Privacy Policy

01Who is responsible

Parapegma is published by Vambran Studio, which is the data controller for the purposes of the UK and EU General Data Protection Regulation. Write to vambranstudio@gmail.com about anything on this page.

02There is no account

There is no sign-up, no password, no email address and no social login. Nothing you do in the app is filed under a person, because the app does not know that a person is there.

The consequence is worth stating plainly rather than burying in section 15: we cannot show you “your data” on request, because there is no “yours” for it to be filed under. That is a result of collecting very little, not a way of avoiding the question.

Cloud backup does not change this. It files your trips under a random number your phone invents, which is not a sign-up, carries no name and is not linked to anything else — see section 4. We cannot tell whose it is, and neither can anybody else who has not been given the number.

03What stays on your phone

Held in a database inside the app, readable only by the app, and sent nowhere by us:

• Your trips — names, dates and cities; each day and each leg, with its operator, service number, departure and arrival times and time zones; fares, including any you corrected yourself; whether you marked something as booked; and any note a suggestion arrived with.
• Your settings — home city, the city a trip starts from, preferred currency, language, light or dark, and whether you have already seen the first-run tour.
• The last search you made, so that reopening the app resumes where you left off.

With cloud backup off — which is how the app arrives — deleting the app deletes all of it. There is no copy of it on any server of ours, and no way to recover it afterwards. Switching backup on is what changes that sentence, and section 4 is the whole of what it changes.

One honest caveat: your phone’s own backup — iCloud on iOS, Google’s backup on Android — may copy this database along with everything else it backs up. That copy is held by Apple or Google under their terms and controlled by you in your phone’s settings, not by us.

04Cloud backup, if you turn it on

It is off until you switch it on, in Settings, and nothing described in this section happens before you do. The app shipped saying your trips never leave the phone; backup is an offer, not a change of mind.

With it on, the app keeps a copy of what section 3 lists — your trips and your settings — on our worker, so that a new phone, or the same phone after a reinstall, can have them back. What is copied is what is on that list and nothing else: no name, no email address, no device identifier, no location.

It still has no account. The copy is filed under a random number your phone generates the first time you switch backup on — the “recovery code” Settings shows you. That number is the only key to it. Anyone who has it can read the trips filed under it, which is why it is worth keeping to yourself, and why it is the only thing you need in order to get your trips onto another phone. We cannot connect it to a person, because nothing that identifies one is ever attached to it.

So that a reinstall can find its own backup without you having kept anything, the app also stores a second random number — kept in your phone’s keychain, which survives deleting the app — alongside the first. We store only a one-way hash of it, so those records cannot be read backwards into a list of phones.

The copy is held in Cloudflare D1, on Cloudflare’s network, under the transfer terms in section 17. It stays until you delete it: Settings → delete my cloud backup erases every row of it, and the app then behaves exactly as it did before you switched backup on. Switching backup off stops new copies being made; deleting removes what is there.

05The app does not use GPS

Parapegma requests no location permission and cannot read your position, coarse or precise. It guesses which city you live in from your phone’s time zone, matched against the cities it already knows. If the guess is wrong, change it in Settings — your choice is kept, and choosing a city to fly into never overwrites it.

06What a search sends

When you search for trips, the app sends one request to our planner, which runs on Cloudflare Workers. It contains:

• the city or airport you are starting from
• the departure date, the number of nights, and today’s date
• how many people are travelling
• the currency you want prices in
• what you said matters, as fixed codes from a short list — not free text
• any cities you named, and the order you put them in
• whether you want direct flights only, and whether you are returning to the airport you left from

That is the entire request. There is no name, no account and no device identifier in it, because the app holds none to send.

Like every request on the internet it arrives carrying your device’s IP address, which Cloudflare sees and records as part of operating the service and defending it from abuse. We do not store it, and we do not attach it to anything.

07Where the search goes next

The planner asks other services on your behalf, so that your phone does not have to and so that our keys stay off it. Each is asked about places and dates. None of them is told anything about you, and none receives an identifier for you or for your device — they see our server, not your phone.

08Booking links, and how the app is paid

Parapegma sells nothing and takes no payment. When you tap a link to book a flight, a train, a ferry or a ticket, it opens that partner’s own search already filled in with the route, the date and the number of travellers, and we may earn a commission if you book there. It does not change your price, and it never changes how trips are ranked.

Those links carry two things. An affiliate marker, which identifies us and not you. And a short reference of the form placement~tripId~legId — where in the app the tap happened, and which trip and which leg it belonged to. Those two ids are random strings generated on your phone; they mean something to us and nothing to anybody else, and there is nothing about you in either.

From the moment the partner’s page opens, that partner’s privacy policy governs what happens — including any cookies they set and any tracking they do once you are on their site. We have no control over it and no view into it. The partners reachable from the app today are Aviasales, Klook, Tiqets, Hotellook, Booking.com, Ferryhopper, Kiwitaxi and Omio, reached through the Travelpayouts network.

We read a record of bookings back from that network — what was sold, its price, and our commission — so that we know which parts of the app actually pay for it. The network’s own record of a click also includes the IP address and country of whoever made it. Parapegma does not use those fields, does not store them, and never sends them to its analytics.

09Usage statistics

Anonymous, and collected to find out which parts of the app work and which are ignored. They are processed by PostHog, in the United States. What is sent:

• An anonymous identifier created when the app is installed. It is not your Apple or Google account, not an advertising identifier, and not connected to anything about you. Reinstalling the app produces a new one, unrelated to the old.
• Which screens you open and which controls you tap.
• Named events describing the shape of what happened — how many cities, how many nights, how many travellers, how long a search took, whether it found anything, which kind of link was tapped. The rule the code enforces is counts, flags and fixed codes, never the words you typed. Place names you enter are yours and are not sent.
• Your device and app — manufacturer, model name, operating system and version, app version and build number, language, time zone, and whether it is a simulator.
• An approximate location — country, region and city — which PostHog derives from the IP address the events arrive from. The IP address itself is not kept on the events.

Session recording is off, and stays off. Nothing you type is captured, no screen is ever recorded, and no profile is built — there is no identity here to build one on.

10Crash reports

When the app crashes, or survives an error worth knowing about, a report goes to Firebase Crashlytics, operated by Google: the stack trace, a short trail of what the app was doing beforehand, the device model, the operating system version, and the app version. Crashlytics generates its own identifier for the installation. No user identifier is ever set — there is none to set. Google keeps crash reports for 90 days.

11Updates

Parapegma updates itself in the background through Expo’s update service. Checking for one sends the platform, the app’s runtime version and the id of the version installed; Expo sees the IP address the check comes from. Nothing about your trips is involved, and an update never uploads anything from your phone.

12What is never collected

• No name, email address, phone number or postal address.
• No contacts, photos, calendar, files, microphone or camera. The app asks for none of those permissions.
• No precise or coarse device location.
• No advertising identifier. The app carries no advertising SDK, shows no adverts, and does not track you across other apps or websites.
• No payment details. Parapegma never takes a payment.
• Nothing is sold, rented, or shared with data brokers — not now and not as a change of plan later.

13How long things are kept

14Why we are allowed to do this

For anyone in the UK or the EEA, the legal bases under the GDPR are:

• Running a search you asked for — performing the service you requested by using the app.
• Usage statistics and crash reports — our legitimate interest in knowing whether the app works and where it breaks, held to the minimum described in sections 9 and 10, with no profiling, no advertising use and no identity attached. You may object to this at the address in section 1.
• Affiliate attribution — our legitimate interest in being paid for the work, using a reference that identifies a tap rather than a person.
• Cloud backup — your consent, given by switching it on and withdrawn by deleting it, both in Settings. It is the one thing in this policy that happens only because you asked for it.

15Your rights

Under the UK and EU GDPR you have the right to ask for access to your personal data, its correction or erasure, restriction of its processing, a portable copy, and to object to processing based on legitimate interests. You can also complain to your data protection authority — in the UK, the Information Commissioner’s Office.

How that works here in practice:

• Everything the app knows about your travel is on your phone. Delete a trip to erase it, or delete the app to erase all of it at once. You do not need our permission and you do not need to ask.
• If you switched cloud backup on, the copy described in section 4 is the one thing we hold that is genuinely yours — and you can see it in the app and erase it from Settings, in one tap, without asking us. That is access and erasure done properly, rather than by email.
• The statistics and crash reports carry no identifier that points back to you, so in most cases we genuinely cannot find a particular person’s records in order to show or delete them. Ask us anyway at the address in section 1 and we will tell you honestly what we can and cannot do.
• To stop usage statistics being collected at all, delete the app; nothing is sent from a device it is not installed on.

16Children

Parapegma is not directed at children, and is not intended for use by anyone under 13 — or under 16 where local law sets that age. We do not knowingly collect anything from a child. Because there are no accounts, we have no way to verify anybody’s age, which is one more reason the app collects as little as it does.

17Where the data goes

The services in this policy process data in the United States (PostHog, Google and Expo) and on Cloudflare’s global network, which may route a request through any country it operates in. Where personal data leaves the UK or the EEA, those transfers rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as incorporated into each provider’s terms.

18Changes to this policy

The date at the top of the page says when it last changed. If what leaves the app ever changes materially, this page changes first — a new provider or a new kind of data is a change to these words, not a footnote to them.

19Contact

Questions, objections, or anything on this page that does not match what you observe the app doing: vambranstudio@gmail.com.