Privacy Policy

What we collect, and why

Account: your email address and a display name — to sign you in and show your name to your trip companions.

Location names: when you enable Location services for your account, Vamo can send one current position to its lookup service and geocoding provider to name a nearby place or street. Go checks a fresh position when you enter or refresh. This lookup does not send your full route or photos.

Private Go recording: when you enable this account choice and explicitly start or resume recording, Vamo saves your private route, including in the background if your phone permits it. Each recording has an original maximum 24-hour window. Pause, End or turning the choice off stops further recording; it does not erase a previously saved route. Your phone's location permission is separate.

Go sharing: your account choice permits new Go shares to the audiences you select; it does not share anything by itself. Turning this choice off stops new sharing approvals. To withdraw an existing share, use Stop sharing on that Go day.

Go Live: a separate account choice, off unless you turn it on. When it is on and you start Go Live in Go, the people you pick see your current position, its accuracy and time, and your distance, time and average speed since you started, at most every 30 seconds, for up to 24 hours or until you stop. Nothing from it is saved: no day, route or positions are kept on your phone, theirs or our servers. The same choice also allows live position on a Go you record, for the audiences and people you pick there. Positions already seen cannot be recalled. Go Live is not available yet.

Account privacy choices: review the available choices once during setup and change them in Profile › Privacy. Every choice is optional, and a saved Off answer is remembered too. Features covered by those choices reuse the same account decision across devices. Camera, location and notification permissions are managed separately by each device when needed.

Trip data you create: trips, expenses, splits, settlements, notes, photos, receipt scans, plan items. Visible only to the members of that trip — enforced at the database layer, not just in the interface. Nothing is public unless you explicitly share it (e.g. posting a snapshot card to social media yourself).

Capture photo metadata: if you turn on "Tag captures with location" in Profile, new trip photos may store location coordinates and original photo time from the image file. This is off by default; when it is off, Vamo does not read that metadata for capture photos. Stored capture metadata is visible only to members of the same trip.

Receipt details: when you scan a receipt, text recognition runs on your device — the receipt image is stored privately for your trip; what the OCR reads (amount, merchant, place) becomes part of the expense. If a photo contains location metadata (EXIF), we may use it to attach a place to the expense, visible to your trip members like the expense itself.

Usage analytics: product usage analytics collection is currently disabled. We do not send product usage events to PostHog. Any future activation will use PostHog's EU cloud and requires a policy update before collection starts.

Crash diagnostics: technical crash reports (for example app version, device model, OS version, stack traces, and crash timing) so we can fix beta and production crashes. Crash reports are for diagnostics only and do not intentionally include trip contents, receipt text, invite tokens, or message text.

What we never do

• We never sell or rent your data. To anyone.
• We never show ads or share data with ad networks.
• We never move money — payments happen in the apps you already use.
• We never make your trips public. Sharing is always your explicit act.

Who processes data for us

• Supabase — database, authentication, file storage (your trip data).
• Geocoding providers (OpenCage; Geoapify as fallback) — one-point street naming when Location services is enabled. Geoapify is used only when OpenCage is unavailable.
• Search provider (Photon) — destination and place search: only the text you type, never your location.
• Brevo — primary transactional email (sign-in codes and notifications).
• Resend — fallback transactional email for sign-in codes if the primary provider is unavailable.
• Firebase Crashlytics — crash diagnostics (technical crash reports).

Each processes data solely to provide Vamo's functionality.

Your rights

You can access, correct, export, or delete your data. Deleting an expense or trip removes it for you per the in-app retention options; deleting your account removes your personal data entirely (in-app account deletion is rolling out; meanwhile email privacy@vamo.world and we'll do it promptly). Shared trip data you contributed to others' trips (e.g. an expense in a group ledger) may persist for the other members, attributed minimally.

EU/EEA users: you may also lodge a complaint with your local data protection authority.

Data retention

Trip data persists while the trip exists and per its members' retention choices. Sign-in codes expire within one hour. Invite links expire within 30 days.

Changes

We'll update this page when the policy changes and note the date above. Material changes will be announced in the app.