Travel Mapmory works fully offline in guest mode — your trips, journals and photos never leave your device. A random install id may be used to count the monthly free recommended itineraries, and if you allow notifications, a push token, that install id and your app language are stored so we can send notices (a guest token is deleted after 90 days without re-registration). If you sign in (Apple/Google/Kakao/Naver/LINE), we collect your email, name, profile photo URL, and social account identifier to provide cloud backup, sync, and trip sharing. Your travel records, journal text, and attached photos are backed up to Google Firebase (Firestore/Cloud Storage, us-central1, USA) only while signed in, as are the short video clips you attach to a journal.

Community (optional, signed-in users who accept its terms). Your nickname, your community profile picture (a photo you pick from your library or a built-in glyph — never your sign-in account's photo), your posts (text, photos, video clips, tagged places and cities, itineraries, place reviews and ratings), comments and the journals you choose to publish are public: anyone using the app can see them, signed in or not. Your likes, follows, saved posts, block list and notification settings are visible only to you; reports you file (target, reason, note) are seen only by the operator and are forwarded to the developer's email. Your community content is deleted when you delete it or your account; content the operator removes for breaking the rules is kept for 90 days for appeals and then deleted.

Generative AI features (opt-in). These run only after you grant permission on a dedicated in-app consent screen shown at first launch, which states what is sent, to whom, and why. If you decline, every journaling feature still works in full — entries, photos, videos, map coloring, and backup.

• Sent to: Google LLC (Gemini API)
• Data sent: voice memo recordings; journal text and photo captions you write; trip and place details (city names, place names, itinerary, expense summary); public feed posts and comments you ask to translate
• Used for: transcribing voice into journal text, generating journal epigraphs, and generating city, place, restaurant, stay, and aircraft guides, and translating feed posts and comments
• Retention: content is used only to produce the result of that request and is not stored, except feed translations, which are kept on our server so the same post is not translated twice; an edited post is translated again and a deleted post's translations are deleted with it. Place names in already-public posts and journals are also translated for readers of other languages; this sends public place names only, no personal data, and runs regardless of the reader's AI setting
• Withdrawing consent: turn it off any time in Settings → AI features; sending stops immediately

Google LLC provides protections equivalent to those described in this policy (Gemini API Terms).

Device location is processed on-device only (map display, current-country detection) and is never transmitted or stored server-side. Search keywords are sent to Google Places, myrealtrip, Trip.com, Klook, Airalo, Travelpayouts, and AeroDataBox to provide search results and external booking links; no personal data is shared with them. In-app purchases (lifetime pass, donation items) are processed entirely by Apple/Google's own payment systems — we never see your card details. In-app feedback messages are forwarded to the developer's email via Gmail, together with a reply address when one is available — either an optional email you type in the feedback sheet, or your signed-in account's email — used solely to answer that message. We use Firebase App Check (Play Integrity on Android, App Attest on iOS) for API security. We also compile statistics from the trip itineraries (cities, places visited and their order by day) that signed-in users back up or add to Shared trips, processed so that no individual can be identified, to analyze popular cities, places and itinerary patterns (trip length, places visited together) and to create recommended itineraries. These statistics contain no account identifiers, names, email addresses, or journal, photo, memo or expense content. A place name you saved is kept for at most 30 days in a private store only the developer can read, and only when the same name was saved at least twice. Rankings built from these statistics are shown to everyone in the app's Keep tab (per app language: cities with many upcoming trips, cities most visited last quarter, and the most planned places, restaurants and stays of top cities). They show names and order only — never accounts, nicknames or user counts. City rankings have no minimum, so one person's trip can make a city appear; places and restaurants need at least two accounts; stays must be listed on Google and may come from a single account's trip. Places you add by typing your own address or name are never used in rankings or shown in public itineraries, and the coordinates in a public itinerary are deleted 30 days after posting. Place details cached from Google Places (coordinates, photos) are deleted after 30 days, keeping only the place id. Your nickname history (name and date) is kept, visible only to the operator, to keep nicknames unique and to match event hashtag entries to accounts; it is deleted with your account. Prize winners' name, contact and shipping address are used only to ship the prize and are deleted once it ships. The statistics are recomputed weekly, so a deleted account's trips drop out of the next run; monthly trend records hold counts only and may remain. We run no ads and no third-party analytics SDKs; we do collect our own anonymous usage events (screen/feature counts, never journal content) tied to a random per-device id, which you can turn off in Settings > Usage statistics, and we derive a country code from the request IP address for aggregate distribution stats (the IP itself is not stored, and no finer location is derived). For each in-app purchase we keep an operational purchase record (purchase time, product, how it was made, platform, app version and language, country) to confirm purchases and count revenue; the transaction and device ids are stored only as irreversible hashes, it holds no account, name, email or payment details, and it is kept even when usage statistics are off. We never sell your data.

Account deletion: delete your account in-app via Settings → Account → Delete Account, or email travelmapmory@gmail.com. Deletion removes all cloud data (trips, journals, photos, account info). All transfers are encrypted via HTTPS/TLS.

Contact: travelmapmory@gmail.com