Privacy policy

Truce is a group trip-planning app. Using it means putting some personal information into it — who you are, who you are travelling with, where you are going and who paid for what. This page sets out exactly what that is, what we do with it, and what you can make us do about it.

This policy is written to be accurate about how the app actually behaves. Where something is a deliberate design choice with a privacy consequence, we say so rather than glossing it.

1. Who we are

The controller of your personal data is Liam Green, who builds and runs Truce (“Truce”, “we”, “us”). Truce is in the process of being incorporated as a company in England and Wales; this page will name that company, its registered number and its registered office as soon as it exists.

You can reach us about anything in this policy at trucetravelapp@gmail.com.

Where Truce is available

Truce is being released in the United Kingdom first, and the UK GDPR is the law that governs it. We are not offering the app in the European Union yet, and the App Store will not list it in EU countries until we do.

Europe is next. When we open the app to EU countries we will appoint a representative in the European Union under Article 27 of the EU GDPR and name them here, before the first EU user signs up rather than after. If you are reading this from the EU, that has not happened yet.

2. What we collect

Account

Your email address, username, display name and, if you set one, an avatar image. If you sign in with Apple or Google we receive the identifier and email address those services give us — never your password with them. If you sign up with a password we store only a cryptographic hash of it. If you turn on two-factor authentication we store the factor needed to verify your codes.

Trips and planning

Trip names, destinations and their coordinates, dates, budgets, currency, who is a member and what role they hold, and invitations sent and accepted.

Content you and your group create

Nominations, votes, the notes you attach to a vote, poll questions and answers, packing-list items, itinerary entries, flight and stay details you enter, photos you upload, and documents you add to a trip's vault.

Money

Who booked what, amounts, how a cost was split, settle-ups between members, and any payment handle you choose to save so people can pay you back. We never see or store card numbers — purchases go through Apple, and subscription status comes back to us as an entitlement, not a payment detail.

If you scan a receipt to split a bill by item, the photo is sent to Microsoft Azure AI Document Intelligence, which reads the line items, total and currency and returns them to the app. We do not keep the image. It is processed and discarded, unless you tick “save receipt to documents”, in which case it is stored in that trip's document vault like anything else you put there.

Location

The coordinates of trip destinations and of the places nominated and won, so the day map and distance figures work. If you opt into scanning your camera roll for trip photos, the app reads the date and, where present, the location recorded in those photos on your device in order to suggest matches. Truce does not track your live location in the background.

Technical

A push-notification token and device platform if you enable notifications; diagnostic and crash reports; and the request data any web service necessarily handles, including IP address.

Support and moderation

Messages you send us, and any report you make or that is made about you, including what was reported and when.

Your device

Some features ask your device for permission and then work locally. Turning on calendar sync creates a calendar named Truce on your device and writes your trip plan into it — that stays on the device and is never sent to us. The camera is used only when you scan a receipt; the photo library only when you pick an image or run the trip-photo scan; Face ID only to unlock the app. Home-screen widgets read a copy of your current trip held on the device itself. You can withdraw any of these permissions in your device settings at any time.

Website

If you join the waitlist or use the contact form on truce.gg, we receive the email address and message you submit. Nothing else — see section 13.

3. Why, and on what legal basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded it is not, because the processing is limited to what keeps the service working, safe and honest. You can object — see section 10.

Providing account and trip data is necessary to use Truce; without it there is no service to provide. Everything marked as consent above is genuinely optional and the app works without it.

4. Data you share with your group

Truce is a shared tool. Anyone who is an active member of a trip can see the other members' display names, usernames and avatars, and everything posted to that trip: nominations, votes and their notes, poll answers that are not anonymous, packing items, photos, documents, and the full ledger including who paid for what and who owes whom.

This matters when you delete your account. We remove you as a person, but we do not destroy the group's record. Your profile, uploads, notification tokens and payment handles are deleted outright. Entries the rest of the group are party to — a booking you paid for, a settle-up between you and someone else, a poll you created, a packing item you added — are kept but detached from you, and shown as belonging to a former member.

We do this deliberately. The other members are data subjects too, and erasing the record of who fronted £400 for an apartment would rewrite their financial history without their consent. Your identity is removed; the group's arithmetic is left intact.

5. Photos, including of people who do not use Truce

Photos you add to a trip album are visible to every member of that trip. They are stored privately: not public, not indexed, and not shared beyond that group.

Holiday photos usually contain other people, and some of them will not be Truce users. When you upload a photo you are sharing other people's personal data with your group, and you are responsible for doing that reasonably — do not upload something the people in it would object to. If you appear in a photo on Truce and want it removed, contact us at trucetravelapp@gmail.com and we will act on it, whether or not you have an account.

The camera-roll scan is opt-in and never uploads anything on its own. It looks at photos on your device, suggests ones matching the trip's dates and place, and waits for you to choose. You can revoke photo access in your device settings at any time.

6. Reports, blocks and moderation

If you report content or a person, we record who reported it, what was reported, which trip it was in, the reason you gave and any note you added, and we email it to ourselves so it can be reviewed. We aim to act within 24 hours.

If you block someone, that is recorded so we can stop them inviting you to anything. If someone is removed from a trip, that is recorded so they cannot rejoin through an old share link; re-inviting them clears it.

Moderation records are kept as records rather than as your personal data: if you later delete your account, a report you made is anonymised rather than destroyed, so a pattern of behaviour by someone else is not erased along with your profile.

7. Who else sees it

We do not sell personal data, we do not rent it, and we do not share it with advertisers or data brokers. We use the following processors, each under a contract limiting them to acting on our instructions:

Some screens link out to travel partners such as Skyscanner, Booking.com, Airalo and Heymondo. Following one of those links takes you to their site, under their privacy policy, and may earn us a commission. We do not pass them your personal data; the link carries only what is needed to prefill a search, such as a destination and dates.

We may also disclose data where we are legally required to, or where it is necessary to establish or defend legal claims.

8. Where your data is held

Your data lives in the European Union. Our database, sign-in and file storage are hosted by Supabase in Ireland — your trips, photos, documents and ledger are all held there.

Truce is run from the United Kingdom, so holding your data in Ireland is a transfer out of the UK. The UK has formally recognised the EEA as providing an adequate level of protection, so that transfer needs no further safeguard.

Some of the processors listed in section 7 are based in the United States. Where personal data reaches them, we rely on the safeguards in our contract with each one — the UK's International Data Transfer Addendum to the Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where that processor is certified under it — and we assess those transfers as the law requires.

9. How long we keep it

• Your account and content: for as long as your account exists. Delete it and the personal parts go immediately, with the exceptions described in section 4.
• Trips: for as long as the trip exists. Deleting a trip removes it and everything in it, for everyone.
• Cached place photos: automatically purged after 30 days.
• Scanned receipts: not stored at all, unless you choose to save one to a trip's document vault — then for as long as that trip exists.
• Support messages: for as long as needed to resolve the issue and a reasonable period after.
• Moderation records: long enough to identify repeat behaviour, then deleted. Reports are anonymised when the reporter deletes their account.
• Waitlist emails: until launch, or until you ask us to remove yours — whichever is first.
• Records we must keep by law, such as transaction records for tax: for the period the law requires.

10. Your rights

Under the UK and EU GDPR you have the right to:

• Access — get a copy of the personal data we hold about you. The app does this instantly: Settings, then Download my data.
• Rectification — correct anything inaccurate. Most of it is editable in Settings.
• Erasure — have your data deleted. Settings, then Delete account. Read section 4 first, so you know what survives and why.
• Restriction — ask us to stop processing while a dispute about accuracy or legitimate interests is resolved.
• Portability — receive the data you gave us in a structured, machine-readable format. The export above is JSON.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting what was done before. Notification categories are per-category switches in Settings; the camera-roll scan is revocable in your device settings.

Exercise any of these by emailing trucetravelapp@gmail.com. We will respond within one month. We may need to confirm who you are first, so that somebody else cannot request your data.

You also have the right to complain to a supervisory authority. Truce is run from the United Kingdom, so ours is the Information Commissioner's Office (ico.org.uk). We would rather you told us first, but that is your choice, not a condition.

11. How we protect it

Every table in our database enforces row-level security, so a request can only ever reach trips you are a member of — applied at the database, not merely in the app. Sessions are stored in the device's encrypted keystore. Two-factor authentication is available. Sign-in endpoints are protected against automated attacks, and diagnostic reports are scrubbed of personal data before they are sent.

No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms, we will notify the supervisory authority within 72 hours of becoming aware of it, and tell you directly where the law requires.

12. Children

Truce is not for children. You must be at least 16 to use it. We do not knowingly collect data from anyone younger; if we learn that we have, we will delete the account.

13. This website

truce.gg sets no cookies, runs no analytics, and loads no third-party scripts. Nothing about you is tracked here, which is why there is no cookie banner to dismiss.

The only personal data this site handles is what you type into the waitlist or contact form. That is emailed to our inbox so we can reply or tell you about launch, and is used for nothing else. One preference — whether you chose the light or dark theme — is stored in your browser and never leaves it.

14. Changes to this policy

If we change this policy we will update the date at the top. If a change materially affects your rights, we will tell you in the app or by email rather than quietly editing the page.

15. Contacting us

Email trucetravelapp@gmail.com, or use the contact form. For anything urgent about content or safety, put “Report” in the subject line.