旅途今日 (Trip Today) Privacy Policy

Effective date: 2026-11-02
Version: v2 (draft, pending legal review; Ask AI added 2026-11-02)

旅途今日 ("the App") is developed and operated by Ziyu Guo, an individual developer based in Japan ("we", "us"). This policy explains what information the App handles, why, who receives it, how long it is kept, and what you can do.

1. Summary

• No account is needed. No ads, no tracking, no selling of data, and no third-party analytics or advertising SDKs.
• Your trips are stored on your device and in an iCloud Drive folder you choose; our server does not store them. Only when you use the AI features is the content they need sent through our server (see Sections 3 and 4).
• Only after you agree, and only when you tap Generate, the materials you added this time (the name and text of each) and the trip name you entered are sent through our server to an AI model operated by Anthropic (United States) to turn them into a day-by-day itinerary.
• When you use Ask AI, your question, the last few turns of the conversation, the content of the trip you have open, and any photo or location you choose to attach are also sent through our server to Anthropic. To answer, the AI may search the web and open public web pages (see Section 4).
• Our server does not store this content. It only counts, per day, how much each device has used, under an encrypted hash of an identifier and without any content. Anthropic deletes inputs and outputs within 30 days and does not use them to train models (exceptions in Section 3).

2. Information that stays on your device (we never receive it)

iCloud Drive is provided by Apple under Apple's privacy policy. We cannot access your iCloud. App data on your device is also included in your own iPhone backups (such as iCloud Backup), which Apple handles under its own policies.

Translation links: when you tap "Open in Google Translate", the App puts that sentence and the languages in a URL and opens the Google Translate app or website; Google then handles it under its own privacy policy, and we do not receive it. The App's built-in Apple offline translation runs on your device and is not sent to anyone.

Map links: when you tap a place, the App puts the place name (and its address, if there is one) into a link and opens Google Maps or Apple Maps; from then on Google or Apple handles it under its own privacy policy, and we do not receive it.

Problem report emails: if you choose to send a problem report by email, the App opens the mail app on your device with the recipient (zguo415@gmail.com), subject and body filled in. The body contains the type of problem, the item's title, your note, the App version and a report number; the item's date, time, places and description are added only if you turn on "Attach this item's details". You review the email and send it yourself, or don't send it. If you send it, we receive the email and your email address, and use them only to handle that report, reply to you and improve generation. We keep them for at most 12 months after the report is handled, then delete them.

3. What is sent when you tap Generate

Before your first generation, the App explains this and asks for your consent. If you decline, nothing is sent and you can still create trips by hand.

What is sent (once per generation)

• Materials: the name and full text of each material you added this time. For a file you pick, the name is the file name (which may contain a person's name, for example "Tanaka-hotel-confirmation.pdf"); pasted text and screenshots get names like "Paste 1" and "Screenshot 1". The full text includes pasted text, text recognized from screenshots, and text read from files (plain text, PDF, web pages, email files and so on).
• Email files: if you pick an email file (.eml), the App parses it on your device and sends only the sender, recipients, subject, date and body text; other email headers (for example the mail servers it passed through and signature data) and attachments are not sent.
• Trip name: the trip name you entered, if any. The App does not send trip dates.
• Generation settings: the IDs of the scenario packs you chose (for example "With kids" or "Dietary needs / allergies") and the trip language (the same as the App's display language, for example Simplified Chinese or Japanese).
• Request information: a random number for this request, a random number for the trip, the time the request was created, and the App name and version.
• Consent record: the version of the explanation you agreed to, when you agreed, and your confirmation that you are 18 or older. No name or other identity information.
• Technical data used to prevent abuse: an Apple App Attest key ID and a signature over this request, used to confirm that the request comes from the genuine App on this device and has not been altered. Once, before your first generation, the App also sends App Attest verification data issued by Apple (including the public key of that key) to register this device.

Of this, only the materials (names and full text) and the trip name are passed on to Anthropic. Everything else is only checked by our server and discarded after processing, not stored (except for the "device record" described below).

What is not sent: photos or screenshots themselves, your other trips, contacts, location, or anything else on your device.

Please do not include: passport numbers, card numbers, medical or health information, or other sensitive information.

Who handles it

1. Our generation server runs on the global network of Cloudflare, Inc. (a US company). Requests are usually handled at the data center nearest to you, so the country of processing cannot be determined in advance. The server only forwards requests and checks results:
   • It does not write your materials to disk or a database, and does not log them.
   • To confirm that requests come from the genuine App on a given device, and to limit how often each device can generate (currently at most 3 a day and 2 a month per device, 3 in all during a new installation's first 7 days; Ask AI 5 messages a day while you are on a trip, 2 on other days), it keeps a "device record". Every installation of the App has one: the App registers with the server the first time it is opened, whether or not you later use the AI features. The record is named by a cryptographic hash (HMAC) of the App Attest key ID; the original ID is not stored. It contains the public key and signature counter of that device's App Attest key, the time the record was created, the install source (TestFlight, App Store or development build, which the App reads from its own install receipt when it registers), and the number of generations today and this month. It contains no material content, trip name, name, contact details, or IP address. The whole record is deleted automatically 90 days after it was created (the App then registers again).
   • "How did you hear about us": the first time you open the App, it asks once where you heard about it (App Store search, Xiaohongshu, note / Zenn, X, a friend, a trip someone shared, other); you can skip it. Only the option you choose is sent, never any text. The server notes "answered" in the device record (one answer per installation) and adds the option to that day's totals. The totals only say which day, which version of the App (personal / public), which install source (TestFlight / App Store / development build), which option and how many, are not stored with device record IDs, and are kept for 2 years; the "answered" mark is deleted with the device record after 90 days.
   • From these device records we add up, per day, the total use across all devices (for example how many generations and Ask AI messages there were that day, optionally split by install source), to understand overall use and control costs. The totals do not include device record IDs, and the App does not upload anything extra for this.
   • For the overall budget cap, the server also records the total AI cost per day across all users. This figure is not linked to any device or content.
   • Operational logs: one line each time a device is registered or a generation runs, containing the outcome and error code (with a short technical reason when verification fails), the install source, the model and processing region used, the number of materials and their total character count, token counts, cost, processing time, why the AI stopped, the number of items generated and how many of them need your check, whether the use was refunded, and the time of the entry. They do not contain material text, file names, the trip name, request or trip numbers, the device record value, or IP addresses. They are deleted within 7 days.
   • We do not record your IP address. To prevent abuse (at most 40 Ask AI messages and 6 generations a day per network), the server keeps only a cryptographic hash (HMAC) of the day's date and the IP address, with that day's count and spend; not the IP address itself. The hash changes every day. To spot abnormal use, the server also keeps each day's spend under a shortened device record ID. All of this is deleted after 2 days. Cloudflare processes IP addresses and other connection data to deliver requests to our server, under its data processing agreement with us.
2. Anthropic, PBC (United States) uses its Claude models to organize your materials into an itinerary. We use Anthropic's commercial API, which is governed by Anthropic's Commercial Terms of Service and Data Processing Addendum:
   • The model runs on servers in the United States.
   • Anthropic does not use this content to train models (Anthropic: https://privacy.claude.com/en/articles/7996885 ).
   • Anthropic automatically deletes API inputs and outputs within 30 days of receiving or generating them. Exceptions: it may keep them longer to enforce its usage policy or where the law requires; inputs and outputs its automated systems flag as violating its usage policy are kept for up to 2 years, and trust and safety classification scores for up to 7 years (Anthropic, updated 2026-07-01: https://privacy.claude.com/en/articles/7996866 ). We do not use services where you control retention yourself (such as the Files API).
   • We send Anthropic only fixed instructions for the AI, the materials (names and full text) and the trip name, without the device record value or any other identifier that could identify you.

4. What is sent when you use Ask AI

Before you use Ask AI for the first time, the App explains this and asks for your separate consent. If you do not agree, nothing is sent and the rest of the App works as before.

What each message sends

• Your question, and any original text you paste in (for example, a message from your hotel).
• Recent conversation: the text of up to the last 10 questions and answers in this conversation (cards in the AI's answers are included as text). Older turns are not sent.
• The trip you have open: each day's date and time zone; each item (time, title, place, description, your note, whether it is booked); stays; to-dos; and the changes you made on your device. For your other trips, only the title, dates, cities and the titles of each day's items are sent, not their details.
• Traveler profile (if you filled it in under Settings): passport nationality, country of residence, residence status and visa, each as a short description. Passport numbers are not sent.
• Time information: today's date and time zone on your device, the current time, and which screen you opened Ask AI from.
• Photo (only when you attach one to that message): sent at reduced size, with extra information in the photo (such as where and when it was taken) removed. It is sent with that message only.
• Location (only when you tap Send my location): accurate to about 1 km (latitude and longitude kept to 2 decimal places); a location older than 30 minutes is not sent. It is sent with that message only.
• Request and anti-abuse information: a random message ID, the App's name and version, your consent record, and the same Apple App Attest signature as for Generate (see Section 3).

What is stopped: numbers that look like a bank card number, and text that names a passport followed by a number or matches common passport number formats, are stopped by your device or our server and not passed to the AI. Not every way of writing them can be recognized, so please do not put card or passport numbers in messages.

Passed to Anthropic: everything above except the request and anti-abuse information, plus fixed instructions for the AI. No device ID or anything else that identifies you is attached.

Web search: to answer questions about things that change, such as opening hours, rules or routes, the AI may use the web search and web page features provided by Anthropic. The AI writes the search terms from your question (they may include place names, shop names and dates), and the search runs on Anthropic's side; our server only receives the results. Search terms do not include your full trip, your photo or your coordinates (the AI is instructed not to put coordinates into search terms).

Weather: when the AI looks up the weather, our server sends a city name, or the location you sent (accurate to about 1 km), to the weather service Open-Meteo (OpenMeteo GmbH, Switzerland) to look up the city's coordinates and get that day's forecast. Nothing else is sent. Under its terms, Open-Meteo may keep server logs (including IP addresses and the coordinates in requests) for up to 90 days; the request comes from our server, not your device (Open-Meteo terms: https://open-meteo.com/en/terms , checked 2026-11-02).

What our server keeps

• It does not store your questions, conversation, trip, photos or location, and none of this is written to logs.
• For per-device limits on use and cost, the "device record" described in Section 3 holds, per day (UTC date): that day's total AI cost, how many messages were sent, how many times the web was used, and how many answers were off-topic or refused. A message being answered has a temporary entry (up to 30 minutes). So that a resend after a dropped connection is not counted twice, an encrypted hash of the message ID is kept for 1 hour. None of these contain content. The per-day counts are kept for 90 days (for statistics and abuse prevention; they include how many messages were refused on trip days and on other days), and the whole device record is deleted 90 days after it was created.
• Operating logs: one line per message with the result, the length of the question and conversation, how many past turns were included, whether a photo or location was attached (not the photo or coordinates themselves), which AI features were used, the kinds and number of cards, token counts, cost, duration, error codes and the install source. No text content, IDs or IP addresses. Kept for up to 7 days.

"Report this answer" email: below every AI answer there is "Report this answer". Tapping it opens the mail app on your phone with the recipient (zguo415@gmail.com), subject and body filled in. The body contains the first 1,500 characters of that answer, the answer's ID and the App version; it does not contain your question, earlier messages, photos, location or trip content. The answer itself may mention dates, places or shop names from your trip. Before sending you can edit or delete anything in the body, or not send it at all. If you send it, we'll review it as soon as we can. We receive the email and your email address and use them only to find out what was wrong with the answer, to reply to you and to improve Ask AI; we keep it for up to 12 months after handling it, then delete it.

Clearing a conversation: clearing a conversation in the App deletes it and the photos you sent from your device. Our server never stored it; what was already sent to Anthropic is deleted within the periods in Section 3.

5. Why we process this information

• To generate your itinerary from your materials and check that the result matches the original text, and to answer your questions in Ask AI.
• To prevent abuse and control costs (confirming requests come from the genuine App, per-device limits and an overall budget cap).
• To investigate service problems.
• To handle the reports and questions you email us, reply to you, and improve generation.

We do not use this information for advertising, marketing, or profiling, and we do not sell it to anyone.

6. Transfer to foreign countries (United States, Switzerland)

Under Article 28 of Japan's Act on the Protection of Personal Information (APPI), we ask for your consent before providing personal data to a third party in a foreign country, and tell you the following:

• Countries: the United States (where Anthropic processes the data), and, when Ask AI looks up the weather, Switzerland (Open-Meteo). Cloudflare (a US company) runs data centers around the world, and each request is handled by the one nearest to you; which one is decided each time by where you are and by network conditions, so the country cannot be determined in advance. For reference, our data processing agreement is with Cloudflare, Inc., a US corporation.
• The US personal information protection system: there is no comprehensive federal privacy law; instead there are sector-specific laws (for example health, finance, and communications). Some states have comprehensive laws, such as the California Consumer Privacy Act (CCPA). The United States joined the APEC Cross-Border Privacy Rules (CBPR) system in 2012. See Japan's Personal Information Protection Commission page on the United States: https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/
• Switzerland's personal data protection system: Switzerland has the Federal Act on Data Protection (FADP), supervised by the Federal Data Protection and Information Commissioner (FDPIC). Only a city name or coordinates accurate to about 1 km are sent to Open-Meteo, nothing else.
• Measures taken by the recipients: Anthropic and Cloudflare each have a data processing agreement with us, process data as processors on our instructions, and maintain technical and organizational security measures. Anthropic may not use this content for training and deletes it within the periods in Section 3. Only a city name or coordinates accurate to about 1 km are sent to Open-Meteo, by our server (not your phone); under its terms Open-Meteo may keep server logs (including IP addresses and the requested coordinates) for up to 90 days. All transfers are encrypted (HTTPS). Open-Meteo has no data processing agreement with us. We cannot confirm whether it takes measures equivalent to those required by Japan's Act on the Protection of Personal Information.

7. Withdrawing consent and deleting data

• Withdraw consent: Settings › AI organizing › Withdraw consent (for Ask AI: Settings › Withdraw consent for Ask AI). After that, no materials or messages are sent; to use these features again you will be asked to consent again.
• Materials and messages already sent: our server did not store them, so there is nothing for us to delete. Anthropic deletes them automatically within the periods in Section 3. We currently have no way to make Anthropic delete a particular request early.
• Data on your device: delete the trip in the App, or delete the App. Delete files in your iCloud Drive folder with the Files app. You can clear the on-device usage statistics in Settings › On-device usage statistics. To delete a ticket or file, long-press it in Tickets and files › Delete; the copy on your device and the backup in the iCloud folder are deleted together.
• Exporting your data: Settings › Export all data puts all your trips (including the problems you reported), the trip list and the on-device usage statistics into one .zip file, which you save or share yourself.
• Device record: deleted automatically within 90 days. It contains nothing that identifies you, so we cannot tell which record is yours.
• Emails you sent us: you can ask us by email to delete them.
• Other requests: you may ask us to disclose, correct, delete, stop using, or stop providing information about you, or to tell you our purposes of use, by emailing zguo415@gmail.com. We will respond within a reasonable time, free of charge.

8. Security

• Connections between your device and our server, and between our server and Anthropic and Open-Meteo, are encrypted (HTTPS).
• The AI service API key is stored only on our server, never in the App.
• Apple App Attest is used to confirm that requests come from the genuine App.

9. Children and minors

The AI features (Generate and Ask AI) are only for users aged 18 or older. The App is not directed to children under 13, and we do not knowingly collect personal information from children.

10. Changes

When we change this policy, we will update the effective date above. If a change affects what is sent, who receives it, or how long it is kept, the App will ask for your consent again before you next generate or use Ask AI.

11. Contact

• Operator: Ziyu Guo (individual developer, Japan)
• Email: zguo415@gmail.com
• Address: provided promptly on request, as permitted under the APPI.

This policy is available in Chinese, Japanese, and English.