Privacy Policy

1. Who we are

TourIts (the “app”, “we”, “us”) is operated by Liam Abu, an individual based in Israel (“TourIts”). We are the controller of the personal data described in this policy, which means we decide why and how it is processed.

Contact for privacy questions: [email protected]

A postal address for legal notices is available on request by email.

We have not appointed a Data Protection Officer, as the law does not currently require one for TourIts. If we become required to appoint a representative in the EU or UK, their contact details will be listed here.

2. Scope

This policy applies to the TourIts mobile apps for iOS and Android and to any support communication with us. It does not cover third-party websites or apps you open from TourIts (for example Google Maps, Apple Maps, Waze, Booking.com, GetYourGuide or Skyscanner); their own privacy policies apply.

3. The short version

• You can use TourIts without an account. Guest data stays on your phone and is deleted after 7 days.
• With an account, your email, packing lists, trips and settings are stored on servers in the EU (Frankfurt, Germany) so they can sync between devices.
• Proof recordings from the Change Helper stay on your phone only and are deleted automatically.
• We use your location only while you use the app and only for features you ask for.
• We do not sell your personal data and we do not use third-party advertising trackers.

4. Data stored only on your device

The following is stored in a local database on your phone and is not sent to us unless you create an account (see section 5):

• Setup answers: language, home country, destination, trip length, age range, whether you want religious and heritage sites shown, and trip style preferences.
• Packing lists, custom items, ticks and quantities.
• Change Helper checks: amounts, currencies, offered amounts, verdicts and time.
• Proof recordings (audio) made with the Change Helper. These are never uploaded.
• Downloaded exchange rates, offline map regions, phrasebooks and translation packs.
• App settings: appearance, accessibility and notification preferences.

Guest data is deleted automatically from your device 7 days after you start using the app as a guest, unless you create an account.

5. Data we process when you have an account

• Account data: your email address and a securely hashed password (we never see your password in readable form), account creation date and sign-in timestamps.
• Synced app data: your profile preferences, packing lists, trips (days, stops, notes, ticks and ratings) and settings, so they can be restored and synced across your devices.
• Subscription status: your plan (Free, Plus or Pro), billing period, renewal or expiry date and store transaction identifiers. We do not receive your card or bank details; payments are handled by Apple or Google, and RevenueCat (our subscription management provider) receives the store transaction details needed to confirm your plan.
• Support messages: the content of messages you send us and your contact details.

6. Exchange store reports and ratings

If you are signed in and choose to rate an exchange store after a Change Helper check, we store:

• The currencies, amount, offered amount and calculated fee.
• The store name you enter, the store’s location and the local time and weekday of the exchange.
• Your star rating and optional comment.
• A link to your account so we can prevent abuse and let you delete your reports.

Other users see the store’s aggregated fairness score, ratings and comments, but not your email or identity. Your recording is never included. Ratings of places and trip stops work the same way.

7. Location

With your permission, TourIts uses your device’s location only while the app is in use (and, for Pro fair-exchange alerts, as permitted by your device settings) to:

• show your position on the map and sort places by distance;
• calculate travel times from where you are;
• attach the store location to an exchange check or rating you choose to share;
• detect whether you are near a fair exchange store (Pro alerts), evaluated on your device.

We do not store a history of your movements on our servers, and we do not share or sell location data for advertising. You can withdraw location permission at any time in your device settings; the rest of the app keeps working.

8. Microphone and recordings

With your permission, TourIts uses your microphone:

• In the Change Helper, to capture the amount an exchange clerk says and, where legally permitted and after any required consent, to keep a short audio recording as proof.
• In the Translator (Plus and Pro), to turn your speech into text for translation.

Proof recordings are stored only on your device and deleted automatically after 7 days in countries covered by the GDPR or where the law is unclear, 30 days elsewhere, or 90 days for Plus and Pro subscribers where the law allows. Speech-to-text may be performed by your device’s operating system speech service (Apple or Google), subject to their privacy terms. We do not keep audio from voice translation. See the Recording & Consent Notice for more.

9. Third-party services we use

We share the minimum data necessary with these providers to run the app:

• Supabase (database, authentication and account emails, hosted in the EU, Frankfurt, Germany): account data, synced data, support messages, reviews and reports.
• RevenueCat (subscription management): store transaction identifiers, the product purchased, subscription status and an app user ID linked to your account, used to confirm and restore your plan. RevenueCat does not receive your card details.
• Apple App Store and Google Play: purchases and subscription management, under their own privacy policies.
• open.er-api.com by ExchangeRate-API (exchange rates): a request for current rates; no personal data is sent beyond what any internet request contains (such as your IP address).
• OpenStreetMap-based services: Overpass API (overpass-api.de, places), Photon by Komoot (photon.komoot.io, place search) and OSRM on the FOSSGIS server (routing.openstreetmap.de, travel times). They receive your search text, the map area you view and the coordinates of the stops you request travel times for.
• OpenFreeMap (tiles.openfreemap.org): map tiles for the map area you view. Development builds may use the OpenStreetMap tile server instead.
• MyMemory by Translated (online translation): the text you ask to translate.
• Wiktionary (Wikimedia Foundation): the word you ask to hear a pronunciation hint for.
• country.is: during first setup, a one-off lookup of the country for your IP address to suggest a language; we do not store the result on our servers.
• Expo (app platform and updates): technical device information needed to deliver app updates.
• Your device’s speech services (Apple or Google): speech-to-text when you use voice input.

These services may process your IP address as part of normal internet communication. We keep this list up to date as the app changes.

10. Why we process your data (legal bases)

Where the GDPR or UK GDPR applies, we rely on:

• Performance of a contract: to provide the app, your account, sync, subscriptions and support.
• Consent: for location, microphone, notifications and marketing communications. You can withdraw consent at any time without affecting earlier processing.
• Legitimate interests: to keep the service secure, prevent fraud and fake reviews, calculate store fairness scores, and fix bugs, balanced against your rights.
• Legal obligation: to keep records required by law, such as tax records for purchases where applicable, and to respond to lawful requests.

11. How long we keep data

• Guest data: on your device only; deleted 7 days after first use unless you create an account.
• Proof recordings: on your device only; 7, 30 or 90 days as described in section 8.
• Account and synced data: for as long as your account exists. When you delete your account we delete it from active systems within 30 days and from backups within 90 days.
• Exchange store reports: while your account exists. On account deletion, they are deleted or irreversibly anonymised so that aggregated fairness scores remain accurate.
• Support messages: up to 24 months after the conversation ends.
• Records we must keep by law: for the period the law requires.

12. Sharing and selling

We do not sell your personal data and we do not “share” it for cross-context behavioural advertising as defined by the California Consumer Privacy Act (CCPA/CPRA). We disclose personal data only:

• to the service providers listed in section 9, under contracts that limit their use of it;
• when required by law or to protect the rights, safety and property of our users or others;
• to a successor in a merger, acquisition or sale of assets, with notice to you.

13. International transfers

TourIts is operated from Israel, and our primary database is located in the European Union (Frankfurt, Germany). The European Commission recognises Israel as providing an adequate level of protection for personal data. Some service providers may process data outside the EU/EEA, the UK or Israel, for example in the United States. Where this happens, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified companies) or on Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

14. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy (portability);
• correct inaccurate data;
• delete your data (you can delete your account directly in Settings);
• restrict or object to certain processing, including processing based on legitimate interests;
• withdraw consent at any time;
• not be discriminated against for exercising your rights (California);
• lodge a complaint with your local data protection authority (in Israel, the Privacy Protection Authority).

To exercise your rights, email [email protected] from the address linked to your account. We respond within one month (GDPR) or 45 days (CCPA), and may need to verify your identity. You may use an authorised agent where the law allows.

15. Children

TourIts is not directed at children. Accounts are available only to people aged 16 or older, or the higher minimum age required in their country. Children under 13 (or the relevant age in their country) must not provide personal data to us. If we learn that we have collected personal data from a child without appropriate consent, we will delete it. Parents or guardians can contact us at [email protected].

16. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS), hashed passwords, row-level access controls so each account can only access its own data, and restricted administrative access. No system is perfectly secure; if we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.

17. Analytics, crash reports and tracking

TourIts does not currently use third-party advertising or cross-app tracking. We may collect limited, non-identifying crash and diagnostic data to fix problems. See the Analytics & Tracking Policy for details. We will update this policy and, where required, ask for your consent before introducing any analytics that identify you.

18. Changes to this policy

We may update this policy as the app changes or laws evolve. We will show the “last updated” date at the top and, for material changes, notify you in the app or by email before they take effect.

19. Contact and complaints

Questions or requests: [email protected]

TourIts is operated by Liam Abu, an individual based in Israel. A postal address for legal notices is available on request by email.

If you are not satisfied with our response, you may complain to the Israeli Privacy Protection Authority or, if you are in the EU/EEA or UK, to your local data protection supervisory authority.