What we collect, why, and what we don't

This Privacy Policy explains how Cotek App FZ-LLC (“we”, “us”) handles personal information when you use ExTraP — Exploring Travellers Platform (“the Service”). Our goal is to handle as little of it as possible, and to be straightforward about the rest.

This policy works alongside our Terms of Service. Defined terms there have the same meaning here.

1. What we collect

1.1 Account information

• Name and email address — required to sign up and to send transactional email.
• Password — stored only as a bcrypt hash. We can't see it; we can't recover it.
• Profile photo — optional. You upload it; you can delete it.
• Default currency and email digest preference — small settings you control.

1.2 Trip and workspace content

• Workspace name, description, and optional logo.
• Trip names, destinations, dates, budgets, itineraries, items, hotels, transport, expenses, notes, and any other planning data you enter.
• Photo and document uploads you attach to trips.
• Membership and collaboration data — who's in a workspace, who's a trip collaborator, who invited whom.

1.3 AI assistant conversations

Messages you send to the assistant, the assistant's replies, and timestamps are stored against your workspace so you can pick a conversation back up. We also send the relevant context to Anthropic so the model can answer — see §4 below.

1.4 Payment information

Subscription billing is handled by Stripe. We do not see or store your card details — Stripe does, under PCI-DSS. We do store your Stripe customer ID and subscription ID against your workspace so we know which tier you're on.

1.5 Technical information

• Sign-in events, IP address at sign-in time, and basic device / browser strings for security and abuse detection.
• Server logs (request paths, status codes, error stack traces). Logs are retained for a short rolling window and are not used to build a profile of you.
• Standard cookies needed to keep you signed in. We don't use third-party advertising or tracking cookies.

2. How we use it

We use the information above to:

• Operate the service — show you your trips, sync collaboration, deliver email, run the AI assistant.
• Bill you accurately and process refunds where applicable.
• Send transactional emails: account verification, password resets, invitations, share-link notifications, weekly digest (opt-in), and important service notices.
• Keep the service secure — detect and respond to abuse, fraud, and unusual activity.
• Comply with our legal obligations.
• Improve the product. Aggregate usage analysis (e.g. “how many people use the polaroid download?”) is fine. We do not sell your data, and we do not use Your Content to train AI models.

3. Lawful basis

Where the GDPR or comparable regimes apply to you, the lawful bases for our processing are:

• Contract — operating the service and billing you for it.
• Legitimate interest — security, fraud prevention, and basic product analytics.
• Consent — optional things like the weekly email digest.
• Legal obligation — responding to lawful requests from competent authorities.

4. Sub-processors

ExTraP uses a small number of trusted vendors to deliver the service. Each receives only what they need:

• Vercel (USA / global edge) — application hosting and server-side execution. Sees request data in transit.
• Vercel Blob — storage for your photos and document uploads.
• Neon (or another managed Postgres provider) — primary database storage.
• Stripe — payment processing, billing, and customer portal. Receives the email and name attached to your workspace, plus your card data (which we never see).
• Resend — transactional email delivery. Sees the recipient address and the contents of the email.
• Anthropic — large-language-model inference for the AI assistant. Receives the assistant's system prompt (which includes a summary of your workspace's trips), the message history of the active conversation, and the message you just sent. Anthropic processes inputs and outputs under their own privacy commitments and, where applicable, their zero-data-retention policy for API traffic.
• Frankfurter — anonymous public API for currency exchange rates. Receives only currency codes (e.g. “USD → JPY”); never your data.

We'll keep this list current. If we add or change sub-processors in ways that materially affect your data, we'll update this page and, where appropriate, notify you by email.

5. Public share links

When you create a public share link for a trip, anyone with the link can view that trip's contents. The link contains a random 24-character token; it is not indexed by search engines and we instruct robots not to crawl share URLs, but treat the link as if the trip itself is public. You can revoke the link any time and the token becomes invalid immediately.

6. International data transfers

Our sub-processors operate primarily in the United States and the European Union. By using ExTraP you understand that your data may be processed in jurisdictions other than your own. Where required by law, we rely on appropriate transfer mechanisms (such as Standard Contractual Clauses) for transfers outside your country of residence.

7. Retention

• Account and content — retained for the life of your account. When you delete a trip, workspace, or your account, the corresponding data is permanently removed from primary systems immediately and from encrypted backups within 30 days.
• AI conversations — retained until you delete the thread or the workspace. Inputs and outputs sent to Anthropic for inference are subject to Anthropic's retention policies.
• Billing records — kept for the period required by applicable accounting and tax law (typically 5–7 years), even after you cancel.
• Security and abuse logs — short rolling window measured in days to weeks, longer if needed to investigate a specific incident.

8. Your rights

Depending on where you live you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and the data associated with it.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time for optional processing (e.g. the email digest).
• Lodge a complaint with a data-protection authority.

For most of these, you don't need to email us — Settings inside the app already lets you update your name, change your password, export trips, opt out of digests, and delete a workspace. For anything else, write to support@cotek.live with the email address on your account and we'll get back to you within 30 days.

9. Security

We protect your information with industry-standard measures: encrypted transport (TLS) everywhere, bcrypt password hashing, signed session tokens, HTTPS-only cookies, and signed cookies for sensitive routes like the admin gate. Database connections are encrypted; uploads to Vercel Blob are served over HTTPS. No system is perfectly secure — if you discover a vulnerability, please email support@cotek.live rather than disclosing it publicly, and we'll respond promptly.

10. Children

ExTraP is not intended for children under 16. We don't knowingly collect personal information from anyone under 16. If you believe a child has created an account, please tell us and we'll delete it.

11. Cookies and similar technologies

We use a small set of strictly-necessary cookies:

• A signed session cookie set by Auth.js so we know you're signed in.
• A workspace-selection cookie so we know which workspace to show you when you have several.
• A signed admin session cookie (only set if you successfully sign in to /admintc, which most users will never see).

We do not use cookies for advertising, cross-site tracking, or behavioural analytics. Stripe and our error-logging providers may set their own cookies on the pages they serve.

12. Marketing and email

We do not run marketing email campaigns. The only emails we send are transactional (account, billing, invitations, share-link notices, weekly digest if you've opted in, important service notices). You can opt out of the digest from Settings. You can't opt out of transactional emails while your account is active; if you don't want them, delete the account.

13. Changes to this policy

We'll update this page if our practices change. Material changes will be announced by email or an in-app banner at least 14 days before they take effect.

14. Contact

Cotek App FZ-LLC — United Arab Emirates.

Privacy questions, data-subject requests, security reports: support@cotek.live.