Privacy policy
What Trekki collects, why, for how long, and what you can demand.
Last updated: 20 August 2026
The principle
Trekki runs on your device first. Your places, trips, photos and notes are stored locally and stay usable offline. They only reach our servers if you create an account, and only so we can give them back to you on your other devices.
We sell no data, we rent none, and we display no targeted advertising.
Data controller
- Aurenyx Studio EOOD, a single-member limited liability company under Bulgarian law
- Registered office: bulevard "Knyaginya Maria Luiza" 47, floor 1, 1202 Sofia, Bulgaria
- UIC (unique identification code): 208591009
- VAT number: to be completed
- Publishing director: to be completed
- Contact: hello@trekki.app
No data protection officer has been appointed: our activity does not meet the conditions that would require one. Requests are handled at the address above.
What we process
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address | Creating and securing your account, sending your sign-in code | Performance of the contract | Until the account is deleted |
| Departure airports and wishes | Showing you flights from where you actually live | Performance of the contract | Until the account is deleted |
| Places, trips, photos, expenses | Giving them back to you across your devices | Performance of the contract | Until you delete them |
| Location | Dropping a place where you stand, validating a quest, measuring a distance | Consent, revocable in your phone settings | Not retained: used then forgotten |
| Contact fingerprints | Telling you who in your address book already uses Trekki | Consent | Not retained: compared then discarded |
| Search phrase | Interpreting your request in plain language | Performance of the contract | Not retained by us |
| Technical identifiers and logs | Security, abuse prevention, fixing failures | Legitimate interest | Twelve months |
Your address book
Your address book never leaves your phone. When you ask who already uses Trekki, the app computes a SHA-256 fingerprint of each email address on the device and sends only those fingerprints. No name, no number and no address in clear text is transmitted, and the server does not retain the fingerprints it receives.
This protects transport and retention. It does not make the fingerprints inherently unreadable: an email address carries little entropy. We choose it because it is the best realistic protection at our scale, and we would rather say so.
Who processes on our behalf
| Processor | Role | Where |
|---|---|---|
| Supabase | Accounts, database, delivery of sign-in emails | European Union (Frankfurt region) |
| Resend | Transactional email delivery | European Union and United States |
| OpenAI | Interpreting natural-language searches | United States |
| Travelpayouts | Flight fares and booking tracking | European Union |
| Vercel | Website hosting | United States, with processing in Europe |
| Apple et Google | App distribution and subscription billing | United States and European Union |
Transfers outside the European Union rely on the European Commission's standard contractual clauses.
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. The app already lets you export your places as GPX or CSV, and delete your account from the settings.
For any request: hello@trekki.app. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), or with the authority of your country of residence.
Minors
Trekki is not intended for people under sixteen and we do not knowingly collect their data.