Last updated: 26 September 2026
This page describes which personal data TravelThread processes, why, for how long, and how you can exercise your rights. It is written to be clear and complete; it is not a substitute for legal advice.
Iona Cancelli (a natural person), who runs TravelThread in a personal capacity. Contact for any privacy request: murmillo98@gmail.com.
tt_session) that keeps you signed in, expiring after 30 days or when you log out.localStorage) together with an internal reminder that you were signed in. The browser also caches the app's files so it works offline; server responses containing your data are never cached.We do not collect the device's GPS location, we do not use profiling or advertising cookies, we show no ads, and we use no statistical analytics or third-party tracking services. Fonts are served directly from our own site, without contacting external services.
We do not use your data for marketing, we do not sell it and we do not pass it on to third parties for their own purposes. We do not profile you or make automated decisions about you.
From the profile menu you can turn on a public read-only link showing your map and aggregate statistics (countries visited, including those where you ticked a milestone, and year of visit; never notes, hotels, restaurants, exact cities or precise dates). The link contains a random, unguessable code; anyone who receives it can view it without an account. You can turn it off at any time: the old link stops working immediately and, if you turn it back on, a new one is generated.
We rely on two technical providers, acting as processors:
These providers may process data outside the European Economic Area, in particular in the United States. For Vercel, transfers rely on the European Commission's Standard Contractual Clauses, included in its Data Processing Addendum. No one else has access to your data. If you install the app from the Google Play Store, Google processes store-related data (for example the installation) under its own policy: we do not receive data from your Google account.
Account data, trips, milestones and preferences are kept as long as your account exists. If you delete your account they are removed immediately from the production database; they may remain for a limited time in the provider's technical backups and are then removed from there too. Sessions expire after 30 days or on log-out. Abuse-protection counters only last for the length of the checking window.
Passwords are protected with a salted hash (never stored in plain text). The session cookie is httpOnly and Secure, so page scripts cannot read it and it only travels over HTTPS. All communication uses HTTPS. We limit sign-in attempts and sign-ups. No system is 100% secure: if we became aware of a data breach affecting you, we would notify you as required by law.
TravelThread is not intended for users under 16 and we do not knowingly collect data from children. If you think a child has signed up, write to us and we will delete the account.
There is no automatic password recovery yet. If you forget your password, write to us from the email address you registered with: we will verify the request before acting.
If anything changes in how we process data, we will update this page and the date at the top.
Questions, requests about your data or deletion requests: murmillo98@gmail.com.