Privacy policy

Who runs Itemerary

Itemerary is run by Mihail Tirdea as an individual in Brașov, Romania. He is responsible for how the service uses your personal data.

A contact address will appear here before sign-in opens to anyone other than the owner.

What Itemerary keeps and why

Your account's email address, name and Apple or Google identifier let you sign in and join trips. Your country of residence and home currency let the app show amounts in your currency and work out which tax refund schemes apply to you.

Itemerary keeps your trips with their members, expenses, line items and places with branches and addresses, receipt photos, transit card reads, budgets and favourites to give you the service you signed up for.

Each transit card is known only by a keyed hash of its ID, called an HMAC. Itemerary does not keep the card's original ID.

Managing your account, sending sign-in emails, recording and sharing trip spending, reading transit cards, working out amounts and keeping copies on your phone are part of the service you ask for. We process this data to carry out our contract with you (GDPR Article 6(1)(b)). Reading receipts uses the same basis, as explained below.

If you agreed in person to help measure the app, your phone times how long you take to log an expense and to mark who shares each line item on a scanned receipt, and sends those timings to Itemerary. Nobody else is timed. This relies on your consent (GDPR Article 6(1)(a)), and you can ask the owner to stop at any time. Itemerary then stops collecting your timings and erases those already kept. Itemerary uses no analytics service.

Logs, error reports, backups and app update checks help keep Itemerary secure and reliable. Comparing what a scan read with what you saved helps check its accuracy. These uses rely on the owner's legitimate interests in protecting the service, recovering data and fixing mistakes (GDPR Article 6(1)(f)).

Names and spending recorded for members without an account, and shared spending kept after you leave or delete your account, rely on the members' legitimate interest in keeping an accurate shared record (GDPR Article 6(1)(f)).

Where it lives

Your account and trip data lives on Hetzner's server in Falkenstein, Germany. Receipt photos and encrypted database backups live in Cloudflare R2 under the EU jurisdiction, and encrypted photo backups live on the Hetzner server. Amazon SES in Frankfurt sends email, and Sentry's EU region receives error reports. These services process the data under data processing agreements. Healthchecks.io and UptimeRobot check that the service is running and receive no personal data.

Data can pass through a provider's global network or be accessed for support outside the EU under its agreement and transfer safeguards.

The app also contacts Expo's update servers to check for and download app updates. Expo receives your phone's IP address, operating system and app version information, and may use a random token to tell whether an update was downloaded. This data may be processed outside the EU, including in the United States. Expo's privacy policy explains its international transfers and safeguards. Reading receipts also sends data outside the EU, as described below.

Reading receipts. When you scan a receipt, Itemerary sends its photos to Anthropic, whose Claude model reads them into lines and amounts for you to check. This is part of the service you signed up for, so it rests on our contract with you (GDPR Article 6(1)(b)). Anthropic may process the photos in any country where it runs Claude, and it stores them in the United States, under the EU Standard Contractual Clauses in its data processing addendum. It deletes them, and what it read from them, within 30 days, unless a request is flagged under its Usage Policy, in which case it may keep it for up to 2 years, or longer where the law requires. It does not train its models on them. The same applies to screenshots and photos of a transit card's history, which show the stations you travelled through. Your photos stay in Itemerary's storage in the EU until a member deletes them or their expense or trip is erased, and our backups drop them within 30 days after that. We keep what was read next to the saved expense to measure how often scans need correcting. A receipt can show what you bought, where and when, and part of your card number. If you'd rather a receipt isn't read, add the expense by hand.

Who sees what

Every member with an account sees the whole trip except other members' private expenses. A private expense is visible only to the member it belongs to. Your budget is visible only to you.

How long things last

A deleted expense or trip waits in Recently deleted for 30 days so a member can restore it. After that it is erased.

If you leave a trip or a member removes you, any member with an account can restore you for 30 days. After that the trip forgets which account was yours. Your account still exists, and the spending already assigned to you stays in the trip.

Photos stay until a member deletes them or their expense or trip is erased. What a scan read stays with its saved expense and is erased with it. A discarded or failed scan keeps no receipt contents.

Erased data leaves encrypted backups within 30 days. A restore replays erasures before the service reopens. Logs keep 14 days and never hold receipt contents.

Deleting your account

You can delete your account in the app or on a web page after confirming it is yours. Account deletion is immediate. It erases your account, sign-in methods, country of residence and home currency, your private expenses, and every trip no other user can reach.

Shared trips keep your spending and the receipt photos you shared. In each shared trip, your name stays as a ghost member, a member without a linked account, so the other members can keep logging your shares or invite you again. This keeps the other members' expenses and shares intact.

What stays on your phone

The app keeps the last-known copy of your trips so you can read them when the connection is down. Signing out wipes that copy. Unsaved expenses and their photos stay encrypted on your phone until they can be saved or you discard them.

Your rights

Under the GDPR, you can ask to access your personal data, correct it, erase it, restrict its use or receive a portable copy. You can object to processing based on legitimate interests and withdraw your consent to phone timings at any time. These rights apply under the conditions set by the GDPR.

To exercise your rights, write to the contact address above and say what you are asking for. Itemerary may ask you to confirm your identity before sharing or changing personal data. Using your contact details and identity confirmation to handle these requests meets our legal obligations (GDPR Article 6(1)(c)).

You can complain to a data protection authority, including Romania's ANSPDCP or the authority where you live or work. The European Commission explains your GDPR rights.