Privacy Policy

Anticipāt ⏳

Countdowns, dates, destinations, notes, and any photo you attach are stored on your device. On iPhone and iPad, you can turn on sync, which stores your events in your own private iCloud database (Apple CloudKit). We can't read it. It's your iCloud, protected by your Apple ID. Nothing is stored on any server of ours. Optional permissions and online features:

• Notifications: to remind you before an event. Optional, asked in context.
• Photo Library: only the specific photo you pick as a countdown background; we never read your whole library.
• Calendar (read-only): if you use Calendar Import, events are read locally to suggest countdowns and discarded when you leave that screen. Never transmitted.
• Unsplash image search: if you search for a background image, the text you type (e.g. "Tokyo skyline") is sent to Unsplash to fetch photos. Only that search text is sent. See Unsplash's policy.
• Sharing a countdown creates an image on your device that you send through the system share sheet. Nothing is uploaded by the app.

Trāce 🌍

The places you mark (visited, lived, booked, want to visit, transited) and your stats are stored on your device. On iPhone, your country and state statuses also back up through your own iCloud (the iCloud key-value store), so a new phone comes back filled in. That's your iCloud, not ours, and it does nothing at all if iCloud is off.

Trāce's interactive map is rendered by the Mapbox Maps SDK. To draw the map, Mapbox receives standard map-tile requests and, by default, collects de-identified usage and approximate-location telemetry from the map view. We do not receive or store this telemetry; it is handled by Mapbox under Mapbox's privacy policy. You can opt out of Mapbox telemetry directly on the map: tap the information (ⓘ) icon and choose the telemetry setting.

If Anticipāt is installed on the same phone, the two apps can exchange trip suggestions through a shared on-device container. Nothing leaves the phone, and every suggestion asks you first. Share images are generated on your device. Trāce has no accounts, no ads, and no third-party services other than Mapbox.

Rōute 🗺️

Trips, day-by-day itineraries, confirmation numbers, attached confirmation PDFs, and notes are stored on your device, and every saved trip opens fully offline. On iPhone and iPad, trips sync between your own devices through your own private iCloud database (Apple CloudKit), never through a server of ours. Rōute requests no location permission at all. There is no account and no sign-in anywhere in the app.

Rōute's online conveniences, and exactly what each one sends:

• Confirmation parsing. When you import a booking confirmation (shared email text, pasted text, an uploaded PDF, or a Fora link), that text is sent to a parsing service we operate (a Cloudflare Worker), which passes it to AI services from Anthropic and Google to extract the booking fields, then returns them to your phone. We do not store the text or the result; the Worker has no database and no logging. Only the one confirmation you choose to import ever leaves the device; Rōute never touches your inbox. Offline, an on-device parser takes over.
• Live flight status. The flight number and date are sent to a flight-status service to fetch gates, terminals, and times.
• Weather and travel times. The coordinates and dates of your itinerary days are sent to weather and routing services to show forecasts and realistic travel times between stops.
• Notifications: for day-of reminders and flight alerts. Optional. Scheduled on your device.
• Photo Library: only if you pick a trip cover photo.

Each of these degrades quietly when you're offline. Rōute currently contains no affiliate links.

Pāck 🧳

Lists, items, templates, photos, and progress live on your device. Packing on your own makes no network calls at all. The online features, one by one:

• Weather suggestions. Pāck sends your destination's name and coordinates to Open-Meteo, a weather service that needs no key and no account, and reads back the forecast. Nothing about you is sent.
• Cover photo search sends your search text to Unsplash.
• Personal sync (opt-in, off by default). Your own lists back up to your own cloud: your iCloud Drive on iPhone, or a visible "Pāck" folder in your own Google Drive on Android. On Android this uses Google's drive.file scope, which limits Pāck to files it created itself, so it cannot see the rest of your Drive. You can view and delete these files yourself.
• Shared lists. When you actively share a list, that list (its items, the display name you chose, and who marked what) syncs through Google Firebase (Firestore and Firebase Auth) in a project we operate, so people on different phones (including mixed iPhone and Android groups) can pack the same list together. No photos are uploaded except the list cover, and nothing else about your device is sent. You can end this at any time in Settings ("Stop sharing"), which removes the list from live sync.
• Sign-in. Sharing signs you in silently with an anonymous session. You can optionally attach the Apple or Google account you already have so shared lists survive a new phone. We never create a HYTimes account.

Pāck's affiliate links (Amazon, Airalo, Faye) open in your browser; see Section 5.

Spēnd 💰

Solo use needs no account and no network. Budgets, expenses, splitting, settling up, and CSV export all work on-device and offline, with no sign-in anywhere. That's the default, and nothing below applies until you share a group.

• Sharing a group uses an account you already have. Sharing or joining a live group requires signing in with Apple or Google (federated through Firebase Auth), so your groups survive a lost phone. Viewers who only look at a group can join anonymously. We never create a HYTimes account, and sign-in is only ever prompted when you share or join.
• What syncs, and only what syncs: participants, expenses and their splits, payments, funds, comments, and group details. These live in a Google Firebase (Firestore) project operated by HYTimes Group LLC while the group is shared.
• What never syncs: receipt photos never leave the device that took them. Balances are never transmitted; each device works out who owes whom from the synced rows itself.
• Push notifications. If you allow them, a device token is stored in the shared group so our notification function can reach you. It's removed when you leave the group or stop sharing. Notifications are only ever about activity in a group you joined, never marketing.
• Exchange rates. Spēnd fetches a daily currency rate table from a public feed. No user data is sent to get it, and the table is cached on your device.
• Receipt scanning is on-device. Apple Vision or ML Kit reads the receipt on your phone, and only the values you keep are stored. The image is never uploaded. Camera and Photo Library permissions are requested only for the receipt you're adding.
• Deleting your account. Settings has a delete-account control. It deletes the account and strips your user ID, name, and payout handles out of every shared group. Expenses you added stay, because they're part of other people's balances too. Details: hytimesgroup.com/spend/delete-account.

Where the shared copy lives, and for how long. Shared group documents sit in a Firebase project operated by HYTimes Group LLC, and they delete themselves on a schedule: 30 days after the owner ends the share, or 12 months after a group goes untouched. Everyone keeps their own copy on their own phone either way, because the shared copy exists for live collaboration, not for archiving. You can stop sharing or leave a group whenever you want, and if you want the shared copy gone sooner than the schedule, use the in-app controls or email us.