Awaybo

Privacy

Awaybo 0.1, a TestFlight prototype.

What we store

• Your Apple ID user identifier, from Sign in with Apple. Not your email address.
• The name you give, your home currency and, if you set it, your passport country.
• A sign-in token for each phone you sign in on. We keep only a hash of it. Signing out deletes it.
• Your trips: name, dates, currency, and who the trip is shared with.
• What you add to a trip: flights, stays, plans, expenses, settlements, packing items and journal entries, with the photos and PDFs you attach.
• Invite codes you create. They work for 14 days.
• How many reads (100 a day) and flight lookups (20 a day) you used today, and how many AI requests you made each day, kept for 60 days. Not what was in them.

Travel documents

Document numbers and scans are encrypted on your iPhone with a key kept in your iCloud Keychain before they are uploaded. The server stores only the encrypted data and cannot read it. The type, issuing country, expiry date, label and first name are stored as is, so reminders work on a new phone. Documents are never shared with trip members and never sent for reading. If iCloud Keychain is off, a backup can't be restored on another phone.

Reading bookings

When you tap Read, the images or text go to the reader model, Cloudflare Workers AI or Anthropic, which returns the bookings it found. Awaybo does not keep what was sent for reading. Only what you save is stored.

Flight status

Flight routes and positions come from public sources: adsbdb, adsb.lol and the OpenSky Network, and AeroDataBox when it is turned on. They get the flight number or the aircraft code, never who is on the flight. One status is shared by everyone on that flight.

Weather and rates

Weather comes from Open-Meteo for a place and dates, rounded to about 10 km. Exchange rates come from Frankfurter and currency-api once a day. Neither gets anything about you.

Shared trips

Everyone who joins a trip sees its flights, stays, plans, expenses, packing list and members' names. Journal entries are private unless you share them. Anyone with an invite link can join until it expires.

Where it lives

Data is stored with Cloudflare (D1 database and R2 storage). Cloudflare keeps request logs for a short time for debugging. We do not log documents, bookings or receipt text. No ads, no tracking, nothing sold.

Deleting

Settings, Delete account removes your account, sign-ins, documents, private entries and your place in every trip. A trip only you are in is deleted with everything in it. A shared trip stays with the others, including what you shared, shown as by a former member. The oldest remaining member becomes its owner.