Privacy Policy — VoyagEase

1. Introduction

We care about your privacy. This Policy explains, in clear terms, how we collect, use, and protect your data when you use the VoyagEase app and website.

Age Notice: VoyagEase is intended for users aged 18 and older. By creating an account, you confirm that you are at least 18 years old. Users under 18 are not permitted to use VoyagEase.

2. Information We Collect

2.1 Information You Provide Directly

• Account Registration: Email address, display name, phone number, password (or OAuth sign-in via Google/Apple)
• Profile Information: Avatar/photo, biography, location fields, language preferences
• Payment Information: We use Stripe for payments and Connect onboarding; we do NOT store full card numbers or CVV locally
• Communication: Messages you send via the in-app messaging system and any media you attach (photos)
• Trip / Ad Details: Trip routes, dates, prices, stops and related ad metadata
• Identifiers: User IDs and device push tokens (FCM/APNs) used for account and notifications

2.2 Information Collected Automatically

• Device Information: OS type, device model, unique device identifiers, IP address
• Usage Data: Features accessed, actions taken, timestamps, session duration (for app functionality and crash diagnostics)
• Location Data: Only if you explicitly grant permission; used for trip matching, optional chat share, and search filtering (when-in-use; no background tracking)
• City / place search: Place queries are sent to Google Places to power city autocomplete
• Crash diagnostics: Sentry may receive error reports; when you are signed in these may include your user ID

2.3 Information from Third Parties

• OAuth Providers: When you sign in with Google or Apple, we receive basic profile info (email, display name)
• Phone Verification: Phone numbers are verified via Firebase Authentication; we store verification status
• Payment Processor (Stripe): Stripe provides transaction status and Connect account information

3. How We Use Your Information

• Service Delivery: Create/manage account, enable messaging, match trips, process payments
• Verification & Safety: Phone verification, identity confirmation, fraud prevention, dispute resolution
• Communication: Send transactional emails (payment confirmations, notifications), system messages
• Reliability: Diagnose crashes and improve stability (Sentry)
• Legal Compliance: Enforce Terms of Service, comply with laws, respond to legal requests
• Purposes (summary): App functionality, fraud prevention & security, developer communications, account management

4. Sharing Your Information

4.1 We DO NOT Sell Your Data

We never sell, rent, or trade your personal information to third parties for marketing.

4.2 Information Shared With Other Users

What's Shared	With Whom	Why
Display name, avatar, verified badge, rating, review count	Other users viewing your trips/ads	Trust & transparency for trip matching
Trip route, dates, preferences	Senders/travelers interested in your trips	Enable trip matching and coordination
Email/phone (for direct contact)	Only matched trip partners in messaging	Coordinate trip details securely

4.3 Service Providers

We share information with trusted third parties who process data on our behalf:

• Firebase: Backend hosting, database, authentication (including phone verification), Cloud Messaging
• Stripe: Payment processing, Connect account management
• Google Places: City and place autocomplete for trip search
• Cloud Functions: Email notifications, system messaging, payment webhooks
• Sentry: Crash and error reporting (may include user ID when signed in)

All processors have Data Processing Agreements (DPAs) ensuring GDPR compliance.

4.4 Legal Requirements

We may disclose information if required by law, court order, or to protect our rights/safety/users.

5. Data Retention

Data Type	Retention Period
Active User Account Data	During account lifetime; see deletion section for post-deletion retention
Messages & Conversations	2 years from last activity (for dispute resolution)
Transaction Records	7 years (tax/legal requirements)
Ratings & Reviews	Indefinite (part of user reputation)
Crash / diagnostic logs (Sentry)	Per Sentry project retention (typically ≤90 days)
Deleted Account Data	We remove or anonymize account data within 90 days after deletion where applicable. Anonymized counterparty names on past transactions may be retained up to 180 days for dispute/audit integrity. Transaction records required by law: up to 7 years.

6. Your Rights & Controls

6.1 Access & Portability (GDPR Article 15, 20)

You have the right to request a copy of all personal data we hold about you in a portable format.

6.2 Correction (GDPR Article 16)

Update your profile information anytime in the app. Contact us for data we don't expose in the UI.

6.3 Deletion (GDPR Article 17 - "Right to be Forgotten")

Important: Account deletion is permanent. We retain the following where required by law:

• Transaction records (7 years for legal compliance)
• Messages in disputes (until resolution + 30 days)
• Ratings/reviews (anonymized to protect other users)

How to delete your account: In the app use Profile → Danger Zone → Delete account, or request via https://voyagease.app/delete-account-en.html. Deletion is blocked while you have active payments that have not yet been released (paid or disputed); complete or cancel those first. We remove or anonymize remaining account data within 90 days where applicable.

6.4 Withdrawal of Consent

Disable location sharing and notification permissions in your device settings. Contact us to withdraw other consents.

6.5 Objection to Processing (GDPR Article 21)

Object to non-essential processing by contacting us at hello@voyagease.app.

6.6 Data Subject Rights Requests

Submit requests to: hello@voyagease.app

Response time: Within 30 days (GDPR requirement)

7. Security

• Encryption: All data in transit uses HTTPS/TLS encryption. Data is encrypted in transit for all required user data types.
• Password: Passwords are hashed and managed by Firebase Authentication; we never store plaintext
• Payment: Stripe handles PCI-DSS compliance; we never see full card numbers
• Access Control: Limited employee access; role-based permissions
• Monitoring: Automated security logs and alert systems

Note: No system is 100% secure. We cannot guarantee absolute security but maintain industry-standard protections.

8. Children's Privacy (COPPA & GDPR)

VoyagEase is designed for users aged 18 and older. We do not knowingly collect data from anyone under 18.

• No Minor Accounts: Users under 18 are not permitted to register or use VoyagEase
• Age Confirmation: Account creation requires confirmation that you are 18 or older
• Immediate Deletion: If we become aware that a user is under 18, the account will be deleted immediately
• No COPPA Applicability: VoyagEase is not directed at children under 18 and does not knowingly collect their data

If you believe a minor has created an account, contact us immediately at hello@voyagease.app.

9. International Data Transfers

VoyagEase operates globally. Your data may be transferred to/processed in countries outside your residence, including the US. We ensure Standard Contractual Clauses (SCCs) and adequate safeguards for GDPR compliance.

10. Third-Party Links

VoyagEase may contain links to external websites (Stripe, help pages, etc.). We are not responsible for their privacy practices. Review their policies before providing information.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have rights to:

• Know what personal information is collected
• Delete personal information collected
• Opt-out of "sale" of personal information (we don't sell data)
• Non-discrimination for exercising rights

Submit requests to: hello@voyagease.app

12. Changes to This Policy

We may update this policy. Significant changes will notify you via:

• In-app notification
• Email to your registered address

Continued use after changes constitutes acceptance.