Privacy Policy
Last updated: 2026-09-21
Tourlet has not been released. This page describes an app under construction
(name.gpm.tourlet), written against what is actually built today rather than against
a finished product that does not exist yet. It will be rewritten as the app is, and every
TODO below marks a point that depends on a product decision nobody has taken yet — not a
promise, not a guess.
The short version, as things stand: an itinerary you create lives on your phone. Nothing about a trip is sent anywhere unless you turn on sync, which the app cannot do yet — see “The itinerary sync” below. When it ships, sync will not be end-to-end encrypted: our server will store your trips in a form it can read, protected in transit and by who can reach the server — not by a key only you hold. An earlier version of this page promised the opposite; the decision changed on 2026-09-21, before any sync code existed, and this page changed with it. There is no location permission in the app today, and nothing reads or stores where the device is. There is also no attachment feature — a boarding-pass PDF or a ticket photo cannot be attached to an item in this version.
On 2026-09-20 the app’s planned scope grew — a map, flight alerts, suggestions written by a language model, trips shared with other people, and saved tickets and receipts. None of it is built, and this page describes what the app does, not what it is going to do. The section “What the wider app will send, and to whom” below sets out each new flow in advance, so that each one is built to what is written here rather than described afterwards.
Who is responsible
Gabriele Proietti Mattia is the data controller for the processing described here. Contact: apps@gpm.name.
What the app does, in data terms
An itinerary — trips, their dates, the things planned for each one — is kept as the app’s own data on your device. Nothing about it is read by, or sent to, anyone else by default.
No location. The current build declares no location permission at all, and nothing in the app’s design so far calls for one (see the design brief’s open questions for whether a future feature, such as “what’s near me on this trip”, would ever ask for it — it is not planned today, and this page will say so plainly, before it ships, if that changes).
No storage or media permission. Anything Tourlet keeps is its own private data, or reached through Android’s own file picker where a feature calls for opening a file — never a blanket permission over your photos or documents.
No attachments. A first version of Tourlet does not let you attach a file — a boarding-pass
PDF, a photo of a ticket — to anything in your itinerary. If that changes, it will change
alongside sync (below), and this page will say so before it ships, per common/docs/rules.md
§20.
The itinerary sync — planned, readable by our server, and not in the app yet
Tourlet’s own backend (tourlet/backend) runs at https://tourlet-app.gpm.name since 2026-09-21, but the
app you could install today has no code that talks to it. Nothing a person does in that
build reaches our server.
Decided, ahead of the app’s side of it: sync is not end-to-end encrypted. When you turn it
on, each thing in your itinerary — a place, a leg, a day’s plan, a note — is sent to
https://tourlet-app.gpm.name and stored there as you wrote it, so that your other devices can fetch it.
Our server can read it. What protects it is:
- HTTPS on every request, with no unencrypted fallback;
- who can reach the server and its database — the operator (Gabriele Proietti Mattia) and nobody else; the database is not exposed to the internet;
- backups of that database, kept for two weeks, which are covered by exactly the same.
We say this plainly because an itinerary is sensitive: it says where you will be, and when, and so when your home is empty. If that matters more to you than having your trips on a second device, leave sync off — the app is complete without it, and nothing leaves your phone.
What we do not do with what we can read: nothing. There is no search across trips, no web page that shows one, no notification sent from our server about your plans, no analysis, and no sharing with anyone. Every reminder the app gives you is scheduled by your phone. If any of that ever changes, it changes on this page first.
What the server keeps alongside your trips: the address you signed in with, when each item was last changed and from which account, and — for seven days — the previous version of any item that another edit overwrote, so it can be put back.
Sync is also planned as a paid feature (a Pro subscription) once Tourlet has one — the app itself, and the itinerary you type into it, stay fully usable and free without it.
TODO — once sync is in the app, this section has to add, plainly:
- retention: how long a synced trip is kept after it is over, and after an account is closed;
- how billing for the Pro subscription is handled, and what Google Play’s billing system sees beyond the purchase itself.
What the wider app will send, and to whom — decided, not built
Each row is a feature that has been decided and not written. Every one of them is opt-in at the point of use; none of them runs in the background; and none is in the app you can install today, because there is no app you can install today.
| Feature | What would leave your phone | Who would receive it | Would our server see it? |
|---|---|---|---|
| The map | the area you are looking at; a place name you search for | the map tile server and the geocoder | no |
| Flight alerts | a flight number and a date, for a flight you switched watching on | a flight-data provider | no — your phone asks it directly |
| Suggestions | the text of the request you send, built from what you selected | our server, then the model provider (OpenRouter) | yes — this is the exception |
| Sync | every item of a synced trip | our server | yes |
| A shared trip | the trip, and who is in it with you | our server | yes |
| Tickets and receipts | the file you attach | our server | yes |
What survives all of this: nothing runs in the background, and nothing leaves your phone for a feature you have not switched on. Flight alerts are the one a reader might expect to go through our server, and they do not: your phone asks the flight-data provider directly, on a schedule, the way our own flight-tracking app already works with no server at all.
Suggestions, said specifically: when you ask for one, the text of that request goes to our server and then to the model provider. Nothing is sent automatically, the request is built from what you selected and nothing else, and the screen will show you what is about to be sent before it is sent. The model will be named on this page, not described as “AI”.
Not decided, and so not done: a public link to a trip. If you want to give a trip to someone without an account, the app will export it as a file.
Diagnostics, reports and the two builds — not yet decided
Every app in this family eventually ships a play build (Google Play, with the family’s
diagnostics opt-in — common/docs/rules.md §9.1) and a foss build (a self-hosted F-Droid
repository, no billing, no Firebase). Tourlet’s source repository is not yet built out to
that split, and no report/feedback screen, no crash reporting and no usage-statistics SDK
exist in it today.
TODO — before the first Play release, this section has to state, precisely and per build:
whether Firebase Crashlytics and Analytics are present, what each collects, and that both
default on with a switch under Settings → Diagnostics, on the first launch — the pattern every
sibling app’s privacy page already documents (see, for comparison,
bandcue’s or
statlet’s). None of it can be written truthfully before
the code that would make it true exists (common/docs/rules.md §20: a privacy claim and the
code behind it ship together).
What a bug report or feature request would send, once the app has a report screen, is
governed by the family’s own rule (common/docs/rules.md §0, Law 1): it goes to
apps-management.gpm.name, proved by an address, never to Tourlet’s own backend — the same
split every sibling app draws between “the family’s shared service” and “this app’s own
accounts”. Not built yet, so nothing is sent today.
What stays on your device
- Every trip and everything planned for it, until you delete it or uninstall the app.
- The app’s settings.
If Android’s own backup is enabled on your device, this data may be included in your own device backup, under Google’s terms, the same as any app’s.
What the app never does, today
- No location tracking.
- No advertising, and no sale or sharing of data with anyone.
- No account, no sign-in, no password — there is nothing to sign in to yet.
- No map, no flight lookup, no suggestions, no sharing: the section above describes what is decided, and none of it is in any build.
- No reading of your contacts, messages, call history or files beyond what a future feature explicitly asks permission for, at the point it needs it, never at launch.
Legal basis (GDPR)
For readers in the EU/EEA and the UK: as things stand, nothing the app does involves any transmission to Gabriele Proietti Mattia, so there is no processing on that side to which a legal basis under Article 6 would attach. This changes the day sync or a report screen actually ships, and this section will say what basis applies to each at that point.
Your rights
Under the GDPR you may request access to, correction of, or deletion of your personal data. Today that is straightforward: everything Tourlet holds is on your device, so uninstalling the app removes it. Once a server-side feature exists, this page will say exactly what it holds and how to have it deleted. Write to apps@gpm.name for any request in the meantime.
Children
Tourlet is not directed at children under 13 and knowingly collects no data from them — or, today, from anyone.
Changes
Material changes will be published on this page with a new date at the top, and significant ones will be noted in the app’s changelog once one exists.
Last updated: 2026-09-21