Privacy Policy

Last updated: 18 August 2026

We built VAYRA around a simple idea: your travel data belongs to you. We collect only what we need to make the app work and learn from your rhythm — nothing more.

1. Who is responsible for your data

Data controller: Darast, the Netherlands
Contact: vayra@darast.nl

Darast is the controller of personal data processed through the VAYRA app, within the meaning of the General Data Protection Regulation (GDPR).

2. What we collect and why

Data	Purpose	Legal basis
Email address, name	Account creation and authentication	Contract
Travel preferences (budget, style, interests)	Personalising itinerary generation	Contract
Rhythm profile (8 behavioural dimensions)	Adapting suggestions to your travel pace and energy	Contract / Legitimate interest
In-app behaviour signals (skips, ratings, timing)	Improving rhythm accuracy over time	Legitimate interest
Trip data (destination, dates, itinerary)	Generating and storing your travel plans	Contract
Device info, platform, app version	Crash reporting and diagnostics (Sentry)	Legitimate interest
Product usage events (screens opened, features used, app lifecycle)	Product analytics — understanding which parts of the app work (PostHog, EU-hosted)	Legitimate interest
Approximate or precise location (when permission is granted)	Nearby places, local weather, walking routes and movement-map guidance	Consent / Contract
Destination and hotel search terms	Returning place suggestions while you type	Contract
Beta feedback (if submitted)	Improving the product during beta	Consent

VAYRA accesses your location only after you grant permission and only while the app is in use. When you use nearby places, local weather, walking routes or the Movement Map, the coordinates needed to answer that request are sent securely to our server infrastructure and relevant service providers: Supabase, Google, Mapbox, OpenStreetMap services, Open-Meteo and, for Movement Map analysis, OpenAI. VAYRA does not store those coordinates in your account database or use them for advertising or cross-app tracking. Service providers may retain limited operational and security logs under their own privacy policies.

Adapt verification is handled differently. If a suggestion names a place, VAYRA reads your position once at follow-up and compares it with that public place coordinate. If no place was named, VAYRA stores one starting position on your device and compares it with a follow-up reading. Those personal coordinate readings stay on your device and are deleted when you answer or the suggestion expires. Only a rounded distance in metres and whether the check was usable are sent to VAYRA — never the Adapt coordinates themselves. You can refuse location access and still answer the follow-up yourself. We do not sell your data to third parties.

3. How we store your data

Your data is stored in Supabase (EU region) with row-level security — each user can only access their own records. Destination and hotel search terms are sent through Supabase to Google Places to return suggestions; VAYRA does not save those terms in your account database or raw application logs. Google may retain limited operational and security records under its own privacy policy. We use Sentry for crash reporting; crash reports may include anonymised device and session context but never contain trip content or behaviour data.

We use PostHog (EU-hosted, eu.i.posthog.com) for product analytics. PostHog records which screens you open and which features you use, linked to your account ID. It does not record trip content, message content or precise location, and we do not use it for advertising or cross-app tracking. You can switch this off in-app via Settings → AI learning → “Learn from my adjustments”; with that toggle off, no analytics events are sent.

AI generation requests are sent to OpenAI via our servers. We send your rhythm profile and trip preferences to generate itinerary suggestions. Movement Map requests can also include route endpoints and nearby public venue coordinates; no VAYRA account ID is included in that AI request. OpenAI does not train models on API data.

4. How long we keep your data

Account and profile data — until you delete your account
Trip data and itineraries — until you delete the trip or your account
Behaviour signals — retained to power rhythm learning; anonymised after account deletion
Location requests — not stored in your VAYRA account database; service providers may retain limited operational and security logs under their own policies
Adapt starting position — stored only on your device until you answer the follow-up or the suggestion expires
Beta feedback — retained for product improvement; deleted on request
Crash reports — retained by Sentry for 90 days
Product usage events — retained by PostHog (EU) for 12 months, then deleted

5. Your rights under GDPR

As a resident of the EU/EEA you have the following rights:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — delete your account and associated data (available in-app via Settings → Privacy & Account → Delete account)
Portability — request a copy of your data in a machine-readable format
Restriction — request that we limit processing of your data
Objection — object to processing based on legitimate interest

To exercise any right, contact us at vayra@darast.nl. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

6. Group trips and partner data

If you join a shared trip, the trip owner can see that you have joined and your display name. Your rhythm profile is shared with the trip generation engine to personalise the itinerary for the group, but it is not shown directly to other users. You can leave a shared trip at any time from Settings.

7. Third-party services

Supabase — database, authentication and server functions (privacy policy)
OpenAI — AI itinerary and Movement Map generation (privacy policy)
Mapbox — maps and walking routes (privacy policy)
Google — place search, photos and directions (privacy policy)
OpenStreetMap services — geocoding and nearby route context (privacy policy)
Open-Meteo — local weather (terms and privacy information)
Sentry — crash reporting (privacy policy)
PostHog — product analytics, EU-hosted (privacy policy)

8. Children

VAYRA is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us at vayra@darast.nl.

9. Changes to this policy

We may update this policy as the product evolves. We will notify you in-app of material changes. The “Last updated” date at the top of this page reflects the most recent revision.

10. Contact

Darast
vayra@darast.nl
darast.nl