Travel Journal
Privacy
Travel Journal reads your photos on your phone. In Local Mode, how the app ships and how nearly everyone runs it, recognising what is in a photo, matching faces to a person you have named, and choosing which days belong in your journal all happen on the device, without a network call, and the photographs themselves stay on your phone unless you choose otherwise. We never sell them, and in Local Mode we receive only the photos you choose to send. There are three ways that happens, each your own choice: cloud mode, sharing a day or a trip as a link, and exporting a private PDF, slideshow or Seedance film. A shared link is an unlisted page that anyone with the link can open, and its photos stay stored on our server for now, even after the link is turned off. Place names are looked up with Apple Maps from a rounded location, never a photo. Settings deletes your journal from your phone; it does not yet delete your account or the photos behind a link you shared. Questions: hello@traveljournal.ai.
If Local Mode is off
Everything above describes Local Mode, which is on for every new install. Settings has a Local Mode switch. If you turn it off, or if you installed before Local Mode existed and never turned it on, Travel Journal runs in cloud mode instead: resized copies of your photographs are uploaded to our server so the recognition Local Mode runs on your phone runs there. A Life Book, and a Life film made as a slideshow, are built on our server from those same uploaded copies by our own software; no other company sees the photographs to do it. A Seedance film, which you have to ask for separately, is the one exception, described below. Translating a Life Book into another language sends its journal entries as text to OpenRouter, the same writer used below, to translate them. Turn Local Mode back on in Settings and new imports go back to your phone.
Exporting a private PDF or slideshow
A Life Book and a Life film are cloud mode features, described above. Exporting a private PDF or a private slideshow is different: your own local-only feature, and it works even with Local Mode on. Asking for one uploads the photos you approve, temporarily: a 1600-pixel copy of each, never the original file, plus the day titles and journal text for the days you picked, and any captions or place descriptions on them. Up to 80 photos for a PDF, 3 to 24 for a slideshow. Before anything uploads, the app shows exactly what that is, how many photos, how many megabytes, which days, how many words of story text, and asks you to confirm; nothing outside that approved selection goes anywhere. The uploaded copies are deleted from our server once the file is built, and an unfinished request expires and is deleted within fifteen minutes. If a request fails, its copies are kept only until that same fifteen-minute limit, so that trying again from your account does not upload them twice; a retry never extends that limit, and no other account can use or detect them.
A Seedance film is an opt-in AI film of one trip, and it also works with Local Mode on. It is the only export another company sees photographs for. The app picks up to 14 photos from the trip, checks each one for faces on your phone, and leaves out any photo with a face, or any it could not check. Before anything leaves your phone, it shows those photos, how many megabytes they are, who receives them, the model, and its estimated cost, and asks you to confirm. Only the chosen face-free photos, as 1600-pixel copies, the trip title and the place names are sent: to our server, then to fal.ai, which runs ByteDance's Seedance video model on them and returns the video to us. fal.ai and ByteDance see those photos for that purpose only. No journal text is sent. If ByteDance refuses the photos because one may show a person, no film is made from them, nothing is charged, and you get the slideshow film instead. The fast film (where the app offers it) is different: up to 60 photos are cut to music on our server, and only a few of them, always photos without a face, go on to Seedance for a short moving clip. A fast film may include photos with people in them, including people other than you: the consent screen says how many before you confirm, those photos are sent to our server only and never to fal.ai or ByteDance, and a switch on the film screen leaves out every photo with people. Our copies are deleted once the film is built, and an unfinished request is deleted within 45 minutes. If a request fails, its copies are kept only until that same limit, so that trying again from your account does not upload them twice; a retry never extends it. The finished film plays in the app and is not saved to your Photos. The default slideshow film and the PDF are still made on our server only, with no other company involved.
What we send
To write each day's entry, we send our writer, OpenRouter, facts about that day, never the photos: the date, an approximate place name, the kinds of things in the photos (like beach or trail, not the photos), how many photos and how many show a recognised face, how long that day's photos span, and, if you have given names to people in Faces, the names of anyone who appears that day, so the story can use them naturally. Location is one approximate point for the day, not a trail of everywhere you stopped. Nothing in this request is kept on our server once the story is written; only your device keeps the journal. One sibling request, used to recognise trips and home, sends that day's exact coordinate rather than a rounded one, since finding a real place needs it; it asks for the same one-time consent as this request and recommendation research below.
Films subscription
A Films subscription is bought and paid for through the App Store or Google Play. Apple or Google take the payment; we never see your card, bank or billing details. When you subscribe or restore a purchase, the app sends us the store's signed record of it so our server can confirm it is real and switch Films on for your account. From that record we keep: the store (Apple or Google), the store's transaction identifiers, the product, whether it was a test (sandbox) purchase, when it expires, and whether it was refunded or revoked, linked to your Travel Journal account through an opaque identifier the app gives the store at purchase, which contains no account id, name or email. To keep Films in step when a subscription renews, lapses or is refunded, Apple tells our server directly, and our server checks Google Play's record again from time to time. These records are deleted when your account is deleted.
Usage counts, only if you say yes
Travel Journal can send us a few counts about how the app is used, so we can see what works. It is off unless you turn it on: the app asks once, after you have read your first story to the end, and "Not now" leaves it off without asking again. You can switch it on or off at any time in Settings, under "Share usage counts".
While it is on, the app puts together one message a week on your phone and sends it on any network. It holds small counts and ranges, never an exact size: on how many of the 7 days you opened the app, roughly how many visits, which of the main screens you used (My story, Calendar, Trips, Ideas, My book, Settings), how many photos are in your journal and how many days it covers, each as a range such as 500 to 1,999, how many books and films you have made, as a range, how many times you opened the app from a notification (up to 10), the app version, and whether the phone is an iPhone or Android. It never holds a photo, a place, a coordinate, the date of a photo, what is in a photo, a name, or anything you wrote.
Between those weekly messages, the app also notes a few kinds of moment, keeps them on your phone, and sends them in batches, a few times a day at most, never as they happen: that you opened the app (the hour, and whether it came from a notification), how long you stayed on each main screen (in seconds, capped at an hour), which setup screens you reached, whether sign-in and each permission you were asked for went through, that an import started and finished (the number of photos, days and trips as ranges, and roughly how long it took), that a story was written and when you first read one, which kind of page you opened (a day's story, a trip, the calendar, never which day, trip or place), that you made a book or a film or shared something, that a reminder was set or opened, and how smoothly each visit ran: how many times the app paused for more than a tenth of a second and how long the longest pause was, as a range, how long it took to show its first screen, how warm the phone got and whether Low Power Mode was on, how many photos face recognition looked at, as a range, which app update was running, and for the longest pause, roughly how far into the visit it began and which kind of screen was open (a main screen or a kind of page, never which day, trip or place). On iPhone only (Android sends none of this), when iOS reports to the app that it crashed, froze, started slowly, or used the processor or wrote to storage too heavily, that is sent too: which of those it was, for a crash a word for why (such as frozen too long, out of memory, or stopped by the system), for a freeze or a slow start how long it lasted as a range, and the app's build number. iOS also counts, each day, how the app ended, and that is sent as ranges such as 2 to 4: closed normally, which includes you swiping it away; ended by iOS for using too much memory, for being frozen too long, by a crash, or for another reason; and in the background, for memory, for holding a file open, or for another reason; with the most memory the app used that day, as a range such as 1 to 2 GB, and the build number. None of this is sent for anything that happened before you turned usage counts on. Never the report itself, which part of the app it was in, or your iPhone's model or iOS version. Each is sent with how many days ago it happened, never a time. None of it holds a photo, what is in one, the date a photo was taken, a place, a name, or anything you wrote.
Under "Share usage counts" there is a second switch, "Also share my age range and country", off unless you turn it on, and only offered to adults. It adds an age range (18 to 24, 25 to 34, 35 to 44, 45 to 54, or 55 and over) to the weekly message, taken from the birth year you gave during setup or asked once, with "Prefer not to say" as an answer; never your birthday. It also adds your country as your phone's region setting says it, never from your location or your IP address. Turning it off takes both out of anything still waiting to be sent.
The message carries a random id made on your phone. It is not your account, it is not a device or advertising identifier, and nothing on our side links it to you: the message is sent without signing in, and we do not keep the IP address it came from. Settings has "See what was sent", which shows last week's message line by line, the last batch of moments, and the raw message itself. We keep these messages for 400 days, stored under a code made from that id that changes every three months, and only ever report on them in totals of at least five phones. A message that could not be sent within two weeks is dropped.
Turning it off deletes anything waiting to be sent, straight away. Once it is off, Settings also offers "Delete the counts already sent", which deletes every message from your phone on our server, found by that random id, refuses anything still on its way under it, and gives your phone a new id. Deleting all your data from Settings deletes the id, the counts and anything waiting, and a later yes starts under a new id.
Apple Health and Health Connect
If you allow it, Travel Journal reads a small set of activity data from Apple Health on iPhone, or Health Connect on Android: steps, walking and running distance, flights climbed, time in daylight, and your workouts, including the route of a workout when one was recorded. It only reads; it never writes to Health. It uses this to add a line about each day's activity to your journal, to let the story writer that runs on your phone mention how a day moved (after a morning run, a long day on foot), to notice patterns in it alongside your photos, such as weekend hikes, regular runs, early starts or walking more on trips, and to let the on-device assistant answer questions about them. When a story is written by our server instead, none of this is sent with it.
Health data stays on your phone. It is never uploaded to our server, never sent to OpenRouter or any other company, never included in a shared link, a Life Book, a Life film, or an exported PDF or slideshow, never sent to analytics, and never used for advertising. It is stored in a part of the app that is excluded from iCloud and device backups. You can turn it off in Settings, and withdraw access at any time in the Health app or Health Connect. Deleting everything from Settings also deletes what Travel Journal read from Health.
Optional recommendation research
When you choose a destination or share foreground location, the same writer, OpenRouter, receives an approximate area and local time to research activities and food on the public web. Generic AI browsing remains available without photo personalization. If you enable photo personalization, the provider also receives bounded activity and cuisine patterns already sitting on your phone, including evidence strength and recency, never the photos that produced them. A photographed interest is not proof that you enjoyed it.
Recommendation research does not send raw photos, full narratives, exact historical location trails, or sensitive inferred attributes. The supporting travel-guide source receives no profile. Photo personalization and foreground-location permission are separate choices. You can ignore interests in Recommendations, and delete your data in Settings. There is no separate personalization off-switch in this build.