Privacy Policy

Who we are

Tomodachi is a travel companion app for Japan. In this policy, "we" and "us" mean the team that makes it, and "you" means the person using it.

You can reach us about anything in this policy at info.tomodachiai@gmail.com.

What we collect

When you build a trip, you answer a short set of questions and we send those answers to our server so an itinerary can be written for you. That is where the cities, the dates, the size of your group, your budget, the pace you want, your interests and any dietary needs go.

Alongside the itinerary we keep:

• Your trip code, so the people travelling with you can join.
• A device identifier the app generates for itself. It is not your Apple or Google account, and it is not tied to your name.
• The display name you choose when you join a trip, which the others on the trip can see.
• Your email address, and only if you pay. It is used for the receipt and to help you recover your trip code.

We never ask for your contacts, your photos, your messages or any social account. The app does not connect to them, so there is nothing for us to read.

What never leaves your phone

The app is offline first, so a large part of it is simply local storage. These are stored on your device and are not sent to us at all:

• Your exact location, while you are following directions or using Lost Mode.
• The home address you confirm, and its coordinates.
• Your emergency contacts.
• Your packing list, the stamps you collect, your settings, and your check-ins.
• Downloaded maps.

Deleting the app deletes all of it. There is no copy of it anywhere else.

Anonymous analytics, only if you turn them on

We ask once, during setup, whether you are willing to share anonymous information about how the app is used. The purpose is to learn where travellers get lost, what they struggle to say and which planned stops they miss, so that signage and services in Japan can be improved. Anonymised totals built from it are also shared with, or licensed to, tourism boards, regions and businesses (see "Who else sees any of it"). You can turn it off at any time in Settings, and turning it off also deletes anything still waiting to be sent.

If you say yes, seven kinds of moment are recorded:

• lost_mode_activated — Lost Mode was opened.
• route_abandoned — directions were started and not finished.
• phrase_card_used — a translation phrase card was used, including the card you show station staff.
• gap_search — something was searched for that we had no place for.
• repeat_visitor_detected — this phone has planned a trip with us before.
• stop_arrived — you arrived at a stop you had planned, and whether that was early, on time or late.
• why_label — your answer, if you give one, when the app asks why you did not make it to a planned stop. This is a new kind of information: reasons for skipping a planned stop.

In a station. If you open Lost Mode in a railway station, or show a station worker the card from it, the record also names the station and the line you were heading for, and whether you were going to a platform, changing trains or leaving. These come from your plan or from the station you pick, and are chosen from our fixed list of major stations and lines. At a station that is not on that list, no station or line is sent. When a station is named, the record carries no position: no coordinates, not even rounded ones. Like every record, it still carries your trip’s city and country. Your destination station is never sent. Totals by station, line and time of day are shared only when at least 5 different trips stand behind them.

The app may ask "Didn’t make it to this stop?" after you close directions early, in an evening check-in, or when you mark a stop as skipped. It is never asked on a phone that belongs to a dependent (a child) on the trip, and that phone sends no analytics at all. Answering is optional. Answers are picked from a fixed list (for example "ran out of time", "weather" or "it was closed"), with no free text and no text box. Your answer is kept on your phone for your own trip recap; it is sent to us only if analytics are on. For a stop you skipped or arrived at, the location sent is the stop’s own location from our list of public places, rounded the same way, never your phone’s GPS; for an arrival, that is the place you arrived at. A stop that is not a public place on that list is sent with no location, and the stop’s name is never sent.

Before any of it is queued, your phone rounds the location to about 110 metres and the time to the hour, and replaces your trip with a one-way code that cannot be turned back into a trip. The full-precision values never leave the device. No name, no email and no device identifier is attached, and this data goes to a different database from the one holding your trip.

When something you search for is missing from our places, we record the kind of thing it was, the city and the hour. We deliberately do not record what you typed, because a search can be a person’s name or a friend’s address.

Who else sees any of it

We never sell or share anything about you as an individual. There is no advertising in the app and no data broker involved. The companies and organisations below are the ones the app genuinely has to talk to for it to work:

• Anthropic — receives your trip answers so a model can write the itinerary. It is not used to train models.
• Supabase — hosts our database and server functions.
• Google — we check a place exists through Google Places. We keep only Google’s identifier for that place and none of its content.
• The OpenStreetMap Foundation — we look up coordinates for a place name through their Nominatim service.
• The Wikimedia Foundation (Wikidata and Wikimedia Commons) — to find photographs of the places on your trip, and a place’s official website when you open its card. It receives the public identifiers of those places (never your name, trip code or location) and serves the photographs. Your phone asks it directly, so it sees your device’s internet address.
• OSRM — receives coordinates to work out a route between them.
• Open-Meteo — receives coordinates to return a forecast.
• OpenFreeMap — serves the map tiles your app requests.
• Google Maps and Apple Maps — only if you tap “Open in Google Maps” or “Open in Apple Maps” for a train, subway, bus or ferry ride, or for a stop too far to walk to. Only the destination of that one journey is sent (map coordinates, or a public place name such as a station or a sight); that company’s app or website works out the route from your current location and handles it under its own privacy policy. We never send your hotel or a place you added yourself, and nothing else is sent.
• Stripe — handles payment details, if and when paid trips are switched on. We never see your card number.

Each of these receives only what it needs for that one task. None of them receives your email address, and none receives your analytics.

Anonymised totals from the analytics above — never individual trips, and never anything that points back to you — are shared with, or licensed to, tourism boards, regions and businesses, so they can see things like where visitors get lost or why a planned stop gets skipped. Anything we publish openly counts at least 20 travellers in every number. Access-controlled reports, which only a named partner can open, count at least 5 travellers in every number. A total with fewer travellers behind it is withheld, not rounded up.

To be plain about it: we do license anonymous statistics built from the analytics — totals of at least 20 travellers for anything published, and at least 5 for access-controlled partner reports — to tourism boards, regions and businesses, and we may be paid for them. Some laws, such as California’s Consumer Privacy Act (CCPA), may treat that as a "sale" or "sharing" of personal information even though no individual can be picked out. Turning analytics off in Settings keeps your data out of those totals from then on.

We may also disclose information if the law requires it, or to protect someone from harm.

Itineraries can be reused

Writing an itinerary is slow and expensive, so when two people ask for a very similar trip we may serve the second one an itinerary we have already written. What is reused is the plan itself, which contains no personal information. Your trip, your code, your travelling companions and anything you collect are yours alone and are never shared.

Where it is kept

Our databases run in Tokyo, Japan. The companies and organisations listed above may process what we send them in other countries under their own terms.

How long we keep it

• Your trip and its code are kept until you ask us to delete them, because losing a trip mid-journey is the worst thing this app could do to you.
• Your email address is kept as long as the trip it paid for.
• Analytics are added into totals every night. The one-way trip code stays with them for up to about five weeks, only so that one trip is counted once in a month’s totals, and is then deleted. What we keep after that is counts, not journeys.
• Reusable itineraries are kept as content, with nothing personal attached.
• Anything stored only on your phone lasts exactly as long as the app does.

What you can ask us to do

Write to info.tomodachiai@gmail.com with your trip code and you can ask us to:

• Tell you what we hold about you.
• Correct anything that is wrong.
• Delete your trip and your email address.
• Stop the anonymous analytics, which you can also do yourself in Settings at any time.

Once the one-way trip code has been deleted from the analytics, up to about five weeks after they were sent, we can no longer find your contribution to them, because nothing in them points back to you. That is the point of the design, and it is also a limit on what we can undo.

If you are in Japan you may also complain to the Personal Information Protection Commission. If you are in the United Kingdom or the European Economic Area, you may complain to your local data protection authority.

How it is protected

Traffic between the app and our server is encrypted. No part of the app can read another traveller’s trip: the database refuses every direct read, and the few operations a phone is allowed to perform are narrow and checked on the server. No method is perfectly secure, and we will not claim otherwise.

Children

Tomodachi is meant for adults planning travel, and we do not knowingly collect information from a child under 13. Children do travel with their families, and a parent can add a child as a traveller on a trip. Doing so records the child’s display name and nothing else. A phone set up as a dependent on a trip is never asked survey questions, and a dependent’s phone sends no anonymous analytics, whatever its settings say. If you believe a child has given us anything more, write to us and we will delete it.

Changes to this policy

If we change what we collect, we change this policy in the same release and move the effective date at the top. If the change is significant we will tell you in the app rather than hoping you re-read this.

Contact

Questions, requests and complaints all go to info.tomodachiai@gmail.com. A person reads it.