Walou Travel Privacy Policy
This Privacy Policy explains what information Walou Travel collects, how we use it, who we share it with, and the choices you have. Walou Travel ("Walou" or "the app") is operated by Atlas L&S LLC, doing business as Waloutech ("we", "us" or "our"). This policy covers the Walou Travel app for iPhone and Android, the website https://walou.me, and the booking email service at trips.walou.me. If you have a question, write to support@walou.me.
1. The short version
- Walou Travel is free. There are no purchases and no ads.
- We never sell your personal data, and we never share it for advertising. We do not track you across other companies' apps or websites.
- Your passport, driver's license, travel preferences, and dietary or accessibility notes stay on your phone. They are not stored on our servers.
- AI features use OpenAI only after you agree, and you can turn them off at any time in Settings.
- You can download a copy of your data, or delete your account, from inside the app.
2. Information you give us
- Account details: your name, email address, phone number, @handle and an optional profile photo. You can sign in with Apple, Google or email. If you use Apple's "Hide My Email", we only receive the relay address.
- Home and safety details: your home address, home airport, and the name and phone number of an emergency contact.
- People you invite: the email address, phone number or @handle you type in to invite someone to a trip. We do not read your phone's contact list.
- Travel profile (stored on your phone): Known Traveler Numbers (for TSA PreCheck), Global Entry and other trusted-traveler numbers, airline, hotel and car-rental loyalty numbers, the names of travel credit cards you hold (never card numbers), your seat, cabin, bag and room preferences, and optional dietary and accessibility notes are saved in your phone's secure storage and are not stored in our server database.
- Trips and plans: destinations, dates, flights, hotels, rentals, daily plans and places.
- Forwarded booking emails: emails (and their attachments) that you forward to your personal address, yourhandle@trips.walou.me. We read them to add the bookings to your trips.
- Documents: PDFs, screenshots, boarding passes and other files you upload to a trip.
- Photos: photos you add to trip posts, chats or your profile. Walou does not accept video.
- Messages: group chat messages, direct messages, comments and reactions.
- Expenses: shared expense entries. Walou only does the math. It does not move money, and it never asks for card or bank details.
- Reports and blocks you make, and anything you send to our support team.
3. Information collected automatically
- Approximate location: when you tap a button such as "Use current location" or "Detect airport", the app reads your phone's location while the app is open. Your phone turns it into a place name, an address or the nearest airport, and only that text, which you can edit, is saved to your account. Your precise GPS coordinates are not sent to our servers (see section 7 for the drive-time lookup with Apple Maps). Walou does not track your location in the background.
- Push notification token: a code from Apple or Google that lets us send notifications to your phone.
- Crash and performance data: if crash reporting is enabled, crash and performance diagnostics are sent to Sentry (EU). These include crash reports, error logs, performance timings, device model and operating system version. We also record short screen replays of a small share of sessions and of sessions where an error happens. All text and images in these replays are masked, so your messages, documents and ID details cannot be read. Sentry is set not to collect your IP address or your identity, and we do not link these reports to your account.
- Website visits: when you visit walou.me, our server records the page, the type of device, the page that sent you and your country. We do not store your IP address.
4. ID Vault: your IDs stay on your phone
The ID Vault lets you keep your passport and driver's license handy for travel. On iPhone, the ID is scanned and read on the phone using Apple's on-device text recognition. The details are stored in your phone's secure storage (the iPhone Keychain, or the Android Keystore on Android), and the ID photos are stored in the app's private storage on your phone. Your ID details and photos are never sent to our servers, and we cannot see them. You can protect the app with Face ID, Touch ID or your phone's passcode.
Please note: if you back up your phone to iCloud or a computer, those backups may include the app's data, depending on your own backup settings. If you choose to share an ID through your phone's share sheet, it goes only to the person or app you pick.
5. How we use your information
- To run Walou for you: create your account, build and sync your trips, store your files and keep your group in touch.
- To read forwarded booking emails and uploaded documents and add the bookings to the right trip.
- To send invitations you ask us to send, by email, text message or an invite link (https://walou.me/invite/...).
- To send trip alerts by push notification and, if you add a phone number and leave text alerts on, by text message.
- To keep Walou safe: review reports, remove harmful content and stop abuse.
- To fix bugs and keep the app stable.
- To answer your support requests and meet our legal duties.
We do not use your information for advertising, and we do not build marketing profiles about you.
6. AI features (OpenAI)
Some features, such as reading booking details, building a trip draft and asking @Walou questions in chat, use AI from OpenAI through its business API. We turn these features on only after you agree on a consent screen in the app. When you use them, OpenAI may receive the message or document being processed and the details of the trip. OpenAI does not use data sent through its API to train its models.
Forwarded emails are not sent to OpenAI unless you have agreed. You can turn AI features off at any time in Settings. When you ask @Walou a question that needs current information, the trip destination and your question may also be sent as a web search to DuckDuckGo. AI answers can be wrong, so please check anything important.
7. Departure alerts, weather and airport status
Traffic-aware departure alerts: on iPhone, Walou asks Apple Maps for the drive time from your current location or saved home address to your departure airport, including current or typical traffic. Your home address or location is sent to Apple only for that lookup, and Walou does not store the result on its servers. On other devices, or when Apple Maps is unavailable, Walou shows a rough drive-time estimate that does not include traffic.
Weather comes from Open-Meteo and the US National Weather Service (weather.gov), and airport delay and ground-stop status comes from the US Federal Aviation Administration (FAA). For these, we send only a city name, map coordinates of the destination or airport, or an airport code, never your name or account. Walou does not receive live gate assignments from airlines. Always check your flight, gate and times with your airline.
8. Who can see your information
- People on your trip: members of a trip can see your name, @handle, profile photo, the shared plans, the files in the shared Trip Folder, group chat messages and trip posts. Files in your personal "My Documents" folder are visible only to you.
- People you message: direct messages are seen by you and the person you are writing to.
- People you invite: they receive the invitation you send, with your name and the trip name.
- Our team: a small number of authorized staff can access account data when it is needed for support, to review a report, or for legal reasons.
- Service providers: the companies listed below, only to run Walou for us.
- The law: we may share information if the law requires it, or to protect the safety of a person.
- If the company is sold or merged, your information may pass to the new owner, who must keep honoring this policy.
9. Our service providers
We use these companies to run Walou. They process data only on our instructions and are not allowed to use it for their own purposes:
- Railway: server hosting and database (United States).
- Clerk: sign-in and account security.
- ImageKit: file and photo storage. Private documents are opened through short-lived signed links.
- Resend and Hostinger: sending and receiving email, including forwarded booking emails.
- Genesys Cloud: text messages (SMS) for invitations and trip alerts, only if you give a phone number.
- Inngest: background jobs such as processing forwarded emails.
- OpenAI: AI features, only after you agree.
- Sentry: if crash reporting is enabled, crash and performance diagnostics are sent to Sentry (EU; processed in Germany).
- Expo: push notifications and app updates.
- Apple: Sign in with Apple, and Apple Maps for drive times to the airport (your home address or location is sent to Apple only for that lookup).
- Google: Google sign-in.
- Duffel: flight price search. Only airport codes, the date and the number of travelers are sent.
- Unsplash and Wikimedia: destination cover photos. Only the destination name is sent.
- Open-Meteo, the US National Weather Service and the FAA: weather and airport status. Only a city, coordinates or airport codes are sent, never personal data.
- DuckDuckGo: web search for @Walou answers, only with AI features on. Only the destination and question are sent.
10. What we never do
- We never sell or rent your personal data.
- We never share your personal data for advertising.
- We do not show ads or use advertising networks, and we do not use the Apple advertising identifier.
- We do not track you across other companies' apps or websites.
- We do not collect payment card or bank details.
- We do not receive Face ID, Touch ID or other biometric data. Your phone checks these itself.
11. Safety: reporting and blocking
You can report a message, post or comment, and block another user, from inside chats and posts. Reports go to our team and are reviewed within 24 hours. When you block someone, you no longer see their messages, posts or comments, and the block applies on all your devices. We may remove content and accounts that break our rules. To review a report, our team looks at the reported content and the accounts involved.
12. Where your data is stored and how we protect it
Your data is stored in the United States. If crash reporting is enabled, crash reports are processed in the European Union. If you use Walou from outside the United States, your information is transferred to the United States. All traffic between the app and our servers is encrypted (HTTPS). Private documents are served only through short-lived signed links. No system is perfectly secure, but we work to protect your information and limit who can access it.
13. Keeping and deleting your data
We keep your information while your account is open. You can delete your account at any time in the app: go to Profile, then Settings, then Delete account. This deletes your account, your records in our database and the files you uploaded to our storage. Copies in our backups may remain for up to 30 days before they are erased. Information on your phone, such as the ID Vault and saved trip files, is removed from the app when you delete your account or the app.
To get a copy of your data, use "Back up my data" in your Profile. You get a file (JSON) with your profile, travel profile, trips and itinerary, the messages and posts you wrote, your expenses and a list of your documents.
14. Your privacy rights
Depending on where you live (for example, California and other US states, the European Union, the United Kingdom or Switzerland), you may have the right to: see the personal data we hold about you; correct it; delete it; get a copy in a portable format; object to or limit some uses; and withdraw consent, such as your consent to AI features, at any time. You can do most of this in the app. For anything else, email support@walou.me and we will answer within 30 days. You also have the right to complain to your local data protection authority. We will never treat you differently for using these rights. We do not sell or share personal data as defined by California law, so there is nothing to opt out of.
For people in the EU and UK, our legal reasons for using your data are: to provide the service you asked for (our contract with you); your consent (for AI features, location and notifications, which you can withdraw); our legitimate interests in keeping Walou safe and working; and our legal obligations.
15. Children
Walou is not for children under 13, and children under 13 may not create an account. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us information, email support@walou.me and we will delete it.
16. Changes to this policy
If we change this policy, we will update the effective date above. If the change is important, we will tell you in the app or by email before it takes effect.
17. Contact us
Atlas L&S LLC (d/b/a Waloutech), operator of Walou Travel. Email: support@walou.me. Website: https://walou.me.