1. Introduction
Odyssa (“we,” “our,” or “us”) is an AI-powered trip planning application available as a web app and mobile app. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services at odyssa.net and the Odyssa mobile application.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address
- Display name
- Password (stored as a salted, one-way hash — we never store your plaintext password)
- Google account identifier (if you sign in with Google)
2.2 Trip Data
When you create and manage trips, we collect:
- Trip names, destinations, dates, and itinerary details
- Travel preferences (pace, style, transport mode, interests)
- Flight information (airline, flight numbers, airports, departure/arrival times)
- Accommodation details (hotel names, addresses, check-in/check-out dates, confirmation numbers)
- Expense records (amounts, categories, descriptions)
- Packing lists
- Trip notes and must-see locations
2.3 Photos & Documents
You may upload photos and documents (such as booking confirmations or travel documents) to associate with your trips. These files are stored on our servers and are only accessible to you and any collaborators you explicitly invite.
2.4 Google Calendar Data
If you grant calendar permissions, we access your Google Calendar to export itinerary events directly to your calendar. We read and write calendar events only for trips you explicitly choose to sync. We do not access, read, or store any pre-existing calendar events unrelated to Odyssa trips.
2.5 Google Fit / Activity Data
If you grant fitness permissions, we read step count and activity data from Google Fit to display your daily activity during active trips. This data is displayed in real-time within the app and is not stored on our servers. We access only aggregate daily step counts and do not access heart rate, sleep, or other health metrics.
2.6 Location Data
If you use the “Near Me” feature or live trip tracking, we access your device's location to show nearby points of interest and your position on the trip map. Location data is used in real-time and is not stored on our servers beyond the duration of your active session.
2.7 AI Conversations
Conversations with Penelope (our AI trip assistant) are processed through Google's Gemini API. Your messages and trip context are sent to Google's AI service to generate responses. We track aggregate AI usage costs per trip but do not permanently store conversation transcripts.
2.8 Push Notification Tokens
If you enable push notifications, we store your device's notification token to send trip reminders and status updates. You can disable notifications at any time through your device settings or within the app.
3. How We Use Your Information
We use the information we collect to:
- Create and manage your account
- Generate AI-powered trip itineraries based on your preferences
- Store and organize your trip plans, photos, documents, and expenses
- Enable trip collaboration with other users you invite
- Provide weather forecasts, currency conversion, and local phrase translations for your destinations
- Send trip reminders and status notifications
- Sync itinerary events to your Google Calendar (with your permission)
- Display activity tracking data during trips (with your permission)
- Track real-time flight status for your saved flights
- Improve our service and fix bugs
4. Third-Party Services
Odyssa integrates with the following third-party services:
- Google Gemini API — AI itinerary generation and trip assistant
- Google OAuth — Authentication (sign in with Google)
- Google Calendar API — Calendar event export (with your permission)
- Google Fit API — Activity/step tracking (with your permission)
- Google Maps — Location mapping and place information
- Visual Crossing — Weather forecast data
- Cloudflare — CDN, DDoS protection, and SSL
- Firebase Cloud Messaging — Push notifications
Each third-party service has its own privacy policy governing their handling of your data. We encourage you to review their policies.
5. Data Storage & Security
- Your data is stored in a MongoDB database on servers we operate
- Passwords are hashed using bcrypt with a cost factor of 12
- Authentication tokens (JWT) expire after 15 minutes; refresh tokens expire after 7 days
- All connections are encrypted via HTTPS/TLS
- Uploaded photos and documents are stored on our servers with access restricted to authorized users
- We perform daily automated database backups
- We do not sell, rent, or trade your personal information to third parties
6. Data Sharing
We share your data only in the following circumstances:
- Trip Collaborators — When you invite someone to a trip, they can view the trip details you've shared
- AI Processing — Trip context is sent to Google Gemini to generate itineraries and answer questions
- Legal Requirements — If required by law, court order, or governmental regulation
7. Your Rights
You have the right to:
- Access your personal data through your account settings
- Correct inaccurate information in your profile
- Delete your account and all associated data by contacting us
- Export your trip data
- Revoke Google permissions at any time through your Google Account settings
- Opt out of push notifications through your device settings
8. Children's Privacy
Odyssa is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us and we will promptly delete it.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date. Your continued use of Odyssa after changes constitutes acceptance of the updated policy.
10. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:
[email protected]