Privacy Policy
Last updated: November 9, 2026
Information we handle
tabibi (the “App”) handles the email address needed to identify an account, external authentication identifiers from Google or Apple, an optional display name, password hashes, profile images, plans and idea boards you create, spots and schedules in plans, notes, attachments, lists, and reservation candidates.
For inquiries, we handle your question or submission, the AI's answer, and an optional reply-to email address. To prevent abuse, the IP address used to submit a form is handled as a hash; the raw IP address is not stored.
Purposes and storage
We use this information for authentication, saving, syncing, and sharing plans, providing and maintaining the App, responding to inquiries, improving quality, preventing abuse, and protecting rights. We do not use it to deliver advertising or to train the App's own AI on user input.
Accounts, plans, and inquiry records are stored in Cloudflare D1. Profile images and note attachments are stored in Cloudflare R2. The device stores a cache for display and offline use.
AI features and disclosures
When you first use AI for trip planning, we explain the shared data scope and retention terms for booking extraction, place extraction, and plan advice, and obtain explicit permission. Turning it off also disables on-device AI. AI support requires separate permission because its retention terms differ. Permission is kept on this device and can be revoked in Settings. Changes to the scope, provider, or retention terms require renewed permission.
For AI help inquiries, only with your separate AI support permission, we send your question to Cloudflare Workers AI to generate an initial answer. The question and answer are stored as an inquiry record for support, quality improvement, and abuse response.
When you run place extraction or plan suggestions, we send the plan or idea-board notes, text from images, checklist items, and other information needed for the feature to Cloudflare Workers AI. The feature input and AI answer are not stored in the App's D1, R2, or application logs unless you review and save the content.
Cloudflare has published that it does not use Workers AI customer content to train AI models or improve its services without explicit consent. See Cloudflare's data usage policy for details.
For reservation autofill, images and PDFs you explicitly select are converted to text on your device. On-device AI is preferred. Only if you allow cloud processing and the content cannot be processed on your device is the text sent to Cloudflare Workers AI. Original images and PDFs are not sent, and this input and AI output are not stored in D1, R2, or application logs unless you review and save the results.
Location and maps
We access the device's location for the current-location display on the map only when you grant permission. tabibi does not send or store location data on its servers.
In-app maps, place search, and route guidance use Apple MapKit. Apple may receive search places, routes, or location information in connection with map and route searches. When you choose to do so, the App passes destinations or route information to Apple Maps or Google Maps to open the external app.
External authentication and sharing
For Google Sign-In, the server verifies the ID token received from Google (a temporary proof used to verify the authentication result) and may receive the email address and display name needed for authentication. The App does not obtain your Google Account password and does not store Google's refresh token (the credential used to refresh a sign-in).
When you sign in with Apple, we may receive an Apple-provided identifier that links your Apple account to your tabibi account (a value issued per Apple development team and separate from your email address), the email address Apple provides as verified, and the name you provide on Apple's authentication screen. We use the Apple identifier instead of an email address to recognize you when you sign in again.
- If Apple provides a name on the first sign-in, we save it as the display name for the new tabibi account. If no name is provided, we do not save one.
- On later sign-ins, we match the existing account by the Apple identifier. We do not remove or replace the display name saved on the first sign-in merely because Apple does not provide the name again.
- If you choose “Hide My Email,” we use the relay address issued by Apple (for example,
@privaterelay.appleid.com) as the email address received. tabibi does not guess or replace your original email address. - If Apple does not provide a verified email, we may use an internal substitute so that an account can still be created with the Apple identifier. This is not an estimate of your original email address.
For Apple's rules about information sharing, Hide My Email, and subsequent sign-ins, see Apple's official Sign in with Apple documentation and its private email relay documentation.
When you share a plan, the invited person can see the plan name, schedule, and the inviter's display name or email address. Plans that you have not shared are not shown to other users.
Retention and deletion
We retain plans and other account-linked information while the account is active, for the purposes above. Deleting the account from the Settings screen opened from the icon at the top right of the App deletes, at that time, authentication information, plans and idea boards you own, their saved information (spots and schedules, notes, attachments, lists, and reservation candidates), participation in shared plans, and AI inquiry records.
Questions and answers in AI inquiries are deleted 180 days after you send them. If an answer mentions a paid feature and is linked to an issue number, we delete it 90 days after it is marked handled.
tabibi session access tokens and refresh tokens are stored on the device in Keychain (the iPhone's protected storage), while the server stores only a hash of the refresh token. For Apple's refresh token (the credential used to refresh a sign-in and unlink Apple), the server stores only an encrypted value protected by a dedicated server key. Apple's ID token, one-time authorization code, and nonce (the temporary value linking an authentication request to its result) are handled temporarily for authentication and are not stored as account information.
Logging out ends the tabibi session. When you delete your account, if an Apple refresh token is stored, we ask Apple to revoke it and then delete tabibi's authentication information containing the Apple identifier, email address, display name, and encrypted refresh token. The tabibi account and related data are deleted even if Apple's revocation does not complete. This does not delete the Apple account itself.
For Apple's approach to deleting authentication information and revoking tokens, see the official Apple token revocation documentation.
The inquiry form does not require an account and is not linked to one. We delete the message 12 months after you send it, and the reply-to email address 90 days after the inquiry is marked handled or declined. Submissions marked as test or spam are deleted 30 days after that mark. Reports from trip members are deleted 12 months after they are marked handled or declined. Reviews posted on the App Store are kept for 12 months after they are posted. Records of how we handled an item are deleted after 12 months. Weekly counts contain no message and no email address, so we keep them. Contact the channel below if you want to request disclosure of a form submission.
App usage
To improve the app, we record how far people who agree get through starting, notes, plans, places, and schedules. You can turn this off in Settings.
What we record, what we do not send, disclosure categories, key revocation, and getting started.
To see where people stop between download and continued use, we record closed event names, the time, the app version, the consent cohort, and short classification keys for people who agree. Getting started means we first observe a plan with 2 or more places and at least 1 scheduled place within 7 days after you agree. On the server we keep pseudonymous identifiers for short-lived exploration logs (Workers Analytics Engine) and for reach aggregates in D1.
We do not send trip names, notes, search words, place IDs, coordinates, email addresses, auth tokens, images, AI inputs or outputs, IP addresses, or full URLs. We do not store raw IP addresses. We hash the connection's IP address only to limit how often data can be sent. We do not write that hash on the action record.
The purpose is analytics. We do not use this record for advertising or for tracking you across other companies' apps and websites. We do not ask for App Tracking Transparency permission.
In the App Store privacy disclosure, action types are Product Interaction. The purpose is Analytics. The data is linked to the user and is not used for tracking. The install ID is a random identifier stored on the device and is disclosed as Device ID. It is not an advertising identifier. The account identifier linked while you are signed in is disclosed as User ID.
The first time you open the app, we ask on one screen whether we may record. Until you agree, we do not record or send anything. If you decline, we do not record or send anything. “Help improve with usage measurement” in Settings starts off. You can turn it on or off from that same setting at any time.
Turning it off stops recording and sending. We discard records still waiting on the device. On the server we revoke this device's measurement keys and stop new reach aggregates. Exploration log rows are not deleted immediately; they expire under the service retention window (about three months).
We process the revocation when the request reaches us. Until then, the device keeps the request and sends it the next time it can connect. After you turn it on again, we record only actions from that moment and issue new measurement keys.
When you delete your account, we revoke that account's measurement keys and any linked device keys. Exploration log rows are not deleted immediately; they expire under the retention window.
Public website
On the public website (tabibitravel.com), we count page views, sections seen, how far down the page was read, and App Store button taps. We also keep the referrer category (search, X, Instagram, and similar), campaign parameters, device class (phone, tablet, or computer), language, and country or region as daily totals in Japan time. We do not use cookies. We do not store IP addresses, cookies, the full user agent, or accounts. We use the user agent only to leave out bots, and we do not store that string. We delete these totals after 12 months.
On the website, we store page views, button taps, and scroll depth as daily counts without identifiers. We do not store IP addresses or cookies for this measurement.
Contact
Please contact us through the support channel listed on tabibi's App Store page.