explore
search

Privacy Policy

Last updated: September 27, 2026

Introduction

Travel Bounties ("we", "us", "our") operates travelbounties.com. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal information. By using Travel Bounties, you agree to the collection and use of information in accordance with this policy.

Information We Collect

We collect the following categories of information when you use Travel Bounties:

  • Account information: email address, display name, and avatar image URL.
  • Authentication: password (stored as a one-way hash, never in plain text), or third-party OAuth identity (Google, Apple).
  • User preferences: theme (light/dark/system), distance units (km/mi), and currency display preference.
  • Activity data: favorite bounties, trips you create (destinations, dates, itinerary), bounty completions, XP earned, and achievement progress.
  • Crash diagnostics: if the app fails unexpectedly, we collect the exception type, message, and stack trace, the app version, the platform it happened on (web browser, phone, tablet, or desktop), the operating system version, and the interface language — tagged with a random installation identifier and the time it happened. This never includes your name, email address, account identifier, IP address, or any content you created in the app. The installation identifier is random, is not linked to your account, and is reset when you clear the app's data, clear your browser's site data, or reinstall the app. Crash diagnostics are sent to our own API — never a third-party analytics service — and are retained for 90 days in Azure Application Insights, used only to find and fix crashes.
  • Feedback and prompt counters: to decide when to ask you for a note or invite you to rate the app, Travel Bounties counts a few of its own events (for example a bounty being completed, or the app going to the background) and keeps those counters in your browser's localStorage under waf.* keys (on the mobile app, in the app's own device storage instead). Daily totals of those events — numbers only, with no account, device or installation identifier — and any note you choose to send are transmitted to Words Are Flowing, a feedback service operated by Studio Mubold, the maker of Travel Bounties. Nothing there identifies you unless you type it into a note. A note contains the text you write and, if you give one, a rating, together with which moment in the app asked for it, the interface language, the platform (for example web, Android or iOS), and the versions of the app and of the feedback library. Travel Bounties sends no account identifier and no other details about you with a note. Because a note is not linked to your account, deleting your account does not delete it; notes are deleted automatically once they are two years (730 days) old.

We do NOT collect: IP addresses for tracking, advertising identifiers, device fingerprints, or browsing history.

The Android app shows ads, which involves one identifier we cannot remove — see Advertising below. It is not an advertising ID and it is not used to track you across apps or websites.

Location Data

The Explore feature can use your device's GPS (via the browser geolocation API) to show nearby bounties. Location is only accessed when you explicitly request it — never automatically. Your coordinates are sent to our server for a real-time query and are NOT stored, logged, or retained.

You can deny or revoke location permission at any time through your browser or device settings.

How We Use Your Data

  • To operate and provide the Travel Bounties service.
  • To authenticate your identity and secure your account.
  • To track your progress, XP, level, and achievements.
  • To send password reset emails when you request them.

We do NOT sell, rent, or share your personal data with third parties for marketing purposes.

Lawful Basis for Processing

We process your personal data on the following lawful bases under GDPR Article 6:

  • Consent: When you create an account, you consent to the collection and use of your data as described in this policy.
  • Legitimate interest: We process activity data (trips, completions, XP, achievements) to deliver the core gamification service you signed up for, in a way that does not override your rights and freedoms.

Third-Party Services

We use the following third-party services:

  • Google OAuth and Apple OAuth: For account authentication. We receive your email, name, and profile picture. Governed by Google's and Apple's respective privacy policies.
  • Resend: To deliver verification and password reset emails, and the friend-request and trip-invitation emails you send. It receives the recipient's email address and the display names and trip name shown in the email. Governed by Resend's privacy policy.
  • OpenStreetMap / CartoDB: Map tiles displayed in the app. These services may log tile requests. Governed by their respective privacy policies.
  • Unsplash: Images used for destination content. No user data is shared with Unsplash.
  • Google AdMob (Android app only): Serves the banner ad. Receives the App set ID, IP address, ad interactions, and ad diagnostics. See Advertising above.
  • Microsoft Azure: Hosts the app and its API. Azure Application Insights receives the API's operational telemetry (requests, errors, performance) and the crash diagnostics described under Information We Collect above.
  • MongoDB Atlas: Stores the application database.
  • Google Fonts: Delivers the fonts and icons the app uses; your browser requests them directly from Google. Governed by Google's privacy policy.
  • Words Are Flowing: collects the feedback and prompt counters described under Information We Collect above, and any note you choose to send. Operated by Studio Mubold, the maker of Travel Bounties.

Advertising

The Android app displays a single banner ad at the bottom of the screen, served by Google AdMob.

On the web, Google AdSense is being introduced. As of 2026-09-02 the AdSense library is present on the site but no ad slots are placed, so no ads are shown yet, and the site is awaiting Google's review. The library still loads Google code in your browser and Google may set cookies and receive your IP address, so it is disclosed here now rather than when the first ad appears.

  • Non-personalized only. We instruct Google not to personalize ads, and we do not enable Google's publisher first-party identifier. Ads are chosen from general context, not from a profile of you.
  • No advertising ID. The app removes the Android advertising ID permission, so Google's SDK cannot read that identifier.
  • One identifier we cannot remove: Google's SDK sends the App set ID, which Google marks as required. It is scoped to this developer and this app — it cannot follow you into other companies' apps — and it is reset if you reinstall the app or clear its data.
  • What Google receives: the App set ID, your IP address, whether you interacted with the ad, and diagnostic information about ad delivery. Google may use the IP address to estimate your approximate location (for example, your country) in order to serve appropriate ads and meet local legal requirements. We never send Google your account, email, name, trips, or any content you create.
  • Your choices in the EEA, UK and Switzerland: the app asks for your consent before requesting any ad, using Google's own consent dialog, and it will not request an ad if you decline. You can change or withdraw that choice at any time from Profile → Settings → Ad privacy options.
  • Google's handling of this data is governed by Google's Privacy Policy and its advertising terms.

We use no other ad network, and no third-party product analytics.

Data Storage and Security

  • Your data is stored in a MongoDB database hosted on secure infrastructure.
  • Passwords are hashed using BCrypt (industry-standard one-way hashing).
  • Password reset tokens are hashed with SHA-256 before storage.
  • Authentication uses JSON Web Tokens (JWT) with configurable expiry.
  • API endpoints are rate-limited to prevent abuse.

Your Rights Under GDPR

For users in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation:

  • Access: Request a copy of all data we hold about you (available via "Export My Data" in Settings).
  • Rectification: Update your display name, email, and preferences at any time.
  • Erasure: Delete your account and all associated data via Settings.
  • Data Portability: Export your data in a structured, machine-readable JSON format.
  • Object: Object to processing of your data.
  • Restrict Processing: Request that we limit how we use your data.

To exercise these rights, contact us at privacy@travelbounties.com. We will respond within 30 days.

Your Rights Under CCPA

For California residents, under the California Consumer Privacy Act you have the right to:

  • Know what personal information we collect and how it is used.
  • Delete your personal information.
  • Opt-out of the sale of your personal information — we do not sell personal information.
  • Non-discrimination for exercising your privacy rights.

Data Retention

  • Account data is retained for as long as your account is active.
  • When you delete your account, all associated data (profile, trips, completions, achievements) is permanently removed within 30 days.
  • Anonymized audit records (containing no personally identifiable information) may be retained indefinitely for compliance purposes.

Children's Privacy

Travel Bounties is intended for users aged 16 and older. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected data from a user under 16, we will promptly delete their account and data.

Browser Storage

We use your browser's localStorage to store: your authentication token (for keeping you signed in), your theme preference, your list/map view preference, and the feedback and prompt counters described under Information We Collect above (waf.* keys). These are essential for the service to function and do not track you across websites.

No third-party or tracking cookies are used, other than those the advertising services described in Advertising above may set. Words Are Flowing sets no cookies.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. For significant changes, we will notify you via email or an in-app notice.

Contact Us

For privacy inquiries: privacy@travelbounties.com

For general support: support@travelbounties.com