1Introduction
This Privacy Policy explains what personal information Togvia collects when you use togvia.com, why we collect it, who can see it, how long we keep it, and the rights you have over it.
Togvia is a trip-planning service. Most of the information we hold exists because you or your travelling companions put it there: a trip, a shortlist of places, a vote, a note. We keep the amount of everything else to the minimum the service needs to work.
We do not sell your personal information, we do not share it with advertisers, and we do not use what you write to train models. Togvia carries no third-party advertising or tracking network.
For the purposes of data protection law, Togvia is the controller of the personal information described here. This policy should be read with our Cookie Policy and our Terms of Use.
2Information we collect
The table below lists every category of personal information Togvia holds, what it is used for, and how long it is kept.
| Category | What it includes | Why we hold it | How long |
|---|---|---|---|
| Your account | The name you choose to show the group, your email address or username, and a scrambled (hashed) version of your password. We never store the password itself and cannot read it. | So you can sign in, so your group knows who you are, and so we can send you a reset link if you forget your password. | Until you ask us to delete your account. |
| Your settings | How you usually travel, distance in miles or kilometres, text size and contrast choices, and which emails you want. | So the site behaves the way you set it up, and so we only email you about what you asked for. | Until you change them or delete your account. |
| Trips and who is on them | Trip titles, destinations, dates, who owns each trip and who has joined it. | This is the trip itself — without it there is nothing to plan. | Until the trip is deleted by its owner. |
| Places and ideas | Places added to a trip, the ones you personally marked as favourites, and any notes attached to them. | So the group can see what everyone would like to do. | Until removed, or until the trip is deleted. |
| Your votes | Whether you said yes, maybe or no to each place, and any comment you left with it. | Voting is how the group reaches a decision together. | Until the trip is deleted. |
| Agreed choices | The set of places the group settled on, who confirmed it and when. | So the plan is built from what the group actually agreed, and so it does not change under people's feet. | Until the trip is deleted. |
| Your plan and journey | The day-by-day plan, travel between places, and how far through it you have got while travelling. | So you have a plan to follow, and so the app can show you what is next on the day. | Until the trip is deleted. |
| Notes, checklists and messages | Shared notes and checklists, private notes only you can see, and any messages you send the group. | So a group can organise itself in one place. | Until deleted, or until the trip is deleted. |
| Invitations | The name you typed for the person you invited, when the invitation was made and whether it has been used. The invitation link itself is stored only as a scrambled digest, so it cannot be read back out of our database. | So invitations work, expire, and cannot be reused by somebody they were not meant for. | Until the invitation expires or is revoked, and then with the trip. |
| Sign-in and technical data | A session cookie that keeps you signed in, and a short-lived record of failed sign-in attempts. | So you stay signed in between pages, and so somebody cannot guess their way into your account. | The session ends when you sign out. Failed sign-in records are short-lived. |
| How the site is used | Public page views and product events, an anonymous code derived from the existing Togvia session, activity sessions, the entry and last page, referring website domain, campaign tags, approximate country from the network address, and broad device, browser and operating-system category. A raw IP address is kept briefly for operational visitor and security diagnosis. We do not use device fingerprinting and do not record passwords, form contents, trip notes, messages or private URL tokens. | So we can understand demand, find where people get stuck, improve popular content and diagnose service problems. It is not used for advertising and is never sold. | Raw IP addresses for 30 days; operational session records for 90 days; longer-term reporting is kept without a raw IP. |
| Feedback you choose to send us | If you answer one of our optional questionnaires, we record which trip it related to and which of the offered answers you chose. Only an answer we offered can be stored. If you also choose to write a comment, we keep what you wrote, up to 500 characters. Nobody is asked to write one, and the box says plainly not to put anything private in it. | So we can find out whether Togvia genuinely helps a group decide together, and where it does not. That is the only thing it is used for. | Until the question it answers has been reviewed, or until you ask us to delete your account. |
| Privacy requests | A record that you asked for your data or asked us to delete your account, and what we did about it. | So we can act on the request and show that we did. | Kept as a record that the request was handled. |
We collect this information in three ways: when you give it to us directly (creating an account, building a trip, writing to us); automatically as a necessary part of serving the site (your session, a record of failed sign-in attempts); and from another user, where somebody invites you to a trip.
We do not collect special category data. Please do not put health information, identity documents, payment card details or other sensitive personal data into a trip note, a checklist or a message.
3How we use your information
We use personal information to:
- create and maintain your account, and keep you signed in;
- build, save and display your trips, places, votes, plans, notes and checklists;
- let you share a trip with other people and let them take part in it;
- send invitations, password resets and other service messages you have asked for or need;
- generate itineraries, routes and travel estimates from the places you have chosen;
- keep the service secure, prevent abuse and investigate misuse;
- understand in aggregate how the service is used so we can improve it;
- respond to your questions and to privacy requests;
- comply with our legal obligations.
We do not carry out automated decision-making that produces legal or similarly significant effects about you.
4Our legal basis for using it
Where UK and EU data protection law applies, we rely on the following bases:
- Performance of a contract. Running your account and your trips is the service you asked us for, and we cannot provide it without this information.
- Legitimate interests. Keeping the service secure, preventing abuse, and understanding in aggregate how the site is used so it can be improved. We balance these interests against your rights, and use the least identifying method that works.
- Consent. Where you opt in to something optional, such as a non-essential email. You can withdraw consent at any time from your account page.
- Legal obligation. Where we are required to retain or disclose information by law.
6Third parties your browser contacts
Some parts of Togvia load content from other organisations. None of them receives your account, your trip contents or your votes. Because a browser must reveal its IP address to fetch anything, each of them necessarily sees that.
| Service | What it provides | What it necessarily learns |
|---|---|---|
| OpenStreetMap | Map tiles and walking routes | Your IP address and which part of the map you are looking at. |
| Google Fonts | The typefaces the site is set in | Your IP address when the fonts are fetched. |
| unpkg | Delivers the mapping library the maps are drawn with | Your IP address when the library is fetched. |
| Transport for London | Live London transport information | That somebody asked about a London route. Nothing identifying you is sent. |
| Unsplash | Some photographs | Your IP address when a photograph is fetched. |
| Google Maps | Opens directions when you choose to | Only what you send it, and only if you tap a directions link. |
Each of these organisations operates under its own privacy policy. Togvia also links out to venues, transport operators and ticket sellers; those sites are not ours and we are not responsible for their privacy practices.
7Location information
Togvia can show your position on a map while you are travelling. This only happens when you press the button that asks for it, and only if your browser grants permission.
Your position is used in your browser to draw a marker on your own map. It is not sent to our servers, not stored, and not shared with anybody. You can revoke the permission at any time in your browser settings.
9Your visitor statistics choice
Togvia uses limited first-party statistics to understand page demand, trip creation and where the service needs improvement. It records approximate network country, broad device/browser category, referring domain and a short-lived raw IP address. It does not use fingerprinting, advertising profiles or third-party analytics, and raw IP addresses are removed after 30 days.
You can object free of charge. Turning statistics off does not affect the service.
10How we protect your information
We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration and disclosure. These include:
- encryption in transit (HTTPS) across the whole service;
- passwords stored only as a salted hash — we never hold your password and cannot read it;
- invitation links stored only as a digest, so a link cannot be read back out of our database;
- rate limiting on sign-in to frustrate guessing attacks;
- access controls so that trip data is reachable only by the members of that trip;
- a content security policy and related browser protections on every page.
No online service can promise perfect security. If a breach occurred that was likely to result in a risk to your rights and freedoms, we would notify the relevant supervisory authority and, where required, you.
11How long we keep it, and deletion
We keep personal information only for as long as it is needed for the purpose it was collected for, as set out in the table in Information we collect, or for as long as the law requires.
You can delete your account at any time from your account page. When you do:
- your account, settings, private notes and personal favourites are deleted;
- trips you own are deleted, along with their plans, notes and votes, for every member;
- on trips owned by somebody else, your contributions to the shared record — the places you added and the votes that made up a group decision — remain, because removing them would rewrite a decision the rest of the group made together. Your name is dissociated from them;
- anonymous usage totals, which cannot be linked back to you, are unaffected.
Backups are retained for a short, fixed period and then overwritten. A deleted record may persist in a backup for that period before it is removed.
12Your rights
Depending on where you live, you have some or all of the following rights over your personal information. Togvia is built so that most of them can be exercised immediately, without asking us:
- See what we hold about you. Download it from your account page at any time.
- Correct something wrong. Change your name, email and settings on your account page.
- Delete your account. Ask from your account page. What happens to shared trips is set out below.
- Take your data elsewhere. The download is a JSON file you can keep or move.
- Object, or ask us to stop. Write to the contact address below.
- Complain. You can complain to the data protection regulator in your country. In the UK that is the Information Commissioner's Office.
We do not charge for handling a request, and we respond within one month. We may ask you to confirm your identity before acting on a request about an account.
If you are unhappy with how we have handled your information, you can complain to the data protection authority in your country. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk).
13International transfers
Togvia is operated from England and Wales and its data is hosted within the United Kingdom and the European Economic Area. Where information is transferred outside that area — for example, because a service provider operates elsewhere — we rely on an adequacy decision or on standard contractual clauses, together with any additional safeguards required, so that your information remains protected to the same standard.
14Children's privacy
Togvia is intended for adults and is not directed at children. We do not knowingly collect personal information from a child under 16.
Children may of course be part of a trip a parent or guardian is planning, and a plan may be built around what suits a family. That planning is done through the adult's account.
If you believe a child has created an account, write to privacy@togvia.com and we will delete it.
15Changes to this policy
We may update this policy to reflect a change to the service, to our providers, or to the law. The current version is always published on this page with the date it was last updated shown at the top. Where a change materially affects how we use your information, we will take reasonable steps to tell you before it takes effect.
16Contact us
For any question about this policy, or to make a privacy request, write to privacy@togvia.com.
For anything else about the service, write to support@togvia.com.