Effective: October 9, 2026 · Last updated: October 12, 2026 · English · resumen en español y português al final
Trip Wallet OS is a travel toolkit: translate menus, scan receipts, convert currencies, keep travel documents, track expenses, organize family trips and prepare for emergencies. It is built local-first: by default your data is stored on your phone, and the sections below tell you exactly when something leaves it. There are no accounts, no ads, no third-party advertising or analytics SDKs, and we never sell your data. Usage measurement is limited to the web/PWA install funnel and to daily usage limits, both described under Analytics and usage limits — they are not anonymous, because they use random identifiers, and they never contain trip, receipt, expense, itinerary or payment data.
Who we are. Trip Wallet OS is published by Go Cellular LLC (California, USA), which uses the name Go Cellular Apps for its apps. We decide how the information described here is used. Privacy contact for every question or request: gocellularfix@gmail.com. We collect information directly from you and from your phone when you use a feature; we do not buy data from brokers or combine it with data from other sources.
| What | Why | Where it goes |
|---|---|---|
| Trips, budgets, expenses, notes, itinerary, flights and boarding-pass details you enter or import | To run the app | Your phone only (unless you share a Family Trip) |
| Sensitive: Travel Docs files (passports, visas, IDs, licences) and the Medical Card (blood type, allergies, medication, conditions) | To show them to you, offline | Your phone only, encrypted. Never sent to AI or to us. They can appear in an export or backup you create yourself |
| Photos of receipts, menus and price tags you scan | To read text and prices | Sent through our server to Claude AI (Anthropic), only after your consent. Our server processes them in memory and does not keep them |
| Text you submit for translation or booking import; this may include health information in the Emergency Translator | To translate or import | Anthropic, through our server; not kept by our server |
| Voice | Voice input | Your phone's own speech service turns it into text (Google on Android; may use Google's servers when online). The app receives only the text |
| Family Trip (optional): trip name, budget, dates, join code, display names, shared expenses (photos only if enabled) | To share a budget | Our server (Railway, United States) until the trip owner deletes it |
| Flight number and date (when live flight status is on) | To show flight status | Flightradar24, through our server; not stored |
| Place search text, your app language and, for a “near me” search, a map-cell id (an area of about 0.7 km²) | To find places | Our server; Google Maps Platform receives the text and the centre of the cell. Not stored by us. Your recent search phrases are kept on your phone only |
| Technical and usage data: random install ID and hashed network address with a request count; web-app install events with a random visitor ID, coarse country, browser and OS; standard connection data such as your IP address | Daily usage limits, abuse protection, measuring web installs | Our server and database (Railway); our hosting providers' logs |
| Location (only if you tap the location button or run a “near me” search) | To prefill city and country; to find places near you | City and country are worked out on your phone. GPS coordinates are not sent anywhere unless you tap Open in Maps; a “near me” search sends the map-cell id described above |
Works offline: your documents, Medical Card, expenses and trips, cached exchange rates, the offline phrasebook and emergency phrases, emergency numbers and embassy information, on-device scanning of barcodes and printed text, and translation once you have downloaded the language packs. Needs internet: AI scanning and AI translation, booking import, refreshing exchange rates, airport weather, travel advisories, train timetables, Family Trip sync, live flight status (when enabled), place search, and loading the web app itself.
Expenses, budgets, trip names and dates, currency settings and cached exchange rates, translation phrasebook use, timeline events, boarding-pass details you import, Travel Docs document files (kept in the app's private storage, encrypted), your optional medical card (encrypted), family traveler names you add, language preference, and the App Lock verifier. If you enable App Lock or the Docs & Medical PIN, the PIN itself is never stored — only a salted one-way verifier, so it cannot be read back. Local data is not transmitted to us except as described below.
Before the first photo is sent, the app asks whether you agree to have receipt, menu and price photos read by a third-party AI service; nothing is uploaded until you allow it, declining lets you enter the details by hand, and you can withdraw the permission at any time in Settings → Security Center. Once allowed, when you tap to read a menu, receipt or price tag, the photo is reduced in size on your phone and sent over HTTPS to our backend proxy (hosted on Railway, US), which forwards it to Anthropic's Claude AI to extract text, prices and items. The result returns to your phone and is stored only there. Trip Wallet's server processes the image in memory and does not keep it after the request completes. Anthropic processes the image under its own terms and privacy policy. Do not scan documents or photos you are not comfortable processing this way.
Travel Docs and the Medical Card stay on your phone. The Travel Docs feature (passports, visas, IDs, driver's licenses, boarding passes) and the Medical Card never send anything to AI and never leave your device. Documents and boarding passes are read on your device (barcode, printed text and passport lines with Google ML Kit on your phone) or entered manually; there is no cloud reading of boarding passes. The receipt/menu/price scanner is different: it sends whatever photo you choose, after your consent, to Anthropic. Please do not photograph passports, IDs or boarding passes with it. Trip Wallet blocks known passport-barcode and machine-readable-zone text patterns, but it cannot recognize every photo.
Booking import. Text you paste or share to import a booking is first stripped on your phone of email addresses, phone and card numbers and booking codes, then sent through our proxy to Claude AI (Anthropic) to find dates and places. The app removes obvious identifiers, but names and the itinerary may remain in the text that is sent. It is not kept by our server, and the app tells you before it is sent.
The microphone activates only while you actively use voice input — never in the background. In hands-free Conversation Mode, after you start it the app keeps listening turn after turn until you tap Stop, close or minimize the Conversation screen, or until it pauses itself after a couple of silent turns. It also stops when the app goes to the background or the screen locks. Conversation Mode can capture other people’s speech: tell them, and follow local recording and consent laws. Speech is turned into text by your phone's own voice service (Google on Android; your browser's speech service in the web app): with internet it may use that provider's servers; without internet, on Android, it runs on the phone if you installed the offline voice pack for that language. If both offline translation packs are downloaded (Google ML Kit, only on your tap and only on Wi-Fi), the text is translated on your device and never leaves it. Otherwise, for phrases the offline phrasebook can't handle and when you are online, the text (not audio) is sent to the AI service (Anthropic) for translation only if you chose Use AI translation in the same one-time choice as the Emergency Translator (the text may contain health information), with a notice in the app, and is not kept by our server. Conversation transcripts live only in the app session on your phone.
The Emergency Translator and Conversation Mode work offline with built-in phrases. The first time you use either, the app asks whether to Use AI translation or stay offline. Only if you choose that, the text you type to find the right phrases (which may describe a symptom or other health information) and the lines of a live conversation with a responder are sent through our proxy to Anthropic's Claude AI when you are online (on Android a conversation line is translated on your phone first if both offline language packs are installed). Otherwise nothing is sent and the offline phrase functionality is used. You can change this choice at any time in Settings. Our server does not keep or log this text; it keeps only daily request counters to protect emergency capacity (see below). Anthropic processes what it receives under its own terms. Your Medical Card and the emergency summary built from it are never attached and never sent to AI or to our servers: they are translated only on your phone with the offline language packs, and if those aren't available the original is shown.
If you create or join a shared trip, we store on our server (hosted on Railway, US): trip name, budget, dates, currencies, a random join code, member display names (any name you choose), and the expenses members sync: label, merchant, note, amounts, currency, category, date, split information and who paid. The trip also stores the destination country you picked when you set the trip up (a trip setting, not your location), so that members’ phones show the same destination. The server keeps only these fields: it does not store the city, street address or location of any expense, payment method, card digits or receipt line items (older copies are scrubbed when the updated server starts). Receipt photos are synchronized only if the trip owner turns on photo sync and the member's device opts in; this is off by default. When synced, photos are stored on our server and are visible to everyone in that trip, so remove or skip a photo if it shows a name or card digits. No email, phone number or account is required. Anyone with the join code can join and view the trip — keep it private. We do not describe this server storage as encrypted at rest.
This data is kept until the trip owner deletes the trip; there is currently no automatic expiry. Only the trip owner (the person who created it) can use Delete shared trip in the app to permanently remove the trip, its member list, all synced expenses and any photos from the server. Other members can leave the trip (this disconnects their phone) and can email us at gocellularfix@gmail.com to have their name removed. See Data deletion. Solo use never creates server data.
Exchange rates. The Currency Converter asks our backend for current rates. The backend reads Frankfurter (which republishes central-bank rates such as the European Central Bank's) and open.er-api.com for currencies Frankfurter does not cover; if our backend is unreachable the app asks open.er-api.com directly. The request contains only standard connection metadata (such as your IP address, as with any web request) and no personal or trip data. Rates are cached on your device so conversion works offline.
Airport weather. When a saved flight is close, the app asks our backend for the weather at its departure and arrival airports. Only the three-letter airport code is sent; the backend reads public METAR/TAF data from NOAA's aviationweather.gov and keeps a short in-memory cache. Nothing about you or the flight is sent.
Train timetables (when available). The route you type (station or city names, optional city code, date, time window, or a train number) is sent to our backend, which answers from public timetables downloaded once a day from the operators' official open-data portals. No location, trip or personal data is sent, and the query text is not logged or stored. For routes in Korea, the station pair and date are forwarded to the Korean government's timetable service (TAGO).
Travel advisories. Travel Help asks our backend for the official government advisory (U.S. Department of State, Government of Canada) for the country you are visiting. Only the country code is sent; the result is cached on your device for offline reading.
Flight status (when enabled). Live flight status is currently switched off and will be offered only when we turn it on. When it is on, the flight number you saved or searched for and its date (plus the app's random install ID, used only for usage limits) go to our backend, which asks our flight-data provider, Flightradar24 (a Swedish company), for the flight's route, aircraft type and registration, live position, altitude, speed and actual takeoff and landing times. Flightradar24 sees requests from our server, not from your device, and receives no name, seat, booking reference, device identifier or location from you. The flight card credits Flightradar24, and we do not resell or republish its data. Results are held only in our server's memory for a few minutes to a few hours (a live position about 2 minutes, a matched flight up to 30 minutes, a finished flight a few hours) to avoid repeating requests; they are not written to our database or application logs, and Flightradar24's rules limit how long its data may be kept (at most 30 days according to its documentation), so we keep none. Our hosting provider (Railway) may keep standard infrastructure logs that include request addresses and IP addresses, under its own policy, which we do not control. Flight information can be delayed, incomplete or unavailable (for example over oceans, where there is no radar coverage); the app shows missing details as not reported and never fills them in by guessing. Airlines and airports remain the authoritative source.
Forwarded booking emails (when enabled). If the app offers a forwarding address for confirmation emails, an email you forward to it is held on our server for 7 days so the app can fetch and import it; expired messages are removed the next time that inbox is used. This feature is currently off unless enabled.
Partner links (when configured). Some links to travel services may be affiliate links; if you book through one, the partner may pay us a commission at no extra cost to you. Such links are labeled in the app, open only when you tap them, and we do not send them your trip or personal data. They are currently off unless configured.
Web/PWA install funnel. When you use the web app (PWA), we run first-party measurement of install events (when the browser offers to install the app and whether the install is accepted, dismissed or completed). It uses a random visitor ID stored in your browser for up to 400 days, plus coarse country, browser and operating-system information worked out by our server. This is pseudonymous, not anonymous. Raw events are kept only as long as needed to measure the install funnel: our retention target is 90 days, after which they are meant to be rolled up into daily counts that carry no visitor ID. That clean-up is a job we run on our side rather than an instant automatic deletion, so events can remain stored longer until it runs; you can ask us to delete them sooner (see Your choices and requests). It contains no trip, receipt, expense, itinerary or payment data, is never used for advertising or cross-site tracking and is never sent to any AI provider.
Usage limits. A random app-install ID is sent with AI, flight and place-search requests so that we can enforce daily usage limits. It is created by the app, is not a device or advertising ID, and is not sent to Google or Anthropic. We keep only daily counters (per install ID and per hashed network address, with the ID and hash stored alongside the count for the current day, then reset; place search also keeps the total number of searches per day and per month), not the content of any request. To stop one network from creating too many shared trips per hour, the server also keeps the network address (for IPv6, its first 64 bits) in memory for up to an hour together with a count; it is not written to disk or to the database and is lost when the server restarts.
Our website (tripwalletapp.com). The marketing pages set no cookies and use no analytics or advertising trackers. The home page loads its fonts from Google Fonts, so Google receives your IP address and browser details when you open it. The app itself ships its fonts and makes no font request. Netlify, which hosts the site, processes standard server logs (IP address, pages requested). Do Not Track / Global Privacy Control: we do not track you across other sites and run no advertising trackers, so there is nothing for those signals to switch off; the web app's own install measurement does not read them.
What leaves your phone. When you tap Search on a place query (for example “museums in Madrid”, “restaurants near me”, or a place name the app could not match to anything else), the app sends our backend the search text, your app language and the app's random install ID. Email addresses, phone, card and ID numbers and booking-reference-like codes are removed from the text on your phone and again on our server. Questions about your own spending, documents, itinerary or trip are answered on your phone and are never sent.
“Near me” searches and your location. A “near me” search needs the location permission. Your GPS coordinates are not sent: the app converts them on your phone to the id of a fixed map cell (a hexagon of about 0.7 km², roughly one kilometre across) and sends only that id. This is less exact than GPS, but it still places you within that cell; because the cell is smaller than 3 km², Google Play classes it as precise location.
Who receives it. Our backend (Railway, United States) forwards the search to Google Maps Platform (Places API): the search text or place category, your app language and, for a “near me” search, the centre of that cell with a search radius. Google receives the request from our server, so it does not receive your IP address, the install ID, your GPS coordinates or anything about your trips, expenses or documents. In five cities (Madrid, Mexico City, Tokyo, Seoul and Rio de Janeiro) “near me” results can instead come from public map data held on our own server (OpenStreetMap, Overture Maps, Wikidata); in that case the cell id goes only to our server and Google is not involved. No AI provider is used for place search. Each result shows its source, and results from Google are marked “Google Maps”.
What is kept. Our server does not store or log your searches or the search text; it handles them in memory to answer the request. For the few cities where the app’s own place digest is available, the server may cache a digest for a city-block-sized area (an area key, not linked to any install ID or person) for a few hours, and may write an operational routing log of the same areas if that log is switched on; these hold no search text and no install ID. It keeps only counters: how many place searches were made in total per day and per month, and how many each install ID made in the current day (reset the next day). We do not keep Google's results on our server, and the app does not save them: it stores only your last 20 search phrases on your phone, which you can clear in the search screen. Google keeps and uses what it receives under its own terms; we do not control how long. Its handling is governed by the Google Privacy Policy.
Your choices. Place search runs only when you tap Search. You can refuse or revoke the location permission in your phone's settings (searches that name a city still work), clear your recent searches, or not use place search at all; nothing else in the app depends on it.
If you tap the location button, the app reads your location once to prefill your trip city/country and emergency information. The city and country are worked out on your phone from map data built into the app (Natural Earth borders and GeoNames places), so your coordinates are not sent to us or to any other service, and it also works offline. You can enter the place manually instead. Location is never used for tracking or advertising, and there is no background location. If you tap Open in Maps in the emergency screen, your coordinates are handed to the maps app or website you open (for example Google Maps) at that moment. Links that open a place in Google Maps open only after you confirm, and Google then receives the place name you opened.
Camera: scanning menus, receipts, prices, boarding passes and Travel Docs documents. Photos: importing an existing image. Microphone: voice input in Conversation Mode. Each permission is requested only when you use the feature, and denial simply disables that path (you can type or add things manually).
On Android, reading barcodes, printed text and passports, and the offline translation packs, use Google's ML Kit libraries, which run on your phone: the photos and text they process stay on the device. Under Google's terms, ML Kit may send Google usage and performance metrics about those features (for example which feature ran and how long it took, with a random ML Kit installation id), and it downloads the language packs you ask for from Google.
The optional medical card (blood type, allergies, medication, conditions) and family traveler details are stored on your device only and are shown only when you open them. They are never sent to our servers or to any AI service and are never attached to Emergency Translator or Conversation Mode requests; translating the medical card happens on your phone. Emergency features work offline by design.
We share data with no one else, and none of it is used for advertising.
Transport is HTTPS everywhere. PINs are stored only as salted one-way verifiers. Travel Docs (the document files and their details), the emergency/safety details and the medical card are encrypted on your device (AES-256-GCM). On Android the key is created and kept inside the phone's secure key storage (Android Keystore) and cannot be exported; in the web app it is a non-exportable browser key. The optional PIN adds a lock on those screens, and Android blocks screenshots and screen recording while they are open. Because the key never leaves the phone, a device-to-device copy of the app does not carry these items: Settings → Data → Export backup moves the medical card and the document details (not the document images themselves, which never leave the phone); the backup file is not encrypted, so keep it safe. Family Trip data on our server is protected in transit by HTTPS; we do not describe it as encrypted at rest. Not everything is separately encrypted: trips, expenses, receipt photos, flight and boarding-pass details, the itinerary and the app's install ID are kept in the app's private storage, protected by Android's app sandbox and your device lock, but not by this extra encryption. Android automatic backups are turned off for the app, so its data is not copied to Google backups. Export backup and Export trip (text, JSON, PDF or share) can include sensitive items such as the medical card in readable form; treat exports like the documents themselves. Family Trip data on our server is stored without encryption at rest (see above). No security measure is perfect — keep your device and PINs safe, and treat join codes like a key.
Local data stays until you delete it (per item, per trip, or everything via Settings → Data). Trip Wallet's server does not keep AI scan images or request text after a request completes; Anthropic handles what it receives under its own terms. Family Trip data is kept until the trip owner deletes the shared trip (no automatic expiry yet); members who are not the owner can leave the trip or email us to have their name removed. Web analytics: raw events have a 90-day retention target and then become daily counts (see Analytics); visitor ID up to 400 days in your browser. Daily usage counters: current day. Place search: nothing about a search is kept by our server beyond those counters and daily and monthly totals; your recent search phrases stay on your phone until you clear them. Forwarded booking emails (when enabled): 7 days. The Medical Card is one device-wide record: clear its fields in the card, or use Reset All Trip Wallet OS Data or uninstall. Our hosting provider may keep infrastructure backups or logs that we do not control, so data deleted from our server can persist there for a limited time. Full instructions: Data deletion.
On your phone you decide most things: delete an item, a trip or everything (Settings → Data); withdraw the AI-photo permission (Settings → Security Center); choose offline translation instead of AI; clear your recent searches; skip optional features; and deny camera, photo, microphone or location permissions in Android settings.
Requests to us. You can ask what we hold about you, ask us to correct or delete it, or ask us to stop using it, by emailing gocellularfix@gmail.com. Because we have no accounts, names or email addresses for app users, we can only find records when you give us an identifier: a Family Trip join code (or trip name and dates) or, for web install measurement, the visitor ID stored in your browser. Daily usage counters tied to a random install ID are reset every day and cannot be linked to a person. Requests to delete a Family Trip or to remove a display name are normally handled within 7 days (see Data deletion); we reply to any other request within 30 days at most. We may need to confirm that you control the trip or identifier, charge nothing, and will not treat you differently for asking.
Where you live. Some laws (for example in California, the European Union and United Kingdom, and Brazil) give rights such as access, correction, deletion, portability, objection and withdrawing consent. We honor requests of this kind from anyone, to the extent we hold identifiable data about them. We do not sell your personal information or share it for advertising, and the only way health information can leave your phone is the text of the Emergency Translator and Conversation Mode, and only if you chose AI translation. If you are in the EU, UK or Brazil you may also complain to your local data-protection authority.
Trip Wallet OS is intended for adults (18+) organizing travel and is not directed at children under 13 or at minors. When you first open the app it asks you to confirm that you are 18 or older and that you accept the Terms; it does not verify your age, does not collect a birth date or identity document, and keeps that confirmation only on your device. The app has no accounts, and we do not knowingly collect personal information from children. If you believe a child's information (for example a display name in a Family Trip) is on our server, email us and we will delete it.
Our backend and database run in the United States (Railway, US West region), and Anthropic and our website host process data in the United States. Flightradar24 (when live flight status is on) is operated from Sweden and receives only the flight number and date. Google's speech, ML Kit and Maps Platform services run on Google's global infrastructure. If you use online features from outside the United States, your information is transferred to and processed in the United States and the countries above, whose data-protection laws may differ from yours.
We will update this page when our practices or providers change and will change the effective date above; if a change is significant we will say so in the app or on this page. Questions or requests: gocellularfix@gmail.com. Publisher: Go Cellular LLC, California, USA.
Trip Wallet OS guarda tus datos en tu teléfono. La función Documentos de viaje y la Tarjeta médica nunca envían nada a la IA y no salen de tu teléfono (las tarjetas de embarque se leen en el dispositivo o se escriben a mano). El escáner de recibos, menús y precios, en cambio, envía la foto que tú elijas (con tu consentimiento): no fotografíes pasaportes, documentos de identidad ni tarjetas de embarque con él; Trip Wallet bloquea patrones conocidos de códigos de pasaporte, pero no puede reconocer todas las fotos. Las fotos de recibos, menús y precios se envían a un servicio de IA de terceros (Anthropic) solo después de tu consentimiento explícito, que puedes retirar en Ajustes; nuestro servidor no guarda la imagen y Anthropic la procesa según sus propios términos. El Traductor de emergencias y el Modo Conversación envían a Anthropic el texto que escribes o dices (puede contener datos de salud) solo si elegiste «Usar traducción con IA» en la pregunta única; si no, usan las frases sin conexión, y puedes cambiarlo en Ajustes. La importación de reservas (con datos sensibles quitados) envía texto a la IA cuando hay conexión. El Family Trip opcional guarda en nuestro servidor el nombre, presupuesto, fechas, monedas, un código para unirse, los nombres de los miembros, el país de destino elegido para el viaje y los gastos compartidos (etiqueta, comercio, nota, importes, moneda, categoría, fecha, reparto y quién pagó; sin ubicación, método de pago ni líneas del recibo) hasta que el propietario del viaje lo elimine; las fotos de recibos se sincronizan solo si el propietario activa la sincronización de fotos y cada dispositivo la acepta (desactivada por defecto). Solo el propietario puede eliminar el viaje compartido; los demás miembros pueden salir del viaje o escribir a gocellularfix@gmail.com para que quiten su nombre. Cualquiera con el código puede unirse y ver el viaje. Tus documentos de viaje y tu tarjeta médica se guardan cifrados en el teléfono. Las tasas de cambio, el clima de aeropuertos, las alertas de viaje y los horarios de tren se consultan sin datos personales. Medimos la instalación de la web (PWA) con un ID aleatorio de visitante (hasta 400 días; los eventos crudos tienen un objetivo de 90 días; no es anónimo) y enviamos un ID de instalación aleatorio con las solicitudes de IA, vuelos y búsqueda de lugares para aplicar límites diarios (solo contadores; ese ID no se envía a Google ni a Anthropic). La búsqueda de lugares usa Google Maps Platform (Places API) a través de nuestro servidor: Google recibe el texto que buscas, el idioma de la app y, en una búsqueda «cerca de mí», el centro de una celda de mapa de unos 0,7 km²; no recibe tus coordenadas GPS, tu dirección IP, el ID de instalación ni tus viajes, gastos o documentos. Esa celda es menos exacta que el GPS, pero al medir menos de 3 km² Google Play la considera ubicación precisa. En Madrid, Ciudad de México, Tokio, Seúl y Río de Janeiro los resultados «cerca de mí» pueden venir de datos de mapas públicos guardados en nuestro servidor, sin Google. La búsqueda no usa ningún proveedor de IA. Nuestro servidor no guarda ni registra tus búsquedas (solo contadores); tus últimas búsquedas se guardan en tu teléfono y puedes borrarlas. Puedes negar el permiso de ubicación o no usar la búsqueda de lugares. Google trata lo que recibe según su Política de Privacidad (policies.google.com/privacy). Si se activa el estado de vuelos en vivo, el número de vuelo y la fecha se envían a Flightradar24 a través de nuestro servidor (sin datos personales; no se guardan). No todo está cifrado por separado: solo los documentos de viaje, la tarjeta médica y los datos de seguridad; las copias de seguridad automáticas de Android están desactivadas y las exportaciones que crees pueden incluir datos sensibles. Puedes pedirnos acceso, corrección o eliminación escribiendo a gocellularfix@gmail.com (respondemos en unos 30 días); para localizar datos necesitamos un identificador, como el código del Family Trip. La app es para mayores de 18 años. Sin cuentas, sin anuncios, nunca vendemos datos. Contacto: gocellularfix@gmail.com.
O Trip Wallet OS guarda seus dados no seu telefone. O recurso Documentos de viagem e o Cartão médico nunca enviam nada à IA e não saem do seu telefone (os cartões de embarque são lidos no aparelho ou digitados à mão). O scanner de recibos, cardápios e preços, porém, envia a foto que você escolher (com seu consentimento): não fotografe passaportes, documentos de identidade nem cartões de embarque com ele; o Trip Wallet bloqueia padrões conhecidos de códigos de passaporte, mas não reconhece todas as fotos. As fotos de recibos, cardápios e preços são enviadas a um serviço de IA de terceiros (Anthropic) somente após o seu consentimento explícito, que você pode retirar em Ajustes; o nosso servidor não guarda a imagem e a Anthropic a processa conforme seus próprios termos. O Tradutor de emergência e o Modo Conversa enviam à Anthropic o texto que você digita ou fala (pode conter dados de saúde) somente se você escolheu «Usar tradução por IA» na pergunta única; caso contrário usam as frases offline, e você pode mudar isso em Ajustes. A importação de reservas (com dados sensíveis removidos) envia texto à IA quando há conexão. O Family Trip opcional guarda no nosso servidor o nome, orçamento, datas, moedas, um código de entrada, os nomes dos membros, o país de destino escolhido para a viagem e as despesas compartilhadas (rótulo, estabelecimento, nota, valores, moeda, categoria, data, divisão e quem pagou; sem localização, forma de pagamento nem itens do recibo) até que o dono da viagem a exclua; as fotos de recibos só são sincronizadas se o dono ativar a sincronização de fotos e cada aparelho aceitar (desativada por padrão). Somente o dono pode excluir a viagem compartilhada; os outros membros podem sair da viagem ou escrever para gocellularfix@gmail.com para remover o nome. Quem tiver o código pode entrar e ver a viagem. Seus documentos de viagem e seu cartão médico ficam criptografados no telefone. As taxas de câmbio, o clima de aeroportos, os alertas de viagem e os horários de trem são consultados sem dados pessoais. Medimos a instalação da web (PWA) com um ID aleatório de visitante (até 400 dias; os eventos brutos têm meta de 90 dias; não é anônimo) e enviamos um ID de instalação aleatório com os pedidos de IA, voos e busca de lugares para aplicar limites diários (apenas contadores; esse ID não é enviado ao Google nem à Anthropic). A busca de lugares usa a Google Maps Platform (Places API) por meio do nosso servidor: o Google recebe o texto que você busca, o idioma do app e, em uma busca «perto de mim», o centro de uma célula de mapa de cerca de 0,7 km²; não recebe suas coordenadas de GPS, seu endereço IP, o ID de instalação nem suas viagens, despesas ou documentos. Essa célula é menos exata que o GPS, mas, por ter menos de 3 km², o Google Play a considera localização precisa. Em Madri, Cidade do México, Tóquio, Seul e Rio de Janeiro os resultados «perto de mim» podem vir de dados de mapas públicos guardados no nosso servidor, sem o Google. A busca não usa nenhum provedor de IA. Nosso servidor não guarda nem registra suas buscas (apenas contadores); suas últimas buscas ficam no seu telefone e você pode apagá-las. Você pode negar a permissão de localização ou não usar a busca de lugares. O Google trata o que recebe conforme a sua Política de Privacidade (policies.google.com/privacy). Se o status de voo ao vivo for ativado, o número do voo e a data são enviados à Flightradar24 por meio do nosso servidor (sem dados pessoais; não são guardados). Nem tudo é criptografado separadamente: apenas os documentos de viagem, o cartão médico e os dados de segurança; os backups automáticos do Android estão desativados e as exportações que você criar podem incluir dados sensíveis. Você pode pedir acesso, correção ou exclusão escrevendo para gocellularfix@gmail.com (respondemos em cerca de 30 dias); para localizar dados precisamos de um identificador, como o código do Family Trip. O app é para maiores de 18 anos. Sem contas, sem anúncios, nunca vendemos dados. Contato: gocellularfix@gmail.com.