same either way.

If you accept, Google Analytics sets its own cookies to recognise a returning browser and count visits. We configure it with advertising features switched off — no ad personalisation, no ad targeting, no advertising identifiers — and with IP anonymisation on. We do not use it to follow you onto other websites, and we do not combine it with your Traulo account.

Changing your mind. Clear your browser's cookies for www.traulo.com and we will ask again on your next visit. You may also use Google's own opt-out browser add-on. Withdrawing consent is as easy as giving it.

Legal basis: your consent (GDPR Article 6(1)(a); ZEKom-2 Article 157). This is the only place in Traulo where consent is the legal basis, which is why it is the only place we ask.

Sign-in providers. If you choose Continue with Google or Continue with Apple, that provider's script loads at the moment you open the sign-in panel — not before, and not at all if you never try to sign in. From that point the provider's own privacy policy also applies to the sign-in exchange. We receive only what §2.1 describes.

---

3. Why we process your data and on what legal basis

Where we rely on legitimate interests, we have weighed them against your fundamental rights and freedoms. You can object to that processing at any time (see Section 8).

---

4. Automated decision-making

Traulo uses artificial intelligence (Anthropic's Claude model, via our backend) to suggest an editorial composition for your vlog — which clips to feature, in what order, and with what tone. These suggestions are not solely automated decisions within the meaning of GDPR Article 22(1): you can always preview, edit, override or discard them before exporting your vlog. They produce no legal or similarly significant effect on you. We do not profile you for credit, employment or other consequential purposes.

We also use the same AI to draft and enrich trip-guide text — titles, descriptions and tips. For a plan you keep private, the request may include the place-names of your home and base location and your trip dates as context, so the suggestions are more relevant; this text is likewise a non-binding suggestion you can edit, accept or discard.

We also rank content automatically. Your feed is ordered by an algorithm using the feed and viewing activity in §2.4, who you follow, where you have travelled, and how each post performs with viewers generally. Explore rankings and the weekly Editor's-choice selection run on aggregate signals across all viewers: a deterministic score built from how completely a post is watched, how often it is re-watched, its hearts, saves and comments over the previous seven days, whether it carries a title and description, its length, and whether a trip guide is attached — with per-creator, per-country and per-region diversity limits applied afterwards. Once a set is chosen we ask Claude to write a one-line blurb for each featured guide, from that guide's title, description and country only. An administrator can override or remove any selection by hand.

None of this is a solely automated decision within the meaning of GDPR Article 22(1). It decides the order in which public content is displayed — not whether you may use the Service, what you are charged, or what you are entitled to — and produces no legal or similarly significant effect on you. Being featured is editorial: it is not a benefit you are entitled to and carries no payment.

In line with EU AI Act Article 50 (transparency obligation for AI systems generating content), this Privacy Policy is the place where we tell you that AI is used to suggest editorial choices for your own vlogs and guides, and to write the one-line blurb shown with an Editor's-choice pick.

---

5. Who we share your data with

We share personal data only with the processors listed below, each acting under a Data Processing Agreement that complies with GDPR Article 28. We never sell your data.

Staff access to private content. Your cloud-saved vlogs are encrypted at rest and are not browsed by staff in the ordinary course of business. An authorised administrator may access the content of a specific vlog only in the following three circumstances: (a) investigating a credible report of illegal or harmful content submitted through the in-app reporting flow or by a competent authority; (b) responding to a valid legal order or binding request from a law-enforcement or judicial authority; or (c) diagnosing a technical fault at your express written request to [email protected]. Every access is recorded in an audit log — which staff member, which vlog, the timestamp, and the reason. You may request a copy of the audit log relating to your own content at any time by writing to [email protected].

We may also disclose personal data (a) to comply with a legally binding request from a competent authority, (b) to protect our or others' rights, property or safety, (c) in connection with a corporate transaction (merger, acquisition or sale of assets), in which case the recipient will be bound by privacy commitments at least as protective as these.

Booking partners you are redirected to. When you tap a booking suggestion you may be sent to an independent travel provider — for example Booking.com, Agoda, Klook, Tiqets or Airalo. Once you leave Traulo these providers are not our processors: they act as independent controllers under their own privacy policies. We do not pass identifying information about you to them; any data they hold about you results from your own interaction with their website or app.

---

6. International transfers

Some of our processors are based outside the European Economic Area, primarily in the United States. When we send personal data there we rely on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) under GDPR Chapter V, supplemented by additional safeguards where appropriate. You can ask us for a copy of these clauses by writing to [email protected].

For the United States specifically, we additionally rely on the EU–US Data Privacy Framework where the recipient is certified.

---

7. How long we keep your data

When you delete your account we erase or anonymise your personal data within 30 days unless we are legally required to keep it longer (for example, billing records under Slovenian tax law).

Cloud backup is a paid feature. If a paid plan with cloud backup lapses, is cancelled and then expires, or is downgraded to a plan without cloud backup, the vlogs stored in your cloud are soft-deleted immediately (hidden from your feed but recoverable) and permanently erased 30 days later. Resubscribing to a cloud-backup plan within those 30 days restores them. Vlogs saved on your device are never affected, and you can download your cloud vlogs to your device at any time before the 30 days elapse.

---

8. Your rights

Under the GDPR you have the rights to:

• Access the personal data we hold about you (Art. 15) — in-app at Settings → Account → Export my data, or by emailing [email protected]
• Rectify inaccurate or incomplete data (Art. 16) — most fields are editable in Settings → Account; for the rest, email us
• Erase your data, the "right to be forgotten" (Art. 17) — in-app at Settings → Account → Delete my account, or by email
• Restrict processing while a dispute is being resolved (Art. 18)
• Receive a portable copy in a structured, machine-readable format (Art. 20) — same export as above
• Object to processing based on legitimate interests, including profiling (Art. 21)
• Withdraw consent at any time, where processing is based on your consent (Art. 7(3)) — without affecting lawfulness of processing before withdrawal
• Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (Art. 22) — see Section 4
• Lodge a complaint with a supervisory authority (Art. 77)

To exercise any right, write to [email protected]. We will respond within one month of receiving your request (extendable by two further months for complex requests, in which case we will tell you why). Most requests are free; we may charge a reasonable fee or refuse to act on manifestly unfounded or excessive requests as permitted by GDPR Article 12(5).

If you believe we have not handled your data correctly, you can complain to the Slovenian supervisory authority:

Informacijski pooblaščenec RS Dunajska cesta 22, 1000 Ljubljana, Slovenia Phone: +386 (0)1 230 9730 Web: https://www.ip-rs.si

You may also contact the supervisory authority of your EU country of residence.

---

9. How to delete your account

You can delete your account at any time:

• In the app: Settings → Account → Delete my account. We will ask you to confirm.
• By email: write to [email protected] from the address on your account.

After confirmation, your account enters a 30-day grace period during which you can sign back in to recover it. After 30 days we permanently erase or anonymise your personal data. Some data may be retained beyond that window when we are legally required to keep it (for example, billing records under Slovenian tax law) — those records are kept only for the legally required period and only for the legally required purpose.

---

10. Children

Traulo is not directed at users under 15 years of age, which is the digital-consent age in Slovenia under ZVOP-2 (implementing GDPR Art. 8). We do not knowingly collect personal data from anyone under 15. If you believe a child under 15 has provided us with personal data, please contact us at [email protected] and we will delete it.

For users under the age of 18 (the age of majority in Slovenia), parental authorisation may also be required for in-app purchases under the Slovenian Civil Code (OZ).

---

11. Security

We protect your personal data using:

• Encryption in transit — HTTPS / TLS 1.2 or higher for all client–server traffic
• Encryption at rest — Postgres data encryption and Cloudflare R2 object encryption
• Authentication — Sign in with Apple, Google Sign-In, or passkey-based two-factor authentication for high-risk actions
• Access control — admin access requires passkeys, an IP allow-list, and full audit logging
• Operational hardening — least-privilege roles, dependency scanning, and regular review of our security posture

No system is perfectly secure. We continually work to improve our defences and to detect, contain and notify in the event of an incident.

---

12. Data breach notification

If we become aware of a personal data breach within the meaning of GDPR Article 4(12), we will:

• Notify the Slovenian Information Commissioner (Informacijski pooblaščenec RS) within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to your rights and freedoms (GDPR Art. 33).
• Notify affected users without undue delay when the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34), describing the nature of the breach, the likely consequences and the measures taken or proposed.

---

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we publish the new version on www.traulo.com/privacy together with the new effective date and an archive of all previous versions.

For material changes — for example, a new processor receiving sensitive data, a new processing purpose, or a change to your rights — we will ask you to review and accept the updated Policy in the app before you can continue using Traulo. For non-material changes (typo fixes, clarifications) we publish the new version without asking for re-acceptance, but you can always read the current text and the change log on the website.

We keep a permanent record of which version of this Policy you accepted and when, so we can demonstrate compliance.

---

14. Contact

For any privacy question or to exercise any of your rights:

• Email: [email protected]
• Post: Računalniške storitve REK, Mihael Rek s.p., Ulica heroja Jevtiča 5, 2000 Maribor, Slovenia

For complaints you cannot resolve with us, please contact the Informacijski pooblaščenec RS as described in Section 8.

---

This Privacy Policy is also available in Slovenian at https://www.traulo.com/privacy?locale=sl. In case of any discrepancy between the English and Slovenian versions, the Slovenian version prevails for users domiciled in Slovenia.