English translation of the Spanish original, which is the reference text. Leer en español.
Who is responsible
The controller of the data of the Awayly app and awayly.co is Awayly. For any privacy question, write to privacy@awayly.co.
What data we process
- Account: email, display name, language and an internal identifier. You provide them when you sign in with your email, Google or Apple. With Apple you can hide your email; we then receive an Apple relay address.
- Trip content: trips, members, proposals, votes, activities, booking details you type in, expenses and settlements. Added by you and the people on your trips.
- Trip photos: the photos you add to the album, their thumbnail, the trip day they belong to and who added them. Before storing them we remove GPS location and other metadata (EXIF, XMP, IPTC).
- AI requests: what you ask in “Plan with AI” and the suggestions it returns, with their sources.
- Private preferences: limits or constraints you mark privately. The rest of the group only sees totals of at least 3 answers.
- Device: installation identifier, platform, app version and the token used to send you notifications.
- Usage and diagnostics: app events (for example “decision created” or “sync error”), screen, platform, version and an error code, linked to your account. They do not include your trip content, amounts, addresses or messages.
- Import and receipts: the text, .txt file, PDF or image you choose to import. We do not keep the original document.
- Purchases: if you buy a pass in the future, the transaction and product identifiers, their status and refunds. We never receive your card details.
- Reports: when you report an AI suggestion or reply or a photo, what you report (its reference and the trip), the reason, any note you write and the date. Only the Awayly team sees them; nobody on the trip learns who reported.
- Support: what you send us by email.
We use the camera and your photos only when you choose to take or add a photo or read a receipt. We do not use your device location, your contacts or your microphone, we do not access your mailbox and we never import documents automatically.
If you ask to put plans in your phone calendar, the app writes the plans you choose there and later only changes or deletes the events it created itself. That data stays on your device and in the calendar account you use; we do not read or send your other events.
Why we use it and on what legal basis
- Creating your account, providing the service and syncing the group's trips: performance of the contract (Art. 6(1)(b) GDPR).
- Storing the trip album and sharing it with a link when you ask: performance of the contract.
- Suggesting things to do, places to stay, flights or a full trip with “Plan with AI” when you ask: performance of the contract. Before your first request the app also explains what is sent to OpenAI and asks for your explicit permission; if you do not accept, nothing is sent.
- Importing bookings or reading receipts when you ask: performance of the contract. Before sending, the app tells you the content will be sent to OpenAI.
- Sending trip notifications (votes, plan, expenses): performance of the contract. You can turn them off in your phone settings.
- Handling purchases, restores and refunds, once the pass is on sale: performance of the contract and legal obligations (Art. 6(1)(c) GDPR).
- Security, abuse prevention and cost control (usage limits and bot checks): legitimate interest in protecting the service (Art. 6(1)(f) GDPR).
- Reviewing content reports and removing or correcting what breaks the terms: legitimate interest in keeping the service safe (Art. 6(1)(f) GDPR).
- Minimal usage statistics and error diagnostics: legitimate interest in maintaining and improving the app (Art. 6(1)(f) GDPR).
We do not sell your data, we do not use it for advertising and we do not use your trip content for marketing. The app has no ads.
What the AI receives
So that suggestions fit, your request is sent to OpenAI together with the trip context: its name, destinations, accommodation and dates, time zone, language, the activities in the plan, the votes and the bookings (without booking references, links, expenses or photos), and how many of you there are with each person's arrival and departure dates. People's names are not sent: each person appears as “person 1”, “person 2” and so on.
When the AI searches the web (flights, places to stay or a full trip) only the number of people is sent; OpenAI runs the search and returns the sources, which the app shows with each suggestion. Nothing is added to the plan until you confirm it.
We ask OpenAI not to store the replies. Under its API terms, OpenAI does not use this data to train its models and may keep it for up to 30 days to detect abuse.
Shared album and short links
“Share” in the album creates an awayly.co/a/… link that expires after 72 hours. Anyone who has it can view and download the trip photos while it lasts, without an account. Photos are served through signed addresses that expire after one hour, and we only store a fingerprint of the link code, not the code itself.
Invitations (awayly.co/i/…) and shared votes (awayly.co/d/…) use short links. Whoever receives an invitation sees the trip name before joining; joining requires an account.
Who we share it with
Only with providers that process it on our behalf and solely to provide their service to us:
- Supabase: database, authentication, file storage (photos) and server functions. European Union (Ireland).
- OpenAI: “Plan with AI”, including web search, and reading the text, PDF or image you choose to import. United States.
- RevenueCat: confirming and restoring purchases, once the pass is on sale. United States.
- Expo, Google Firebase Cloud Messaging and Apple Push Notification service: delivering notifications to your device. United States.
- Cloudflare: serving awayly.co, bot checks (Turnstile) and email routing for awayly.co. Global network.
- Resend: sending you the sign-in link and alerting our team about each report (without the note or who reported). United States.
- Google and Apple: signing in with their account, if you choose to, and app downloads and payments in their stores, under their own terms.
When a provider processes data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework, where the provider is certified, or on the European Commission's standard contractual clauses.
The people on your trips see what you share in those trips: your name, your votes (only as totals while a vote is open), activities, expenses and the photos you add to the album.
How long we keep it
- Account and trip content: while you have an account.
- Album photos: up to 12 months after the trip ends, or until you or the trip delete them. We warn you before deleting them.
- AI conversations: up to 90 days after the trip ends.
- Album links: expire after 72 hours.
- Usage and diagnostic events: 30 days.
- Security log (for example, who created a link): 12 months.
- Content reports: until your account or the trip they belong to is deleted.
- If you merge two accounts, the merge can be undone for 30 days.
- When you delete your account, your identity, devices and usage events are deleted. Amounts and transfers needed for the group's balances to add up are kept without your identity.
- Purchase data: for the periods required by legal, tax and accounting obligations.
Your rights
You can ask for access, rectification, erasure, objection, restriction and portability of your data, and withdraw a permission you gave, by writing to privacy@awayly.co. In the app you also have:
- Settings → Export my data, to download what we store about your account.
- Settings → Delete my account, to delete it (also at awayly.co/en/delete-account).
If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to your local data protection authority.
Minors
Awayly is not intended for people under 18 and we do not knowingly collect data from minors. If you think a minor has given us data, write to us and we will delete it.
Security
Communications are encrypted (HTTPS). Access to data is limited per trip and per member in the database. Photos are processed on the server to remove location and other metadata before storing them, and are only delivered through signed addresses that expire.
Changes
If we make a significant change to this policy, we will let you know in the app before it applies.