Privacy policy

The short version

Your trips live on your device. There are no analytics, no ads and no tracking. An account is optional: the app is complete without one, and everything leaves your phone only when you choose it — publishing a trip, signing in, asking the assistant, or adding events to your calendar.

On your device. Every trip is a JSON document in the app's own storage (and in iCloud only if your device backs the app up). Loco never uploads it unless you publish it.

Travel documents. Passport and ID details you keep in Settings → Documents stay on your device, in its Keychain, and reach your other devices only through your own iCloud Keychain. They are never sent to Loco’s servers or to the assistant, and a passport scan is read on the device without keeping a photo.

On our servers, when you publish. Tapping Publish this trip stores a copy of that trip document on Loco's servers, hosted by Supabase in the European Union (region eu-west-1). A published trip has an owner and an audience. Some audiences are unguessable links (capability tokens) you choose to share: whoever holds such a link can do what it allows — a co-traveller link shows the plan and can vote, a family link shows only which city each traveller is in on each day. Treat those links like keys. Other audiences are people: the ones you invite, the accounts that follow you, anyone signed in, or everyone. You pick that per trip and can change or revoke it at any time.

Votes. When someone votes on a proposal, the vote is stored with the person name they picked in the app (for example "Mira"), the option and an optional comment. Nothing else identifies them.

The app works without one. Trips, the timeline, the map, the calendar export and opening a share link all work signed out. An account exists so that a trip can have an owner, so people can be named rather than holding a link, and so Loco can tell you that someone you follow will be in the same city as you.

What we store. Your e-mail address, kept by Supabase Auth so a six-digit code can be sent to it — there is no password. A profile: a handle (for example @nina), and optionally a display name, a colour, a short bio and a home city. Which trips you own or belong to. Who you follow, and who follows you. Invitations you send, which contain the handle or e-mail address you invited. For an e-mail invitation Loco stores that address, the access it gives, and whether the message was sent and accepted, so it can deliver and track the invitation; the address goes to Mailgun to send the message (see Who processes your data) and is deleted with the trip or with your account. Requests you make to open someone else's trip, with the note you wrote. If you set up Residency while signed in: the rules you follow, their start dates and the countries you lived in, with dates — readable by you alone, never by the people you travel with or who follow you.

Encounters. If two people follow each other, Loco compares the plans they can already see and records when they will be in the same place on the same day, so it can tell them. It is arithmetic on trips you wrote, not on where either phone has been.

Deleting it. Settings → Account → Delete account removes the account, the profile, the follows, the invitations and everything the account owns, including trips it published. It is immediate and it is not recoverable.

Gmail, if you connect it. Settings → Bookings from mail → Connect Gmail asks Google for read-only access to that mailbox (the gmail.readonly permission). Loco then looks only at messages that match a booking search — confirmations from booking sites, carriers and hotels, messages with words such as “confirmation” or “e-ticket” in the subject, not newsletters — once for the last twelve months, then new ones as they arrive. Messages that do not match are never fetched. You can connect more than one mailbox, including one that is not your Loco sign-in address.

Why. Only to turn your booking confirmations into trip proposals, which you accept or decline in Inbox. Nothing is added to a trip until you accept it.

What we keep. The bookings read out of a message (dates, places, times, references, prices — what becomes a card or a trip), and for each message its subject, its sender and a short preview of up to 400 characters, so you can see what became of it. The message itself and its attachments are not stored. To read a booking out of a message, its text and any PDF or image attached to it are sent, through Fabrique Futur’s own accounts service, to our AI provider (OpenAI, through its API, which does not use it to train models), and nowhere else.

Your Google access. Google gives Loco a refresh token for that mailbox. It is stored encrypted (Supabase Vault) on our servers and used only by our server to fetch the matching messages. Disconnect in the app revokes the access at Google and deletes the connection and the subjects, senders and previews of the messages it read; bookings you already accepted stay in your trips. The token itself is deleted once Google confirms the revoke; until then it stays encrypted and we keep retrying the revoke, and it is used for nothing else. You can also remove Loco’s access at any time at myaccount.google.com/permissions. Deleting your account removes all of it.

Limited Use. Loco’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Gmail is used only to provide this feature. It is not sold, not used for advertising, not used to train AI models, and not read by people — except with your consent, for security purposes such as investigating abuse, or to comply with the law.

Forwarding instead. If you forward confirmations to trips@mail.fabriquefutur.com instead, Loco reads only what you forward and keeps the same things about each message as above. No access to your mailbox is involved.

Chat. When you write to Loco’s assistant — typing, pasting a confirmation, sharing into the app, or attaching a screenshot or PDF — the message, its attachments and the trips it needs to answer are sent to our servers and, through Fabrique Futur’s accounts service, to our AI provider (OpenAI, through its API). The conversation is kept with your account so you can come back to it, and only you can read it. The assistant proposes; nothing changes in a trip until you accept a proposal. The assistant needs an account.

Voice. When you talk to Loco, your voice goes from your phone directly to OpenAI’s realtime API, using a short-lived key our server issues for that one conversation, together with a summary of the trip so it can answer. Loco does not record or keep the audio or the transcript: the transcript lives on your phone for the length of the conversation.

Translation. When somebody who may edit a trip kept on our servers reads it in a language other than the one its titles were typed in, the trip’s title and its events’ titles are sent, through Fabrique Futur’s accounts service, to our AI provider (OpenAI, through its API) to be translated into that language. Before a title leaves our server, booking references, access codes, addresses, links, e-mail addresses, all-caps codes and every word containing a digit are replaced by placeholders, so they are not sent. Only titles are sent — not notes, documents, prices or the rest of the trip — together with the name of any of the trip’s people a title mentions and how that name is spelled in the target language, so it comes out in that language’s script; never the trip’s whole list of people or a surname no title carries. The translation is stored on the trip next to the title as typed, so everyone who reads the trip in that language sees it; the title as typed is kept and shown on the event’s detail, and once a title is edited its old translation is no longer used.

Near me. When you ask what is near you, the app asks for your location at that moment, finds the places around you on your phone, and sends our server those places — each with its own coordinates and its distance from you. Your own position is not sent, but from those places and distances it can be estimated where you were at that moment. We keep each such set of places with your account for 30 days, so you and the assistant can reopen the picks; no other Loco user can see it. It is deleted after 30 days, or at once when you delete your account. This is the only location data Loco keeps on its servers.

Loco does not sell your data. These services process it for us, on our instructions and only to run the feature you used. They do not use it for advertising or for their own purposes, and they are the only services that receive it — apart from the Gmail access you choose to connect (see above), and the audiences you choose when you publish. Each name links to the service’s own privacy page.

Supabase. Hosting, database, file storage and sign-in codes, in the European Union (eu-west-1). Everything you publish or sign in with is kept there: published trips, your account and profile, chat, moments and photos, invitations (including the e-mail addresses invited). Standard server logs (IP address, time, requested URL) are kept for a short period to operate the service. Privacy page.

Fabrique Futur accounts service and OpenAI. The assistant, the city guide and place ideas, reading bookings from mail, voice and translating titles. Our accounts service, which Fabrique Futur runs, passes your request to OpenAI’s API (voice goes from your phone to OpenAI directly, as described under The assistant): the text you send, any attachments, and the trip details the feature needs to answer (or, for translation, a trip’s masked titles). OpenAI’s API does not use this data to train models. Privacy page.

Google Maps (Gemini). Looking up a venue. When the assistant or place ideas need a venue’s address and map link, our accounts service sends a short search text — the venue’s name and town and, when the plan has one, the coordinates of a place near it — to Google’s Gemini API with Grounding with Google Maps. The conversation, your name and your account are not sent. Privacy page.

Google Maps Platform (Places API). Details of places to eat and to see — Google’s rating, opening hours, price level, photo, phone and website. When you ask what is near you, our accounts service sends Google the middle of the places your phone found, rounded to about 100 metres (an approximate area, never your exact position), and the places’ names; for a place that search does not find, that place’s own name and its coordinates, rounded the same way — what our own server keeps is described under Near me above; for the city’s ideas, a place’s name, address and city. Your name and your account are not sent. Of Google’s data we keep only its identifier of each place; the area point and Google’s details are not stored — they are fetched again when you open the places. Photos load from Google directly. Privacy page.

Mailgun. E-mail. When you invite someone by e-mail, Mailgun sends that one message: the recipient’s address, your name as the inviter, the trip’s title and the invitation link. It also receives confirmations you forward to trips@mail.fabriquefutur.com and hands them to our server. Privacy page.

Open-Meteo. Weather forecasts. The app asks for the forecast at a city’s coordinates, and our server looks up the coordinates of city names the assistant adds to a trip. Nothing that identifies you is sent: no account, name or device id — though, like any server, it sees the IP address of the request. Privacy page.

OpenFreeMap. Map tiles. Drawing the map requests the tiles of the area on screen; no account or device id is sent, only the request itself, which carries your IP address. Privacy page.

Wikipedia and Wikimedia Commons. Photos for place ideas. Our server asks for a freely licensed photo by the place’s name; nothing about you is sent. Privacy page.

Google and Apple sign-in. Identity, only if you choose to sign in with them. Google or Apple confirms who you are and gives Loco your e-mail address and, if you allow it, your name; Apple may give a relay address instead of your own. Privacy page.

Apple Push Notification service. On iPhone, notifications (an invitation, a reply, a booking waiting in Inbox). It receives your device’s notification token and the text of the notification. Android has no push service. Privacy page.

With your permission, Loco adds the trip's flights, stays and events to the calendar you choose and keeps them up to date. It reads your calendar only to find the events it created earlier and to avoid duplicating a flight your mail app already added. It does not read anything else, and nothing from your calendar leaves the device unless you turn on Calendar for agents, below.

Calendar for agents. Off for every calendar until you choose. For each calendar you can pick Off or Busy only. At Busy only, the app on that iPhone or Mac uploads a copy of that calendar’s events from yesterday to 60 days ahead that says only when each starts and ends and in which time zone. It never uploads an event’s title, place, attendees, notes, links or organiser, and calendar and event identifiers leave your device only as one-way hashes. Each device keeps its own copy. The copy is kept on your account, readable only by you; an app you have connected to Loco, such as an AI assistant, reads it when you ask whether you are free, and cannot change it. If you turn on a booking page, it uses the copy to leave out the times you are busy; visitors see only the free times it offers, never your events. It is a copy as of that device’s last upload, not your live calendar. Setting a calendar to Off on a device deletes that device’s copy from our servers at once, and deleting your account deletes all of it. A device that has not uploaded for 7 days no longer counts, and its copy is deleted at the next upload from any of your devices. Signing out stops the uploads but does not delete the copy; turn the calendars Off first if you want it gone. The retired Loco 2 app could also upload each event’s title and place (its Full level). Loco 2 no longer runs, and no copy it uploaded is left on our servers.

What it is. You can connect an AI assistant you already use, such as Claude or ChatGPT, to your Loco account (how it works). You do it yourself: the assistant opens a Loco page, you sign in and press Allow. Until then nothing is connected. The assistant acts as you, with the access you have on each trip, and never sees a trip you are not on.

What Loco sends to it. Only what a tool returns when the assistant calls one: your trips and your role in each; the contents of a trip you are on (stays, moves, events, tasks, notes, open questions and their options, the people and where they are), whole or for a window of days; your agenda, meaning busy, free and to-do time across your trips; where the people you follow are, as far as their plans let you see it; the link to your booking page; and the messages of a trip’s chat when the assistant reads it, which everyone on that trip can already read. If you turned on Calendar for agents, the answer also includes the calendar entries you chose to share, at the level you chose there (Busy only: the start and end of each event). A calendar left Off is never sent.

Who receives it. The company behind the assistant you connected, such as Anthropic for Claude or OpenAI for ChatGPT. It receives what Loco returns as part of your conversation with it and handles it under its own privacy policy and the settings of your account with it. It is not one of the services listed under Who processes your data: you chose it, and Loco has no say in what it does with your conversation. Loco does not receive that conversation. It receives each tool call (which tool, and what the call carries, such as a trip, a day or the text to add) and keeps no copy of what it returned: our logs record only which app called which tool, whether it worked and how long it took.

What the assistant can change. It can add an item to a day, add or propose options, accept or decline an option when you tell it to, create a trip, and write to a trip’s chat. Those are stored in your trip like anything you write yourself, under your name. A message it posts to a trip’s chat is visible to everyone on that trip, and Loco’s own assistant may answer it, as described under The assistant. The connector books and pays nothing, sends no invitations, shares nothing with other people and deletes no trip.

How long. Loco records each item the assistant adds to a day or writes into a trip — what changed, when, and which app did it — and lets you undo it for 7 days; after that the change is part of your trip like any other. Options, decisions, new trips and chat messages are saved like anything you do yourself and are not undone this way: remove them in the trip. The access token an assistant holds lasts one hour.

Your controls. In Settings, under Connected apps, you see every assistant that has access and press Disconnect. That revokes its access and ends its session at once; it can be connected again later. Turning a calendar Off in Calendar for agents deletes its copy, as described under Your calendar. To remove what an assistant wrote, delete it in the trip, or undo an item it added within the 7 days.

No analytics or crash-reporting SDKs. No advertising. No location tracking: "where everyone is" comes from the plan you wrote, never from GPS — the trip journal and “near me” ask for your location only when you turn them on or use them. If you turn on the journal’s visits and allow it, it notes the places you stop at in the background; the journal keeps its visits and routes on your phone and never sends them to us. Near me does send the places found around you, each with its distance from you, and keeps them with your account for 30 days; from them your position at that moment can be estimated (see Near me above). No password: signing in is a six-digit code sent to your e-mail. No selling of data, no advertising and no sharing of it with anyone for their own purposes: the services listed under Who processes your data act on our instructions.

A connected Gmail mailbox: Settings → Bookings from mail → Disconnect (see above). Delete the trip in the app: that removes it from your device, and if it was published, Stop sharing in the Share screen deletes it from our servers together with its votes. Items removed from a published trip — events, stays, journeys and their legs, proposals — are kept on our servers for 30 days in Recently deleted, so that you or a co-editor can restore one; after 30 days they are deleted for good, and deleting the trip or your account deletes them with it. If you have an account, Settings → Account → Delete account removes it and everything it owns. If you no longer have the app, email us the share link at dev@fafutur.com and we will delete the trip.

Loco is not directed at children under 13 and does not knowingly collect information from them.

If this policy changes, the new version is published at this address with a new date.

Fabrique Futur LLC · dev@fafutur.com