Privacy Policy

Last updated: March 2026 · Effective immediately

At Voyagea, your privacy matters to us. This Privacy Policy explains what data we collect, how we use it, who we share it with, and what rights you have. By using Voyagea, you agree to the practices described in this policy.

1. Who This Policy Applies To

This policy applies to all users of Voyagea, including visitors who browse without an account and registered users who have created a Voyagea account.

2. What Data We Collect

Information you provide directly:

• Account data: Full name, username, email address, and password (hashed — never stored in plain text).
• Profile data: Home city, travel preferences, visited countries, and any information you add during onboarding.
• Trip data: Destinations, itineraries, budgets, and prompts you enter into the AI chat.
• V-Passport data: Countries visited, passport tier, and your digital passport identity.

Information collected automatically:

• Session data: Authentication tokens stored in your browser to keep you logged in.
• Usage data: Pages visited and features used within the platform (no keystroke logging).
• Device data: Browser type and device type for compatibility purposes.

What we do NOT collect:

• Real passport numbers, government IDs, or any official travel documents.
• Payment or financial information (we do not process payments).
• Location data beyond what you voluntarily provide as your home city.
• Contacts, photos, or any device permissions beyond browser storage.

3. How We Use Your Data

• To create and manage your account and V-Passport.
• To generate personalized AI travel itineraries based on your inputs.
• To assign your passport tier based on your visited countries count.
• To send account-related emails such as OTP verification (no marketing emails without consent).
• To improve the platform by understanding how features are used (aggregated, not individual).
• To detect and prevent fraud, abuse, and security threats.

4. AI Processing & Third-Party Services

When you enter a travel prompt, that prompt is sent to Google Gemini for processing. By using Voyagea, you acknowledge that your trip prompts are processed by Google's AI infrastructure, subject to Google's Privacy Policy. We recommend not including sensitive personal information in your travel prompts.

Our platform also uses:

• Supabase: Database, authentication, and file storage. Data is encrypted at rest and in transit. Supabase Privacy Policy.
• Vercel: Platform hosting and edge delivery.
• Mapping providers: Used to display interactive trip maps. No personally identifiable data is shared.

5. Data Sharing

We do not sell your personal data. Ever.

We only share data in the following limited circumstances:

• Service providers: Third-party tools listed above that are essential to operating the platform.
• Legal requirements: If required by law, court order, or to protect the rights and safety of our users or the public.
• Business transfers: If Voyagea is acquired or merged, user data may be transferred as part of that transaction. You will be notified.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your profile, trip data, and V-Passport data within 30 days. Some anonymized, aggregated data may be retained for platform analytics. Auth logs may be retained for up to 90 days for security purposes.

7. Your Rights

Depending on your location, you may have the following rights regarding your data:

• Access: Request a copy of the data we hold about you.
• Correction: Update inaccurate data through your profile settings.
• Deletion: Delete your account and all associated data at any time from settings.
• Portability: Request an export of your trip and passport data.
• Objection: Object to certain uses of your data by contacting us.

To exercise any of these rights, contact us at privacy@voyagea.co.

8. Cookies & Local Storage

Voyagea uses minimal browser storage:

• Authentication cookies: Set by Supabase to maintain your login session. These are essential and cannot be disabled without logging out.
• Session storage: Used to remember your last trip prompt between page loads. Cleared when you close your browser.
• We do not use advertising cookies, tracking pixels, or any third-party analytics cookies.

9. Children's Privacy

Voyagea is not directed to children under 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete it immediately. If you believe a child has provided us with data, please contact us at privacy@voyagea.co.

10. Data Security

We take security seriously. Our measures include:

• All data transmitted between your browser and our servers is encrypted via HTTPS/TLS.
• Database data is encrypted at rest via Supabase's infrastructure.
• Passwords are never stored — authentication uses hashed credentials via Supabase Auth.
• Row-Level Security (RLS) ensures each user can only access their own data.
• OTP-based email verification adds a second layer of account protection.

Despite these measures, no system is 100% secure. We cannot guarantee absolute security and are not liable for unauthorized access resulting from factors beyond our reasonable control.

11. International Users

Voyagea is operated globally. If you are accessing the platform from outside the country where our servers are located, your data may be transferred internationally. By using the platform, you consent to this transfer. We ensure that any such transfers comply with applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will notify you of material changes via the platform or email. The "last updated" date at the top of this page will always reflect the most recent revision. Continued use of Voyagea after changes constitutes acceptance.

13. Contact Us

For privacy-related questions, data requests, or concerns, contact us at:

privacy@voyagea.co

We aim to respond to all privacy requests within 7 business days.