Privacy policy
Last updated 28 October 2026
In short: we use your data only to run Troteo for you. We don't sell it, don't show ads, and don't track you. You can delete your account and everything in it from the app at any time.
Who we are
Troteo (the app and troteo.app) is run from Malta by a self-employed sole trader trading as Troteo ("we"), the data controller for the personal data described here. Questions or requests: hello@troteo.app.
What we collect and why
| Data | Why |
|---|---|
| Your email address | To sign you in (we email you a code) and to recognise bookings you forward from it. |
| Name and country, and if you add them, city, date of birth and whether you're an EU citizen | Shown on your profile and to people you share trips with (name only). |
| Booking emails you forward to trips@troteo.app, including attachments | To read the bookings in them. We keep the original email so we can read it again if something went wrong. |
| Your trips and their entries (dates, times, places, booking references, seats, passenger names) | To show your timeline, weather and alerts. |
| Email addresses you share trips with | To send the invitation and add the trip to their account when they join. |
| Weather alerts for your trips | To show them in the app and, unless you turn it off, email them to you. |
| A notification token for your phone | To send notifications about your trips. |
| Documents you attach to a trip | Stored only on your phone; they never reach our servers. |
We rely on our contract with you (providing the app you signed up for) as the legal basis for this processing. We don't use your data for advertising, and the app and website have no analytics or tracking.
Services that process data for us
Troteo runs on the following providers. Each receives only what it needs, under its own data protection terms.
| Provider | What for | What it receives |
|---|---|---|
| Supabase (servers in Ireland, EU) | Database, sign-in and file storage | Everything listed above except documents on your phone |
| Cloudflare | Receives email sent to trips@troteo.app; hosts this website | Forwarded emails, in transit |
| Anthropic (Claude) | Reads forwarded booking emails to find the bookings; suggests indoor ideas for weather alerts | The text and attachments of forwarded emails; for alerts, only the activity name, city, date and forecast. Anthropic does not use this data to train its models. |
| Resend (EU region) | Sends sign-in codes, trip invitations and alert emails | Recipient address and the email content |
| Open-Meteo | Weather forecasts | Place coordinates only, rounded to about 1 km, with nothing that identifies you |
| Google Firebase Cloud Messaging | Delivers notifications to your phone | Your phone's notification token |
| Google or Apple, if you sign in with them | Sign-in | What you agree to share with us on their sign-in screen (usually name and email) |
Some of these providers are based outside the EU (for example in the United States). Where data leaves the EU, it is protected by the safeguards the GDPR requires, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
Sharing
When you share a trip, the people you add can see its entries, and your name. When you email someone a single entry, we send them its details without the booking reference or passenger names. We never share your data with anyone else, except where the law requires it.
How long we keep it
We keep your data for as long as you have an account. When you delete your account (Account → Account Settings → Delete account), we delete your profile, trips, entries, forwarded emails, alerts and invitations straight away. Backups that may still contain them are overwritten within 30 days.
Your rights
Under the GDPR you can ask to see, correct, export or delete your data, and object to or restrict how we use it. Most of this you can do in the app; for anything else, email hello@troteo.app and we'll reply within a month. If you're unhappy with how we handle your data, you can complain to the Information and Data Protection Commissioner in Malta (idpc.org.mt) or the authority where you live.
Children
Troteo is not meant for children under 16, and we don't knowingly collect their data.
Security
Data travels encrypted (HTTPS) and is stored encrypted by our providers. Each account can only reach its own trips and trips shared with it, which the database enforces. Trips saved on your phone for offline use stay in the app's private storage.
Changes
If we change this policy, we'll update the date above and, for significant changes, tell you in the app or by email.