1. Introduction

Ternny ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the Ternny travel social platform and mobile application (the "Service"), in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

Ternny is the data controller responsible for your personal data. If you have questions about this policy or wish to exercise your data protection rights, contact us at legal@ternny.com.

3. Personal Data We Collect

We collect the following categories of personal data:

Account Information

Email address
Display name and username
Profile photo
Password (stored encrypted/hashed)

Profile Information

Bio and personal description
Self-reported location/region and nationality (free text you enter, not your device's GPS location)
Age range and gender (optional)
Languages spoken
Travel preferences, travel style, and motivations

Travel & Social Content

Trips, itineraries, and travel history
Photos and media uploads
Voice notes (audio recordings you create, e.g. during the travelbook review flow)
Reviews, ratings, comments, and reactions
Saved destinations and itineraries
Direct messages you exchange with other users
Connections (people you follow / who follow you)

Technical Data

IP address and device information (device type, operating system, app version; browser type and version where you use the web app)
Usage data and analytics
Crash reports and performance diagnostics. We use Sentry to collect these so we can identify and fix problems
Push notification token. If you enable notifications, we store a push token for your device and deliver notifications via Expo's push service
Local storage and similar technologies (see Section 10)

Contacts (on-device only)

If you choose to invite friends, we access your device's contacts (names, phone numbers, emails) on your device only, to let you select someone to invite. Your contacts are not uploaded to, stored on, or shared with our servers. Accessing contacts is optional and requires your permission, which you can revoke at any time in your device settings.

We do not collect your precise or background device location.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

Contract Performance: Processing necessary to provide the Service you requested
Consent: Where you have given explicit consent for specific purposes (e.g., marketing emails, accessing contacts)
Legitimate Interests: For security, fraud prevention, content moderation, service improvement, and analytics
Legal Obligation: Where required by applicable law

5. How We Use Your Data

We use your personal data to:

Create and manage your account
Provide and improve the Service
Enable social features, messaging, and user connections
Personalize your experience and recommendations
Send service-related notifications
Send marketing communications (with your consent)
Keep the platform safe, including reviewing reports, moderating content, and enforcing our Terms (e.g., blocking and reporting)
Prevent fraud and ensure platform security
Comply with legal obligations
Analyze usage and improve our services

AI features

When you use AI-powered features (generating an itinerary, importing a booking from a screenshot, or creating a travelbook), the relevant content (trip preferences, the screenshot you choose, your trip photos, and any voice notes you include) is processed by our AI service providers to produce the result. This content is used only to fulfil your request and is not used to train third-party models.

6. Data Sharing

We may share your data with:

Other Users: Profile information and content you choose to make visible, according to your profile visibility settings. Messages are shared with the recipient.
Service Providers (sub-processors): Trusted third parties who help us operate the Service, including:
Supabase: database hosting, authentication, and media storage
Google and Apple: sign-in (authentication) when you choose those options
Mapbox and map/place data providers: maps and location search features
Lovable AI Gateway and its upstream model providers: AI-powered itinerary generation, booking screenshot parsing, and travelbook creation
Sentry: crash reporting and performance diagnostics
Expo: delivery of push notifications to your device
Email and analytics providers
Legal Authorities: When required by law, to enforce our Terms, or to protect the rights and safety of our users, the public, or Ternny.

We do not sell your personal data to third parties.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). Where this happens, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission, to protect your data in accordance with GDPR requirements.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law.

You can delete your account at any time from within the app (Profile → Security → Delete account). When you delete your account, your profile and associated personal data are deleted immediately, and any residual copies are removed or anonymized within 30 days, except where we are legally required to retain certain information.

9. Your Rights Under GDPR

Under the GDPR, you have the following rights:

Right of Access: Request a copy of your personal data
Right to Rectification: Request correction of inaccurate data
Right to Erasure: Request deletion of your data ("right to be forgotten"). You can also do this yourself in-app at any time
Right to Restriction: Request limitation of processing
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests or for marketing
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at legal@ternny.com. We will respond within 30 days.

10. Cookies & Similar Technologies

In our mobile app, we use device local storage (for example, to keep you signed in) and software development kits (SDKs) that may use device identifiers for authentication, security, and analytics. On the web, we use cookies and similar technologies to enhance your experience, analyze usage, and personalize content. Essential storage and cookies are necessary for the Service to function and cannot be disabled; you can manage non-essential cookies through your browser settings and SDK/permission choices through your device settings.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure.

12. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately and we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Service. The updated policy will be effective when posted with a new "Last updated" date.

14. Supervisory Authority

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority in your EU member state of residence.

15. Contact Us

For privacy-related inquiries or to exercise your rights:

Ternny

Email: legal@ternny.com

By using Ternny, you acknowledge that you have read and understood this Privacy Policy.