Traveto

Privacy policy for the application

Last updated: 1 November 2026

This English text is a translation provided for convenience. The German version at traveto.app/datenschutz-app is the legally binding one.

This policy applies to the application at app.traveto.app, the apps for Android, iOS and TV, and to connecting Traveto with AI assistants such as Claude and ChatGPT. For the website traveto.app, the privacy policy at traveto.app/en/privacy-policy applies.

1. Controller

Kilo Moana UG (haftungsbeschränkt), Heidestraße 49g, 25462 Rellingen, Germany
Represented by its managing director Alexander Siemer-Schmetzke
Email: info@kilo-moana.com, phone: +49 152 04744501

2. Hosting and operation

The application, its database, the sign-in service and audience measurement run on a virtual server that we rent from STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, and operate ourselves. The data centre is located in Germany. We have a data processing agreement with STRATO under Art. 28 GDPR.

With every request, the server processes technically necessary data: IP address, time, requested address, browser identifier and response status. They are kept in log files that rotate by size (at most 30 MB per service) and are therefore overwritten after a few days to weeks. The legal basis is Art. 6(1)(f) GDPR; our interest is secure and stable operation.

We back up the database every seven days on the same server at STRATO. We keep the last four backups; older ones are deleted.

3. Account and sign-in

For sign-in we operate our own identity service (Keycloak) at auth1.kilo-moana.com. It stores email address, name and password (as a hash only). The application itself stores no password. In the application we store for your account: email address, verification status of the email address, display name, roles, time of registration and of the last sign-in.

The legal basis is Art. 6(1)(b) GDPR (contract for the use of the application).

4. What you create in Traveto

We store what you enter in order to show it to you and to the members of your boards (Art. 6(1)(b) GDPR):

  • Boards, places, categories, trip types, vacations with periods and stages
  • Notes on places, comments (with your display name and your account identifier, so that we can assign them when the account is deleted), ratings
  • To-dos (with due date and, if you wish, a reminder time) and packing lists
  • Invitations to a board (email address of the invited person, expiry date)
  • Friendships, friend requests (email address of the requested person) and places you send to friends, with your remark
  • Notices in a board that someone added, removed, rated or commented on a place (without the text of the comment)

Members of a board see its content. If you share a board publicly or share a trip as a link, anyone with the link sees the places and categories or the trip, but no ratings, comments or names.

Home address. If you enter a home address in your profile, we store it with its coordinates in order to calculate distance and travel time from home.

Travel profile. In the travel profile you record who travels with you: role (me, partner, child, other), a freely chosen label, holiday region, whether the person is bound to school holidays and from which year, annual leave entitlement and working days. We do not ask for names or dates of birth. The travel profile belongs to your account; other members do not see it. From it we calculate school days, leave days and suggestions. If you enter names of children or other people as the free label, we process them on your behalf; please only enter what you need for this.

5. Services we use for features

Google Maps Platform (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you add a place, our server sends the entered name, optionally with an approximate position, to the Google Places API and stores address, coordinates, rating, photo references and description. For distances it sends coordinates to the Google Routes API, for the home address the address text to the Google Geocoding API. Our server fetches photos of places from Google and delivers them itself; your browser does not connect to Google for this. We do not transmit any identifier of your account to Google. Google may process data in the USA; the basis is the adequacy decision for the EU-U.S. Data Privacy Framework, alternatively the standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR.

Anthropic (Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA). AI features of the app run via the Claude API: suggestions near a place (name, city, country, coordinates), the assessment of whether a place suits the trip (additionally category, your description of the place, Google rating as well as trip type, preferences, number and age of fellow travellers from the board settings), AI discovery in the map section, the trip summary (vacation, dates, stages) and packing suggestions (destination, description, duration, luggage). We do not send any identifier of your account, any notes, any comments or the travel profile. Anthropic processes the data as a processor under the Data Processing Addendum that is part of its commercial terms and does not use it for training. The transfer to the USA is based on the standard contractual clauses contained therein. Anthropic deletes inputs and outputs after 30 days at most. Anthropic keeps content longer, up to two years, only if it is identified as violating its usage policies (as stated by Anthropic on 1 July 2026). Legal basis: Art. 6(1)(b) GDPR; you trigger these features yourself.

Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin, Ireland). For subscriptions we create a customer at Stripe with your email address and your account identifier. You enter payment details and billing address on Stripe's payment page; we do not see them. Stripe reports the status and term of the subscription to us. Legal basis: Art. 6(1)(b) and (c) GDPR (contract, retention under tax law).

OpenHolidays API (openholidaysapi.org). Our server fetches school and public holidays per country and year. No data about you is transmitted.

YouTube Data API (Google). In the TV view our server searches for videos about a destination. Only the search term is transmitted. If you play a video, your device loads it from youtube-nocookie.com; Google's privacy policy applies to this.

Sending email. We send invitations, friend requests, to-do reminders and confirmations of cancellations and withdrawals via the mail server of STRATO AG (see section 2, data processing under Art. 28 GDPR). The emails contain the recipient address and the respective content (for example the name of the board and your email address in an invitation). Emails for registration and passwords are sent by the sign-in service.

Websites of places. If a place has a website, our server fetches its home page and takes over title, description and a contact address given there.

6. What your browser loads directly

  • Map tiles from OpenStreetMap (OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) and, if you choose the satellite view, from Esri (server.arcgisonline.com, USA). These providers receive your IP address and the map section. Legal basis: Art. 6(1)(f) GDPR, our interest is displaying the map. An adequacy decision exists for the United Kingdom.
  • Payment on Stripe's page when you take out a subscription.
  • Videos from youtube-nocookie.com and preview images from i.ytimg.com in the TV view.

We deliver fonts and libraries ourselves.

7. Audience measurement

We measure usage with Umami, which we operate ourselves at stats1.kilo-moana.com. We record the pattern of the visited page (for example "/packing/:id", without identifiers), the external referring page, device type, browser, country and individual events such as registration or taking out a subscription, in each case without reference to your account. Umami sets no cookies and stores nothing on your device. The data does not leave our server. Legal basis: Art. 6(1)(f) GDPR.

8. Connecting AI assistants (Claude, ChatGPT and others)

You can connect Traveto with an AI assistant that supports the Model Context Protocol, such as Claude by Anthropic or ChatGPT by OpenAI. You set up the connection yourself and sign in with your Traveto account. From then on, the assistant can, in your name and with your permissions:

  • read place data of your boards: name, address, coordinates, Google data, categories, note, average rating, distances
  • read your vacations, your own to-dos and packing lists, and holiday dates
  • read the names of your friends, without email address
  • create, change or remove places, categories, notes, comments, ratings, vacations, to-dos, packing lists and boards, and send places to friends

Traveto does not give assistants comments, individual ratings of others, members or email addresses. An assistant receives your travel profile only if you expressly allow this under Profile > Travel profile; persons are then named only by their role, never by your label.

What the assistant reads from Traveto and what you write in the conversation is processed by the assistant's provider under its own responsibility and terms; we have no influence on this. For each call we log the name of the tool, your account identifier and the result, without content. The legal basis is Art. 6(1)(b) GDPR; the transfer to the assistant takes place at your request. You can disconnect at any time in the assistant.

9. Consent to legal texts

When you agree to the terms of use, we store as proof the account identifier, document, version, checksum of the text, time, IP address and browser identifier. The legal basis is Art. 6(1)(c) and (f) GDPR (proof of the conclusion of the contract).

10. Retention and deletion

  • Notices in a board (who did what): 30 days
  • Friend requests including email address: 30 days after expiry or completion; completed inbox entries: 30 days
  • Photos of places in the cache: 30 days from the last access
  • Log files: see section 2
  • Billing data: as long as required by tax and commercial law (up to 10 years)
  • Everything else: as long as your account exists, and at most 30 days after the account is deleted

Deleting your account. You can delete your account in the application under Profile. This happens in two steps.

Immediately: the account is blocked. You are signed out and can no longer sign in. We immediately delete public shares of your boards and your travel profile. We cancel a running subscription at the end of the paid period; nothing more is charged. We no longer send to-do reminders.

After 30 days we delete finally. Until then you can get back an account deleted by mistake by writing to us. A cancelled subscription must then be taken out again. Final deletion means:

  • A subscription still running ends immediately.
  • We delete the account at the sign-in service with email address, name and password.
  • In the application we delete email address, display name, roles, home address with coordinates and the distances from this address, memberships and settings in boards, to-dos, packing lists, friendships, blocks, friend requests from you and to your address, the inbox of sent places, open invitations from you and to your address, the board notices about your actions, granted access and your usage counters. We then keep the costs of the calls you triggered only as a daily total without reference to an account.
  • Boards in which nobody but you is a member are deleted with all content. If a board has other members, it passes to the member who has been there longest. Its content remains.
  • In boards that continue to exist, your comments, ratings and notes remain for the other members, but without your name. Comments appear as "Deleted account". Comments from before 30 October 2026 that we cannot reliably assign to an account keep the name they were written with; write to us and we will remove it. If a comment itself contains something personal, please delete it beforehand.

What remains:

  • an empty account record with a random identifier, without email address and name. The anonymised contributions point to it.
  • the proof of your consent to legal texts (section 9), because we must be able to prove the conclusion of the contract. The legal basis is Art. 6(1)(c) and (f) GDPR.
  • cancellations and withdrawals you declared using the buttons in the app, with name, email address, contract and time. We must be able to prove that and when a declaration was received. The legal basis is Art. 6(1)(c) and (f) GDPR. We delete them three years after the end of the year in which they were received (regular limitation period, sections 195 and 199 of the German Civil Code).
  • the link between your account and the customer at Stripe, without email address, and your subscription data. Stripe keeps invoices and payments as long as required by tax and commercial law (up to 10 years).

Deleted data remains in the backups (section 2) until they are deleted after four weeks. If we restore a backup, we delete again the accounts whose deletion was requested since then.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to info@kilo-moana.com for this.

You can lodge a complaint with a supervisory authority, for example the Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

12. Changes

If the way we process data changes, we adapt this policy. The current version is available at traveto.app/datenschutz-app.