Travelingos Privacy Policy

Last Updated: February 2026

In order to ensure transparency and give you more control over your personal information, this privacy policy ("Privacy Policy") governs how we, Travelingos ("Travelingos", "we", "our" or "us"), use, collect and store personal information that we collect or receive from or about you ("you") in connection with https://travelingos.ai (the "Website") and the services provided therein, including the Travelingos platform (the "Platform", and together with the Website, the "Services").

Travelingos is a language-learning platform that enables users to learn languages through their own travel experiences. Users upload photos, videos, and audio from their journeys, and our AI generates personalized vocabulary and exercises from that content.

This Privacy Policy explains how we collect, use, disclose, and process your personal data when you use our Website, Platform, and other places where Travelingos acts as a data controller — for example, when you create an account, upload media, practice exercises, or register on our waiting list.

Please read this Privacy Policy carefully, so you can fully understand our practices in relation to personal data. "Personal Information" means any information that can be used, alone or together with other data, to uniquely identify any living human being. Important note: Nothing in this Privacy Policy is intended to limit in any way your statutory rights, including your rights to a remedy or other means of enforcement.

Table of contents:

1. What information we collect, why we collect it, and how it is used
2. How we protect and retain your Personal Information
3. How we share your Personal Information
4. Third-party service providers
5. Your privacy rights
6. Use by children
7. Interaction with third-party products
8. Cookies and analytics
9. Specific provisions applicable under California privacy law
10. Contact us

This Privacy Policy can be updated from time to time and, therefore, we ask you to check back periodically for the latest version of this Privacy Policy. If we implement material changes in the way we use your information, in a manner that is different from that stated at the time of collection, we will notify you by posting a notice on our Website or by other means and take any additional steps as required by applicable law.

I. What Information We Collect, Why We Collect It, and How It Is Used

1. Account Registration

In order to use the Travelingos Platform, you are required to create an account ("Account"). When registering, we collect the following information:

• Email address (required) — used as your unique account identifier and for essential communications.
• Password (required) — used to secure your account. Passwords are managed by our authentication provider (Netlify Identity) and are not stored in plaintext.
• Full name (optional) — you may choose to provide your name for personalization purposes.
• Invitation code (required during early access) — a one-time code required to register. We record which code was used and by which user for access-control purposes.

Your account is managed through Netlify Identity, which assigns a unique user identifier (UUID) used internally to associate your data with your account.

2. Waiting List Registration

Before gaining access to the Platform, you may register on our waiting list. We use Airtable to manage waiting list registrations. When you sign up for the waiting list, we may collect:

• Email address
• Name
• Any other information you voluntarily provide in the registration form.

This information is stored in Airtable and used solely to manage early access invitations and communicate with you about the availability of the Platform. Airtable processes this data in accordance with its own privacy policy.

3. User-Uploaded Media

Travelingos allows you to upload photos, videos, and audio files from your travels. When you upload media, we collect and store:

• The media file itself (photos, videos, or audio, up to 50 MB per file) — stored securely in Netlify Blobs cloud storage.
• Original filename of the uploaded file.
• Media type (photo, video, or audio).
• Language selection — the target language you have chosen to learn.
• Upload timestamp.

Your uploaded media is associated with your user ID and is accessible only to you. We do not share your media files with other users.

4. AI-Processed Content

When you upload media, we send the content to Google's Gemini AI service to extract language-learning content. This processing generates:

• Extracted words and phrases — vocabulary identified from your media, with example sentences.
• Personalized exercises — practice exercises generated from your accumulated vocabulary.
• Exercise answer evaluations — when you answer exercises, we send your answer and the expected answer to the AI for evaluation.

This AI-generated content is stored in our database and associated with your user ID.

5. Exercise Feedback

You may provide feedback on exercises (thumbs up or thumbs down). We store this feedback along with the exercise text and your user ID to improve exercise quality.

6. Automatic Data Collection

We collect minimal automatic data through your use of the Services:

• Authentication tokens — JWT (JSON Web Token) session tokens issued by Netlify Identity for secure access.
• Exercise view history — timestamps of when you accessed exercises, for tracking your learning progress.

We do not currently collect IP addresses, device identifiers, browser fingerprints, or geolocation data through our Platform.

7. Contact and Support Requests

When you contact us via email (e.g., at privacy@travelingos.ai or contact@travelingos.ai) or through any other communication channel, we may collect:

• Your name — as provided by you in your message or email header.
• Your email address — the address from which you contact us.
• Message content — the content of your inquiry, request, or feedback.

We use this information solely to respond to your inquiry, resolve your issue, and improve our Services. We retain this correspondence for as long as necessary to address your request and for our internal records.

8. How We Use Your Information

We process your information for the following purposes:

1. To provide you with the Travelingos Services. We use your information to operate the Platform — including account management, media storage, AI content extraction, exercise generation, and learning progress tracking.
2. For administrative purposes. We may use your information to respond to your questions, support requests, or feedback; to maintain and improve the Services; and for internal quality control.
3. For security purposes. We use authentication data to verify your identity, prevent unauthorized access, and protect the integrity of the Services.
4. De-identified and aggregated information. We may anonymize or aggregate your information for internal purposes, including improving the Services and for research purposes. Such aggregated data will not identify you personally.
5. To market the Travelingos Services. We may use your email address to send you marketing communications, product updates, feature announcements, early access opportunities, and other information about the Travelingos Services that may be of interest to you. You may opt out of receiving marketing emails at any time (see Section V — Marketing emails – opt-out).

II. How We Protect and Retain Your Information

1. Security

We have implemented and maintain reasonable technical, organizational, and security measures designed to protect your information, including:

• Server-side JWT authentication and authorization on all protected endpoints.
• All database queries are filtered by verified user ID — you can only access your own data.
• Media files are stored with user-scoped access controls and path-traversal prevention.
• Passwords are managed by Netlify Identity and are never stored in plaintext in our systems.
• All data in transit is encrypted via HTTPS/TLS.

However, please note that we cannot guarantee that information will not be compromised as a result of unauthorized penetration to our servers. As the security of information depends in part on the security of the device you use to communicate with us and the security you use to protect your credentials, please make sure to take appropriate measures to protect this information.

2. Retention of Your Information

Your information will be stored until we delete our records, you request deletion, or we proactively delete it. Please note that in some circumstances we may store your information for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax, or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, and/or (iii) if we reasonably believe there is a prospect of litigation relating to your information or dealings.

III. How We Share Your Information

We do not sell your Personal Information. We may share your information as follows:

1. We may use third-party service providers to process your information for the purposes outlined above (see Section IV for a detailed list).
2. To the extent necessary, with regulators, courts, or competent authorities, to comply with applicable laws, regulations, and rules, and requests of law enforcement, regulatory and other governmental agencies, or if required to do so by court order.
3. Where you have otherwise provided your consent to us for sharing or transferring your information.

IV. Third-Party Service Providers

We use the following third-party service providers to operate the Travelingos Platform. Each provider processes data as necessary for the functioning of the Services:

Provider	Purpose	Data Processed
Netlify	Website hosting, serverless functions, user authentication (Netlify Identity), and cloud file storage (Netlify Blobs)	Account credentials (email, password), user sessions (JWT tokens), uploaded media files, and all API requests
Neon	PostgreSQL database hosting	User IDs, media metadata, extracted words, exercises, exercise feedback, invitation code usage
Google (Gemini AI)	AI-powered content extraction and exercise generation	Uploaded media content (sent as base64-encoded data), language context, exercise prompts and answers
Google Fonts	Web typography	Standard font-serving requests (no Personal Information)
Airtable	Waiting list management	Email address, name, and any other information provided during waiting list registration
Simple Analytics	Privacy-friendly website analytics	Aggregated, non-personal usage data such as page views, referrer URLs, browser type, device type, and country-level location. Simple Analytics does not use cookies, does not collect IP addresses, and does not track individual users. See what Simple Analytics collects.

These providers act as our data processors and process data in accordance with their own privacy policies and our agreements with them. We encourage you to review their respective privacy policies.

V. Your Privacy Rights

The following rights (which may be subject to certain exemptions or derogations) shall apply to certain individuals (some of which only apply to individuals protected by certain privacy regulations):

1. You have a right to access Personal Information held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law.
2. You have the right to request that we rectify any Personal Information we hold that is inaccurate or misleading.
3. You have the right to request the erasure/deletion of your Personal Information (e.g., from our records). Please note that there may be circumstances in which we are required to retain your Personal Information, for example for the establishment, exercise, or defense of legal claims.
4. You have the right to object to, or to request restriction of, the processing.
5. You have the right to data portability. This means that you may have the right to receive your Personal Information in a structured, commonly used, and machine-readable format, and that you have the right to transmit that data to another controller.
6. You have the right to object to profiling.
7. You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
8. You also have a right to request certain details of the basis on which your Personal Information is transferred outside the European Economic Area, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality.
9. You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place of work, or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.

You can exercise your rights by contacting us at privacy@travelingos.ai. You may use an authorized agent to submit a request on your behalf if you provide the authorized agent written permission signed by you. To protect your privacy, we may take steps to verify your identity before fulfilling your request. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if we require further information in order to fulfil your request.

When processing your request, we may ask you for additional information to confirm or verify your identity and for security purposes, before processing and/or honoring your request. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive. In the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initially requested, we will address your request to the maximum extent possible, all in accordance with applicable law.

Marketing Emails — Opt-Out

You may opt out of receiving marketing emails from us at any time by clicking the "unsubscribe" link at the bottom of any marketing email you receive from us, or by contacting us at privacy@travelingos.ai. Please note that even if you opt out of marketing emails, we may still send you non-promotional communications, such as those related to your account, security, or the administration of the Services.

Deleting Your Account

Should you ever decide to delete your Account, you may do so by emailing privacy@travelingos.ai. If you terminate your Account, any association between your Account and Personal Information we store will no longer be accessible through your Account. We will delete your uploaded media, extracted words, exercises, and associated data from our systems, subject to any legal retention requirements.

VI. Use by Children

We do not offer our products or services for use by children and, therefore, we do not knowingly collect information from, and/or about children under the age of 18. If you are under the age of 18, do not provide any information to us without the involvement of a parent or a guardian. In the event that we become aware that you provide information in violation of applicable privacy laws, we reserve the right to delete it. If you believe that we might have any such information, please contact us at privacy@travelingos.ai.

VII. Interaction with Third-Party Products

We enable you to interact with third-party websites, mobile software applications, and products or services that are not owned or controlled by us (each, a "Third Party Service"). We are not responsible for the privacy practices or the content of such Third Party Services. Please be aware that Third Party Services can collect information from you. Accordingly, we encourage you to read the terms and conditions and privacy policies of each Third Party Service.

In particular, when you upload media to Travelingos, the content of that media is sent to Google's Gemini AI service for processing. Google may process this data in accordance with its own privacy policy and terms of service. We send only the media content and language context necessary for generating learning materials — no additional personal information is shared with Google beyond what is contained in the media itself.

VIII. Cookies and Analytics

Travelingos uses minimal cookies and tracking:

• Authentication cookies: We use session cookies set by Netlify Identity solely for the purpose of maintaining your authenticated session. These are essential cookies required for the Platform to function and cannot be opted out of while using the Services.
• Local storage: We may temporarily store a pending invitation code in your browser's local storage during the signup process. This data is removed after successful registration.

We use Simple Analytics, a privacy-friendly analytics service, to understand how users interact with the Platform and to improve the Services. Simple Analytics is designed to be compliant with GDPR, CCPA, and other privacy regulations. It does not use cookies, does not collect IP addresses, and does not track individual users across sites. The data collected by Simple Analytics includes:

• Page views and referrer URLs.
• Browser type and device type (e.g., desktop, mobile).
• Country-level geographic region (derived without collecting or storing IP addresses).

All analytics data is aggregated and non-personal — it cannot be used to identify individual users. We do not use advertising trackers, pixel tags, or retargeting technologies on the Platform. For more information, see what Simple Analytics collects.

IX. Specific Provisions Applicable Under California Privacy Law

Do-Not-Track Signals

"Do Not Track" ("DNT") is a privacy preference that users can set in certain web browsers. Please note that we do not currently respond to web browser DNT signals in a standardized manner. However, as described in Section VIII, any analytics tools we use are configured to minimize personal data collection, and you may opt out of analytics tracking using browser-level settings or provider-specific opt-out tools.

Your California Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what Personal Information we collect, the right to delete your Personal Information, and the right to opt out of the sale of your Personal Information. We do not sell your Personal Information. To exercise any of these rights, please contact us at privacy@travelingos.ai.

X. Contact Us

If you have any questions, concerns, or complaints regarding our compliance with this Privacy Policy and data protection laws, or if you wish to exercise your rights, we encourage you to contact us at:

Email: privacy@travelingos.ai

We will make every reasonable effort to respond to your inquiry promptly and to resolve any concerns you may have.