Privacy Policy

François Boulay-Handfield, a sole proprietor registered in Québec, Canada (NEQ 2282395468), operating Volopro, is the data controller for the information described here. For any privacy request, contact us at legal@fbhdev.com.

As a Québec enterprise, we also handle your personal information in accordance with Québec's Law 25 and Canada's PIPEDA. The person responsible for the protection of personal information is François Boulay-Handfield (legal@fbhdev.com).

• Account data — your email, name, password (hashed, never stored in plain text), and optional profile details (city, country, nationality, a second nationality, the expiry date of each passport, preferred languages, travel style, currency, and profile photo). Passport details are only ever a nationality and an expiry date — never a passport number or a scan. We use them to check each destination's entry and validity rules for you, to show your own government's travel advice and consulates, and to remind you before a passport expires.
• Content you create — trips and their stops, budgets, to-dos, checklists, saved trips, and uploaded images. When you organize a trip you may add travel companions: their name and gender, and — if you choose — their nationality and passport expiry date. Only you, as the trip's organizer, see a companion's passport details. People you invite to a trip see a border check computed from their own profile, never from yours.
• Usage analytics — events about how the app is used (pages viewed, features clicked), linked to your account when you're signed in. This product analytics is collected only with your consent. We do not capture the text you type or your input values.
• Request counts — our servers count how many API requests your account makes each hour, so we can size and operate the service. This runs without consent on our legitimate interest, is a count only (no page, feature, or content details), and is stored on our servers — nothing is stored on or read from your device.
• Error logs — technical details when something fails (error message, stack trace, the page it happened on), linked to your account when you're signed in, so we can fix it. We do not capture the text you type or your input values.

• To provide the service (performance of a contract) — your account and content.
• To keep it working and secure (legitimate interest) — error logs, rate limiting, fraud/abuse prevention, and per-account request counts so we can measure load and size the service. You can object to processing based on legitimate interest at any time by emailing us at legal@fbhdev.com.
• To improve the product (consent) — usage analytics. You can withdraw consent at any time.
• To process payments (performance of a contract) — if you subscribe to a paid plan.

We keep this short because we use very little:

• Necessary — a sign-in token and a language preference. Required for the app to function; no consent needed.
• Analytics — a stored record of your consent choice. No product analytics run until you opt in, and we honor your browser's Global Privacy Control / Do Not Track signal as an opt-out. In the app, that choice is stored on your device and asked once; there is no OS-level equivalent of Global Privacy Control, so analytics stays off until you opt in, and you can change it anytime in your profile.

• Account and content: until you delete them or close your account.
• Error logs and analytics events: automatically deleted after 90 days.
• Request counts: automatically deleted after 30 days.
• Payment records: as required by tax and accounting law.
• When you delete your account, your data is removed from the live service immediately. Residual copies can remain in operational backups until those backups are replaced. We do that replacement manually and aim to complete it within 30 days.

We share data only with the processors needed to run the service:

• Stripe — payment processing.
• Railway — application hosting.
• MongoDB Atlas — database hosting; this is where your account and trip data is stored.
• Amazon Web Services (S3 & CloudFront) — image storage and delivery.
• Resend — transactional email (e.g. password resets).
• Unsplash — when you search their image library.
• MET Norway, Meteostat and NOAA NCEI — weather data for your destinations.
• OpenAI — when you use AI suggestions, the destination name and any extra instructions you type are sent to generate ideas.
• RapidAPI (Rakuten) — routes flight-status lookups to the AeroDataBox data service; the flight number you enter passes through RapidAPI. Nonstop-route lookups no longer leave our server.
• Wikimedia Foundation (Wikidata) — place names you add that our offline gazetteer cannot resolve are looked up on Wikidata's public API to find map coordinates; the request carries the place name and our server's address, never your account.
• OpenFreeMap & OpenStreetMap — map tiles. When a map loads in your browser, the area you are viewing is fetched directly from OpenFreeMap's tile servers (built on OpenStreetMap data), which see your IP address; OpenFreeMap states that it does not store IP addresses in its logs.
• Expo / EAS — each time the mobile app launches it checks Expo's update service (u.expo.dev) for an over-the-air update; this sends your device platform, the app's runtime version, a random install identifier and your IP address.
• Expo push notifications — if you allow notifications, the app sends Expo's push service (exp.host) your device's Apple or Google push token, an install identifier and your IP address, to obtain the push token we store with your account. Each notification we send you then goes through Expo to Apple or Google and carries that token, the notification's text, its type and the in-app link it opens. The text can include a trip's name and when you leave, the name of someone on the trip, a destination country, which country's passport it is about if you hold two, a border check result (such as a traveler being blocked from entering a country), that you owe money on a trip or that your card was declined, and dates such as a visa deadline or your passport's expiry date.
• Maps in the mobile app — the app draws its maps with the same OpenFreeMap tiles as the website; no Apple or Google map service is involved. When a map loads, the area you are viewing is fetched from OpenFreeMap, which sees your IP address.

We never sell your personal data. Some processors may be located outside your country; where that happens, transfers are covered by appropriate safeguards.

You can, at any time:

• Access & export — download a copy of your data from your profile.
• Rectify — edit your profile and content directly.
• Erase — delete your account. This removes your data from the live service immediately; residual copies can remain in operational backups until those backups are replaced. We do that replacement manually and aim to complete it within 30 days.
• Withdraw consent — turn off product analytics in Cookie settings, or from your profile when signed in.
• Object or complain — contact us, or your local data protection authority.

Manage most of this from your profile.

Volopro is not directed at children under 16, and we do not knowingly collect their data.

If we make material changes, we'll update the date above and ask for your consent again where required.

Questions or requests: legal@fbhdev.com.