Privacy Policy
Last updated 9 November 2026
We collect only what GoAwayGo needs to run your account, keep it safe and fix problems. We don't sell your data, share it for advertising, or show you ads. Wherever you live, you can see, correct, download or delete your data at any time: write to [email protected].
1. Who we are
GoAwayGo (the website at goawaygo.com and the GoAwayGo app) is run by the GoAwayGo team, based in India. We decide how and why your personal data is used, so we are responsible for it: the “controller” under the EU and UK GDPR, the “business” under US state privacy laws, and the “Data Fiduciary” under India's Digital Personal Data Protection Act. GoAwayGo is in beta and the company is being registered; this policy will name it once that is done.
Contact for anything about your data, including our privacy team: [email protected].
2. What we collect, why, and on what legal basis
Some laws (such as the GDPR) require a “legal basis” for each use of personal data. Ours are shown in the last column.
| Data | Why we use it | Legal basis |
|---|---|---|
| Name and email address | To create and run your account, and to greet you in the app. | Contract: needed to give you the account you asked for |
| Password | To sign you in. We store only a one-way scrambled form (a hash); nobody, including us, can read your password. | Contract |
| Google account ID and whether your email is verified (only if you use “Continue with Google”) | To sign you in with Google. We don't receive your Google password or contacts. | Contract (you choose this way of signing in) |
| Your country and currency, if you choose them in User Profile | To remember your choice and, as GoAwayGo supports it, show prices in your currency. | Contract |
| Sign-in sessions: a protected token, your browser or device type, and when you signed in | To keep you signed in and to end sessions if something looks wrong. | Contract; legitimate interest in keeping accounts secure |
| Single-use links we email you (verify email, reset password, confirm a new email), and a new email address waiting for its link | To confirm your email address, let you reset a forgotten password, and change your email only once you have confirmed the new one. | Contract |
| What you viewed, if you are signed in: the last 30 places and the last 30 trip plans you opened, and when | To show your recent searches on Home and your Recently viewed list, on every device you use. | Contract |
| Places you save to My Trips | To keep the places you saved, on every device you use. | Contract |
| Trip plans: the place, dates, number of days, who is going (solo, couple, family or friends), pace, budget level, interests, any wish you type when changing a day, the plan the AI wrote, and whether you shared it | To write your plan, keep it in My Trips on every device, and show it to people you share its link with. | Contract |
| Notifications: what happened (for example who liked or commented on your post, or which trip starts soon), whether you have read it, which kinds of push messages you turned off, and, in the Android app, a push token for each phone you are signed in on | To show the bell on Home and, if you allow push notifications, to send them to your phone. | Contract |
| Wanderbook: your profile (photo, cover, bio, home town, public or private), posts (photos, captions, place tags), comments, likes, follows and blocks | To show your Wanderbook: to anyone if your profile is public, or only to followers you approve if it is private. Your name and profile photo are always visible. | Contract |
| The location stored inside a photo you upload (GPS) | Read once to suggest the place tag (place, state, country), then removed from the photo. We never store or show the exact coordinates. | Contract (you choose to post the photo) |
| Reports you send, and reports about your content | To review them and keep Wanderbook safe. | Legitimate interest in a safe service; legal obligations |
| Technical data: IP address, time, page or feature used | To protect the service (e.g. limiting repeated sign-in attempts) and to fix errors. | Legitimate interest in security and a working service |
| Crash and error reports: app or browser version, device model, operating system and what went wrong | To find and fix bugs. These reports don't contain your name, email or IP address. | Legitimate interest in a working service |
| Usage statistics, only if you allow them: pages and features used, a random ID for your browser or app, device and browser type | To understand which features are useful and improve GoAwayGo. Never linked to your name or email, and no IP address is kept. | Consent, which you can withdraw at any time |
We use your data only for these purposes. Where we rely on legitimate interest, we have checked that it doesn't override your rights, and you can object (see section 8). Giving us your name, email and a password (or using Google) is needed to have an account; you can use the rest of the website and app without one. We don't collect sensitive data (such as health, religion or precise location), and we don't make decisions about you by automated means alone.
4. Who processes your data for us
We use these trusted service providers (“processors”). They may only use your data to provide their service to us, under a data protection agreement.
| Provider | What they do | Where |
|---|---|---|
| Google Cloud | Runs our servers and keeps server logs | Singapore |
| Neon (on Amazon Web Services) | Hosts our database | Singapore |
| Cloudflare | Hosts the website, app downloads and Wanderbook photos, forwards our email, website statistics | Worldwide network |
| OpenAI | Checks Wanderbook photos and text, and shared trip plans, for content our Community Guidelines don't allow, before they appear (it doesn't use them to train its models and keeps them for at most 30 days) | United States |
| Resend | Sends account emails (verification, password reset) | United States |
| Sentry | Collects crash and error reports | Germany (EU) |
| PostHog | Usage statistics, only if you allow them | Germany (EU) |
| “Continue with Google” sign-in; beta app delivery (Firebase App Distribution, if you join the beta); our team inbox (Gmail) for emails you send us; Gemini AI, which writes your trip plans from the details you choose; Firebase Cloud Messaging, which delivers push notifications to the Android app | Worldwide |
Travel information and photos. To build destination pages we send only place names and locations, never anything about you, to: Google's Gemini AI (writes the travel information), Geoapify (finds places as you type, and the place name for a Wanderbook photo's location; only the coordinates are sent, without anything about you), and Wikipedia, Wikidata and Unsplash (find photos). Photos are then loaded by your browser or the app directly from Wikimedia Commons and Unsplash, which receive your IP address and browser details, as any website you visit would. Their own privacy policies apply to that.
Trip plans. To write or change a plan we send Google's Gemini AI the plan details listed in section 2 (place, dates, who is going, pace, budget, interests and any wish you type), never your name, email or account. While we use Gemini's free tier, Google may use what we send to improve its services, so please don't type personal details in a wish. Before a plan is shared by link, and when a shared plan changes, its text is checked by OpenAI's moderation service (as for Wanderbook). A shared plan can be seen by anyone with its link until you stop sharing or delete it.
Push notifications. The Android app asks before it sends any, and you can turn each kind off in the app or on the website (Notification settings), or all of them in your phone's settings. A push goes through Google's Firebase Cloud Messaging with your phone's push token and the notification's text, never your email. Signing out removes the phone's token. The website has no push notifications.
Flights, stays and car rentals. To show flight prices and open partner websites we send Travelpayouts (our affiliate network, which runs Aviasales) only what you searched: places, dates and the number of travellers, never your name, email or account. When you open a partner from GoAwayGo, your browser goes through Travelpayouts to the partner (for example Aviasales, Trip.com or DiscoverCars). They receive your IP address and browser details and may set cookies to record that you came from GoAwayGo, so a booking can be credited to us. Anything you book is between you and the partner, under their privacy policy.
We don't sell your personal data, and we don't share it for targeted advertising. We disclose it to authorities only when the law requires it, and we would tell you unless the law forbids that.
5. International transfers
Our team is in India and our providers work in the countries listed above, so your data may be processed outside the country where you live. Wherever it goes, it gets the protection described in this policy:
- From the EU, EEA, UK or Switzerland, transfers are covered by the European Commission's Standard Contractual Clauses (and the UK addendum) in our providers' data protection agreements, or go to countries recognised as giving adequate protection.
- Under India's DPDP Act, we don't transfer data to any country the Government of India restricts.
- Elsewhere, we rely on equivalent safeguards that your local law recognises.
You can ask us for more information about these safeguards at [email protected].
6. How long we keep it
- Your account (name, email, password hash, Google ID, sign-in sessions): while you have an account. When you delete it (in the app, on the website, or by email, which we act on within 30 days), it is hidden and signed out at once and deleted 30 days later, unless you sign in again before then to keep it.
- Wanderbook posts, photos, comments and likes: until you delete them or your account. Removed photo files are deleted from storage at the same time.
- Places and trip plans you viewed (signed in): only the last 30 of each are kept; older ones are deleted as you go, you can clear them in Recently viewed, and all are deleted with your account. Places in My Trips and trip plans: until you remove them or delete your account.
- Notifications: 90 days. Push tokens: until you sign out on that phone, uninstall the app, or delete your account.
- Emailed links: they stop working after 30 minutes (password reset) or 24 hours (email verification and a new email), and are deleted with your account.
- Server logs (including IP addresses): deleted automatically after 30 days.
- Crash and error reports: deleted automatically after 30 days.
- Usage statistics (only if you allowed them): deleted automatically after 12 months; they aren't linked to your account, so they can't identify you.
- Database backups: overwritten within 7 days, so deleted data disappears from them too.
7. How we protect it
- All connections are encrypted (HTTPS); the database only accepts encrypted connections.
- Passwords are stored as hashes; sign-in sessions and emailed links are stored as hashes too.
- Only the people who run GoAwayGo can access our systems and data.
- Repeated sign-in attempts are limited, and crash reports have personal data removed.
If a personal data breach affects you, we will tell you without undue delay, with what happened, what it means for you and what we are doing about it, and we will notify the data protection authorities within the time the law sets (for example, within 72 hours under the GDPR).
8. Your rights
We give these rights to everyone, wherever you live. You can ask us to:
- Access: tell you what personal data we hold about you and how we use it, and give you a copy.
- Correct data that is wrong or incomplete.
- Delete your data. See Delete my data.
- Portability: give you your data in a common, machine-readable format (such as JSON), or send it to another service.
- Object to uses based on legitimate interest, or restrict how we use your data while a question is being sorted out.
- Withdraw consent you have given, as easily as you gave it (for usage statistics: “Privacy choices”). This doesn't affect what we did before.
- Appeal if we turn down your request: reply to our answer and someone who wasn't involved will review it.
Write to [email protected] from the email address of your account, so we know it's you. Someone you authorise can also ask for you, with your written permission. We answer within 30 days (we may extend this where the law allows, and will tell you why). Using your rights is free, and we will never treat you differently for using them.
You also have the right to complain to a data protection authority; see section 9. We'd appreciate the chance to sort it out first.
9. Extra information for your region
European Union, EEA, United Kingdom and Switzerland. The GDPR (or UK GDPR / Swiss FADP) applies. Our legal bases are listed in section 2. You can complain to the data protection authority where you live or work, such as the UK Information Commissioner's Office (ICO).
United States (California and other states with privacy laws). In the last 12 months we have collected these categories of personal information: identifiers (name, email, account and device identifiers, IP address), internet or app activity (pages and features used, error reports) and account login details. We collect them from you, your device and, if you choose, Google. We use them only for the purposes in section 2 and disclose them only to the providers in section 4. We have not sold or shared personal information for cross-context behavioural advertising, and we don't knowingly do so for anyone under 16, so there is nothing to opt out of; a Global Privacy Control signal from your browser is respected by default. You have the rights in section 8 (to know, delete, correct and appeal) without discrimination. If we deny an appeal, you can contact your state's Attorney General.
India. Under the DPDP Act, our grievance contact is the GoAwayGo privacy team at [email protected]; we acknowledge every complaint and resolve it within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India. You can also nominate someone to use your rights if you die or can't act yourself, and ask for this notice in any language of the Eighth Schedule to the Constitution of India.
Brazil. Under the LGPD you have the rights in section 8, including confirmation that we process your data and information about who we share it with, and you can complain to the ANPD.
Everywhere else. If your country has a privacy law (for example Canada, Australia, Singapore, Japan, South Africa or the UAE), you have the rights it gives you, and at least those in section 8. You can complain to your national privacy authority.
10. Children
GoAwayGo is for people aged 18 or over, everywhere. We don't knowingly collect data from children; if you believe a child has an account, write to us and we will delete it.
11. Changes to this policy
When this policy changes, we update the date at the top. If a change affects how we use your data, we tell you by email or in the app before it applies and, where needed, ask for your consent again.
12. Contact
Privacy questions and requests: [email protected]. Anything else: [email protected].