Privacy policy

Truce is a group trip-planning app. Using it means putting some personal information into it - who you are, who you are travelling with, where you are going and who paid for what. This page sets out exactly what that is, what we do with it, and what you can make us do about it.

This policy is written to be accurate about how the app actually behaves. Where something is a deliberate design choice with a privacy consequence, we say so rather than glossing it.

1. Who we are

The controller of your personal data is Liam Green, who builds and runs Truce (“Truce”, “we”, “us”). Truce is in the process of being incorporated as a company in England and Wales; this page will name that company, its registered number and its registered office as soon as it exists.

You can reach us about anything in this policy at privacy@truceapp.com.

Where Truce is available

Truce is launching in the United Kingdom, the United States, Australia and New Zealand. Because Truce is run from the UK, the UK GDPR governs how we handle personal data for every user, wherever they live, so you get the same protections and the same rights as someone in the UK. Section 14 adds what US state privacy laws ask us to tell you, and section 15 does the same for Australia and New Zealand.

We are not offering the app in the European Union yet, and the App Store will not list it in EU countries until we do.

Europe is next. When we open the app to EU countries we will appoint a representative in the European Union under Article 27 of the EU GDPR and name them here, before the first EU user signs up rather than after. If you are reading this from the EU, that has not happened yet.

2. What we collect

Account

Your email address, username, display name and, if you set one, an avatar image. If you sign in with Apple or Google we receive the identifier and email address those services give us - never your password with them. If you sign up with a password we store only a cryptographic hash of it. If you turn on two-factor authentication we store the factor needed to verify your codes.

Trips and planning

Trip names, destinations and their coordinates, dates, budgets, currency, who is a member and what role they hold, and invitations sent and accepted.

Content you and your group create

Nominations, votes, the notes you attach to a vote, poll questions and answers, packing-list items, itinerary entries, flight and stay details you enter, photos you upload, and documents you add to a trip's vault.

Money

Who booked what, amounts, how a cost was split, and settle-ups between members.

Any payment methods you choose to save so people can pay you back. That can be a payment-app username or link (PayPal, Venmo, Cash App, Zelle, PayID, Revolut, Monzo) or, if you add a bank transfer method, your bank account details - sort code, BSB or routing number and account number, or IBAN. Saving one is optional, and you can edit or delete it at any time in Settings.

We never see or store card numbers - purchases go through Apple, and subscription status comes back to us as an entitlement, not a payment detail.

If you scan a receipt to split a bill by item, the photo is sent to Microsoft Azure AI Document Intelligence, which reads the line items, total and currency and returns them to the app. We do not keep the image. It is processed and discarded, unless you tick “save receipt to documents”, in which case it is stored in that trip's document vault like anything else you put there.

Location

The coordinates of trip destinations and of the places nominated and won, so the day map and distance figures work. If you opt into scanning your camera roll for trip photos, the app reads the date and, where present, the location recorded in those photos on your device in order to suggest matches. Truce does not track your live location in the background.

Technical

A push-notification token and device platform if you enable notifications; diagnostic and crash reports; and the request data any web service necessarily handles, including IP address. When someone signs in to your account from a new device or location, we also work out roughly which town that sign-in came from, so the security email we send you can say so - see section 7.

Support and moderation

Messages you send us, and any report you make or that is made about you, including what was reported and when.

Your device

Some features ask your device for permission and then work locally. Turning on calendar sync creates a calendar named Truce on your device and writes your trip plan into it — that stays on the device and is never sent to us. The camera is used only when you scan a receipt; the photo library only when you pick an image or run the trip-photo scan; Face ID only to unlock the app. Home-screen widgets read a copy of your current trip held on the device itself. You can withdraw any of these permissions in your device settings at any time.

The app also keeps a copy of the trip screens you last opened on your device, for up to seven days, so they appear straight away next time instead of waiting for the network. It is deleted when you sign out.

Website

If you join the waitlist or use the contact form on truceapp.com, we receive the email address and message you submit. Nothing else - see section 13.

3. Why, and on what legal basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded it is not, because the processing is limited to what keeps the service working, safe and honest. You can object - see section 10.

Providing account and trip data is necessary to use Truce; without it there is no service to provide. Everything marked as consent above is genuinely optional and the app works without it.

4. Data you share with your group

Truce is a shared tool. Anyone who is an active member of a trip can see the other members' display names, usernames and avatars, and everything posted to that trip: nominations, votes and their notes, poll answers that are not anonymous, packing items, photos, documents, and the full ledger including who paid for what and who owes whom.

Payment methods you save are visible to everyone you share a trip with - on any trip, not only the one where a cost was split - so they can pay you back. That includes bank account details if you save a bank transfer method. Only save what you are comfortable those people seeing.

This matters when you delete your account. We remove you as a person, but we do not destroy the group's record. Your profile, uploads, notification tokens and saved payment methods are deleted outright. Entries the rest of the group are party to - a booking you paid for, a settle-up between you and someone else, a poll you created, a packing item you added - are kept but detached from you, and shown as belonging to a former member. If you were banned or blocked, a record of that also survives; see section 6.

We do this deliberately. The other members are data subjects too, and erasing the record of who fronted £400 for an apartment would rewrite their financial history without their consent. Your identity is removed; the group's arithmetic is left intact.

5. Photos, including of people who do not use Truce

Photos you add to a trip album are visible to every member of that trip. They are stored privately: not public, not indexed, and not shared beyond that group.

Holiday photos usually contain other people, and some of them will not be Truce users. When you upload a photo you are sharing other people's personal data with your group, and you are responsible for doing that reasonably - do not upload something the people in it would object to. If you appear in a photo on Truce and want it removed, contact us at privacy@truceapp.com and we will act on it, whether or not you have an account.

The camera-roll scan is opt-in and never uploads anything on its own. It looks at photos on your device, suggests ones matching the trip's dates and place, and waits for you to choose. You can revoke photo access in your device settings at any time.

6. Reports, blocks and moderation

If you report content or a person, we record who reported it, what was reported, which trip it was in, the reason you gave and any note you added, and we email it to ourselves so it can be reviewed. We aim to act within 24 hours.

If you block someone, that is recorded so we can stop them inviting you to anything. If someone is removed from a trip, that is recorded so they cannot rejoin through an old share link; re-inviting them clears it.

Moderation records are kept as records rather than as your personal data: if you later delete your account, a report you made is anonymised rather than destroyed, so a pattern of behaviour by someone else is not erased along with your profile.

One thing survives deleting your account if you are banned, removed from a trip or blocked: a scrambled one-way code made from your email address, and the date the ban ends. It holds no name, no address and no account, and it cannot be read back into your email address. It exists so that deleting an account and signing up again with the same address does not undo the ban. It is removed when a temporary ban ends, when a ban is lifted, when the block is undone or when you are invited back to the trip. Permanent bans are reviewed every year.

7. Who else sees it

We do not sell personal data, we do not rent it, and we do not share it with advertisers or data brokers. Running Truce needs a handful of specialist services. The ones below are our processors, each under a contract limiting them to acting on our instructions and never using your data for their own purposes - with one exception, MaxMind, explained under the table:

MaxMind also uses what we send it for its own purposes. When we email you about a new sign-in, we send MaxMind the network that sign-in came from: the first three parts of its IP address, such as 81.2.69.0 rather than 81.2.69.160, so never the address itself. MaxMind tells us roughly where that network is. Its terms also let it use what it receives, as an independent controller, to keep its location data accurate for its other customers, and to keep it after we stop using the service. We accepted that because the network is all it ever gets from us: we send no name, no email address and nothing that identifies your account. The full address appears only in the email to you.

On iPhone, place searches go straight from your phone to Google. In Discover's Food and Sights, and on a place's own page, Truce shows Google's own place cards. To draw them, your phone contacts Google directly rather than going through our servers, so Google receives your phone's IP address, what you searched for, the area you searched in and which places you opened. We add nothing that identifies your account: no name, no email address, no Truce ID. Google's software in the app may also send it technical information about the app itself, as listed in Google's privacy manifest for it. Everywhere else, including on Android, place searches go through our servers, and Google sees our server rather than you.

Three companies receive data but are not our processors. They decide for themselves what they do with it, under their own privacy policies, and we cannot answer for that part on their behalf:

• Apple - when you download Truce, buy anything inside it, or use Sign in with Apple. Apple is the seller for in-app purchases, so the payment relationship is yours and theirs, not ours. Delivering push notifications is the separate, instructed role in the table above.
• Google - when you use Sign in with Google. Your Google account is theirs and yours; we only receive the identifier and email address it returns. Its Maps and mailbox roles are the instructed ones in the table above.
• Viator - if you follow an activity through to booking. We send Viator nothing about you: the app asks it only what is on in a destination and when. Anything you enter once you are on their site goes to them directly.

Other screens link out to travel partners such as Skyscanner, Booking.com, Airalo and Heymondo. Following one of those links takes you to their site, under their privacy policy, and may earn us a commission. We do not pass them your personal data; the link carries only what is needed to prefill a search, such as a destination and dates.

We may also disclose data where we are legally required to, or where it is necessary to establish or defend legal claims.

8. Where your data is held

Your data lives in the European Union. Our database, sign-in and file storage are hosted by Supabase in Ireland - your trips, photos, documents and ledger are all held there. That is true wherever you use Truce from: if you are in the United States, Australia or New Zealand, your data is stored in Ireland, not in your own country.

Truce is run from the United Kingdom, so holding your data in Ireland is a transfer out of the UK. The UK has formally recognised the EEA as providing an adequate level of protection, so that transfer needs no further safeguard.

Some of the processors listed in section 7 are based in the United States. Where personal data reaches them, we rely on the safeguards in our contract with each one - the UK's International Data Transfer Addendum to the Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where that processor is certified under it - and we assess those transfers as the law requires.

9. How long we keep it

• Your account and content: for as long as your account exists. Delete it and the personal parts go immediately, with the exceptions described in section 4.
• Trips: for as long as the trip exists. Deleting a trip removes it and everything in it, for everyone.
• Cached place photos: automatically purged after 30 days.
• Scanned receipts: not stored at all, unless you choose to save one to a trip's document vault — then for as long as that trip exists.
• Support messages: for as long as needed to resolve the issue and a reasonable period after.
• Moderation records: long enough to identify repeat behaviour, then deleted. Reports are anonymised when the reporter deletes their account.
• Waitlist emails: until we have sent the launch email, or until you unsubscribe or ask us to remove yours - whichever is first.
• Marketing email consent: until you turn it off, unsubscribe, or delete your account. We then remove your address from the mailing list.
• Records we must keep by law, such as transaction records for tax: for the period the law requires.

10. Your rights

Wherever you live, you have the right to:

• Access - get a copy of the personal data we hold about you. The app does this instantly: Settings, then Download my data.
• Rectification - correct anything inaccurate. Most of it is editable in Settings.
• Erasure - have your data deleted. Settings, then Delete account. Read section 4 first, so you know what survives and why.
• Restriction - ask us to stop processing while a dispute about accuracy or legitimate interests is resolved.
• Portability - receive the data you gave us in a structured, machine-readable format. The export above is JSON.
• Objection - object to processing based on legitimate interests.
• Withdraw consent - at any time, without affecting what was done before. Notification categories are per-category switches in Settings; the camera-roll scan is revocable in your device settings.

Exercise any of these by emailing privacy@truceapp.com. We will respond within one month. We may need to confirm who you are first, so that somebody else cannot request your data.

You also have the right to complain to a supervisory authority. Truce is run from the United Kingdom, so ours is the Information Commissioner's Office (ico.org.uk). If you live in the United States you can also contact the attorney general of your state; in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in New Zealand, the Privacy Commissioner (privacy.org.nz). We would rather you told us first, but that is your choice, not a condition.

11. How we protect it

Every table in our database enforces row-level security, so a request can only ever reach trips you are a member of - applied at the database, not merely in the app. Sessions are stored in the device's encrypted keystore. Two-factor authentication is available. Sign-in endpoints are protected against automated attacks, and diagnostic reports are scrubbed of personal data before they are sent.

No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms, we will notify the supervisory authority within 72 hours of becoming aware of it, and tell you directly where the law requires, including under the data breach notification laws of US states. If a breach is likely to cause serious harm to someone in New Zealand, we will also tell New Zealand's Privacy Commissioner and the people affected as soon as practicable.

12. Children

Truce is not for children. You must be at least 16 to use it. We do not knowingly collect data from anyone younger; if we learn that we have, we will delete the account.

13. This website

truceapp.com sets no cookies, runs no analytics, and loads no third-party scripts until you use a form. Nothing about you is tracked here, which is why there is no cookie banner to dismiss.

The one exception: the first time you tap into the waitlist or contact form, we load Cloudflare Turnstile to check the submission comes from a person rather than a bot. It loads at that point and not before, so if you never use a form it never runs at all. It checks the request, not you, and is not used to track you across sites.

The only personal data this site handles is what you type into the waitlist or contact form. That is emailed to our inbox so we can reply or tell you about launch, and is used for nothing else. One preference - whether you chose the light or dark theme - is stored in your browser and never leaves it.

The site itself is hosted by Vercel, which sees each request - including your IP address - in order to serve the page and to receive a form submission. That is ordinary web-server logging, not tracking, and we do not build a profile from it.

14. If you live in the United States

Several US states give their residents specific privacy rights, including California (the CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut and Texas. Whether or not a particular law applies to a business the size of Truce, this is how we handle what they ask for. Nothing here takes away anything in the sections above.

What we collect, in the categories those laws use

We get this from you, from the members of trips you are in, and from Apple or Google if you sign in with them. We use it for the purposes in section 3, disclose it for those purposes only to the service providers in section 7, and keep it for the periods in section 9. One of those disclosures goes further than a service provider acting for us: MaxMind receives the network part of a new sign-in's IP address and may also use it to improve its own location data, as explained in section 7. We are not paid for it and send nothing else with it. We use sensitive personal information only to provide the service you asked for, never to infer anything about you.

We do not sell or share it

We do not sell personal information, and we do not “share” it for cross-context behavioural advertising, as those laws define both terms. We have not done either in the last 12 months, and that includes the information of anyone under 16. There is no targeted advertising and no profiling that produces legal or similarly significant effects. That is why there is no “Do Not Sell or Share” link: there is nothing for it to switch off. We also do not disclose personal information to other companies for their own direct marketing.

Your rights, and how to use them

You can ask to know and access what we hold, have it deleted, correct it, and receive a portable copy - the same rights as in section 10. Most of them work instantly in the app: Settings, then Download my data or Delete account. For anything else, email privacy@truceapp.com from the address on your account, which is how we confirm the request is yours.

• Someone acting for you. An authorised agent can make a request on your behalf with your signed permission. We may still check directly with you that you gave it.
• Appeals. If we turn a request down, reply to our answer to appeal. We will respond within 45 days, and if you are still unhappy you can contact your state attorney general.
• No penalty. We will not charge you more, give you a worse service or refuse you service for using any of these rights.

Do Not Track and Global Privacy Control

Truce does not track you across other companies' apps or websites, and does not let anyone else collect information about your activity on Truce to track you over time or across sites. A Do Not Track or Global Privacy Control signal therefore has nothing to change: we are not ignoring it in favour of tracking, there is simply no tracking for it to stop.

15. If you live in Australia or New Zealand

We handle your information in line with the Australian Privacy Principles under Australia's Privacy Act 1988, and the Information Privacy Principles under New Zealand's Privacy Act 2020. Nothing here takes away anything in the sections above.

• Privacy officer. Questions, requests and complaints go to our privacy officer at privacy@truceapp.com.
• Access and correction. You can see and correct what we hold about you, most of it straight from Settings. For anything else, email us and we will answer within 20 working days.
• Using a nickname. You can use Truce under a username and display name that are not your real name. We do need an email address, because an account cannot be run or recovered without one.
• Information from other people. Some information about you reaches us from other members rather than from you: an invitation to a trip, a photo you appear in, or a cost recorded against you on a trip's ledger. Sections 4 and 5 explain what happens to it, and you can ask us about it, or have a photo removed, at any time.
• Overseas. Your information is held in Ireland and handled by the service providers in section 7, which are in the United Kingdom, the European Union and the United States. See section 8 for how it is protected there.
• Marketing email. We only send it if you opted in. Every one says who it is from and how to reach us, and an unsubscribe takes effect straight away.
• Complaints. Tell us first and we will reply within 30 days. If you are not satisfied, you can go to the Office of the Australian Information Commissioner (oaic.gov.au) or New Zealand's Privacy Commissioner (privacy.org.nz).

16. Changes to this policy

If we change this policy we will update the date at the top. If a change materially affects your rights, we will tell you in the app or by email rather than quietly editing the page.

17. Contacting us

Email privacy@truceapp.com, or use the contact form. For anything urgent about content or safety, put “Report” in the subject line.