Privacy policy

1. Controller

Christopher Blake Hümmer, Taborstr. 19, 10997 Berlin, Germany
Email: christopher.huemmer@posteo.de · Phone: +49 176 32219031

2. Overview

Mochilo (mochilo.io; called Reiselust in German, reiselust.io) is a web app for planning trips together with friends and family. To provide the service, I process personal data you provide when registering and using it.

3. Registration & account

On sign-up I collect your email address, a password you choose (stored encrypted), and your display name, to provide you with an account and identify you at login. You can optionally also provide your legal name if your display name is a nickname; this is used only so the AI feature (see Section 12) can recognize you on an uploaded document, and is never displayed anywhere in the app. Because that matching happens on your co-travelers' devices, it is technically accessible to co-travelers on shared trips, and to no one else. Legal basis: Art. 6(1)(b) GDPR (display name), (a) GDPR (legal name, a voluntary entry). New accounts are manually approved before they can use the app, as an abuse safeguard for this private project. At sign-up we check your email address's domain against a public list of disposable addresses; such addresses can't be used to sign up. Forwarding addresses from privacy services (e.g. SimpleLogin or Apple's Hide My Email) are allowed, but are marked for approval and don't count for the referral program. Legal basis: Art. 6(1)(f) GDPR (protection against abuse).

As the operator I can see usage figures for each account, for example the number of trips created and joined, expenses added and AI requests, the time of the last sign-in and whether the app is used on an iPhone or an Android device. I don't see content such as trips, bookings or expenses. I use these figures to run the service, detect abuse and improve the app. Legal basis: Art. 6(1)(f) GDPR.

4. Profile data

You can optionally upload a profile picture and add a PayPal.me handle (for settling costs with fellow travelers). Profile pictures are resized to 256×256px and stored privately, accessible only to you and your co-travelers via time-limited links. Legal basis: Art. 6(1)(a) GDPR (uploading is voluntary) / (b) for the PayPal feature.

You can also optionally add an IBAN and account holder. Only your co-travelers on shared trips see these details, so they can transfer money they owe you; for this the app generates a QR code (EPC/GiroCode) in the browser containing the IBAN, name, amount and reference. No data is sent to a bank or payment service. You can change or remove the details on your profile at any time. Legal basis: Art. 6(1)(a) GDPR (voluntary).

Further payment options are voluntary too: a Venmo, Monzo.me or Revolut name, a UK bank account (sort code, account number, holder), an Interac e-Transfer address or a PayID. Only your co-travelers on shared trips see them, and only on trips in a currency the option can pay in. When someone taps a payment link, their device opens the provider’s page (Venmo, Monzo or Revolut) with your name there, the amount and the trip name; we don’t send anything to these providers ourselves. They are deleted when you close your account. Legal basis: Art. 6(1)(a) GDPR (voluntary).

Your nationality is optional too (at signup or in your profile). We only use it to show you the matching AI suggestions for a destination (see Section 12). Nobody else can see it and it is never sent to the AI. Without it you simply get no suggestions. You can change or delete it in your profile at any time. Legal basis: Art. 6(1)(a) GDPR (voluntary entry).

You can also add the country you live in to your profile. We only use it to leave out the “On the ground” panel (plugs, driving side, emergency numbers, exchange rate, local time) on trips to that country, and on trips abroad to show whether your phone plan works there like at home (EU roaming), worked out in your browser. Nobody else can see it, and it is deleted when you close your account. Legal basis: Art. 6(1)(a) GDPR (voluntary entry).

5. Trip data

Trips, stops (including place names and coordinates), stays, flights, car rentals, other transport and any uploaded booking confirmations are stored to enable shared trip planning. This data is visible only to you and the members of that trip, enforced technically via database row-level security. Legal basis: Art. 6(1)(b) GDPR.

This includes the trip checklist: items that members add (e.g. a vaccination or a visa) and who has already ticked them off. Whether you tick an item off is up to you; the tick is visible to everyone on that trip. If an item concerns your health (such as a vaccination), this is health data (Art. 9 GDPR) that you provide voluntarily. The legal basis for that is your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by removing the tick. Reminders about open items are sent as an in-app notification and by email (via Resend, see section 10).

Calendar subscription: if you choose, you create a private link for a trip that your calendar app (e.g. Apple Calendar, Google Calendar, Outlook) fetches regularly. The link contains a random key and returns, without signing in, the trip data that concerns you: the trip dates, your flights and other transport, car rentals, stays with their address and your open checklist items with a due date. This data is passed to your calendar app's provider and stored there under its terms. Anyone who knows the link can fetch this data; you can reset it at any time, after which the old link stops working. If you leave the trip or close your account, the link no longer returns any data. Legal basis: Art. 6(1)(b) GDPR.

6. Cost splitting

Costs you add (amounts, who paid, who shares it) are stored and shown to the relevant trip members to enable splitting bills. To settle up, the app can generate a PayPal.me payment link containing the amount and the recipient's PayPal.me handle; no data is sent to PayPal directly by the app: the link simply opens PayPal's own website, where PayPal's privacy policy applies. Legal basis: Art. 6(1)(b) GDPR.

SillyMoney (sillymoney.io), the expense app by the same operator, uses the same account. You only use SillyMoney if you agree on your first visit there. Fellow travelers who use SillyMoney can bring a shared trip's costs over and sync them. If you don't use SillyMoney, you only appear there with your display name on your costs, for the members of that group, who see the same here; your payment details aren't shared there. Legal basis: Art. 6(1)(b) and (f) GDPR (settling up together, which your fellow travelers use).

7. Invitations

A trip member can add another registered user by email, or generate an invite link; adding by email checks whether an account exists for that address. Legal basis: Art. 6(1)(b) GDPR.

For the referral program every account has a personal invite link that you share yourself; we don't send invitation emails. When someone signs up through such a link, we store whose link it was. The person who shared it sees how many signed up through their link and the display names of those who have already created a trip of their own, so they can follow their progress. Legal basis: Art. 6(1)(b) GDPR (taking part in the program) and (f) GDPR (traceability, protection against abuse).

8. Hosting & processors

This site is hosted with:

• Supabase, Inc. (database, authentication, file storage). Data is stored in AWS region eu-west-3 (Paris, France), i.e. within the EU.
• Vercel Inc. (app delivery). Vercel may process requests via servers outside the EU; appropriate safeguards (e.g. EU Standard Contractual Clauses) apply.
• Google Ireland Ltd. / Google LLC (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service), only in the iPhone and Android apps, to deliver push notifications. Processing outside the EU may occur here too; EU Standard Contractual Clauses or the EU-US Data Privacy Framework apply.

Push notifications (apps only): if you allow them when you first sign in to the app, we store a device token, the platform (iOS/Android) and your language, so we can tell you about new invites, costs you're part of, checklist items and changes to your trips. The notification text (e.g. trip name, a person's name, an amount) is passed to Firebase Cloud Messaging and from there to Apple or Google. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your device settings; you can also mute notifications for individual trips. The token is deleted when you close your account or when the push service reports it as invalid.

Under "Notifications" in your profile you choose which kinds of push notifications you get (expenses, trip planning, trip reminders, app news). Trip reminders are one notification at noon the day before a trip starts and, if you have no other trip planned yet, one at noon the day after it ends; so they arrive at the right time, we store your device's time zone with the device token. "App news" are occasional notes from us about new features of Mochilo; they appear in your in-app notifications and as a push notification unless you switch them off (legal basis: Art. 6(1)(f) GDPR). Promotional notifications ("Offers and discounts", e.g. partner offers or discounts) are only sent if you explicitly switch them on there; we store when you gave that consent. You can withdraw it at any time with the same switch. Legal basis: Art. 6(1)(a) GDPR and § 7(2) UWG (German Unfair Competition Act).

9. Sign-up notifications

When you register, your display name and email are sent once to ntfy.sh, a push-notification service, to alert me as the operator so I can manually approve your account. ntfy.sh's own privacy policy applies. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the service from abuse).

10. Approval email

Once your account is approved, I send you a one-time email about it via Resend (Plus Five Five, Inc., USA). This transmits your email address and display name to Resend. Processing takes place in the USA; the EU Standard Contractual Clauses incorporated into Resend's Art. 28 GDPR processor agreement apply, as does Resend's certification under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR (performing the registration you requested) / (f) (legitimate interest in a working sign-up process).

11. CAPTCHA protection

To prevent automated mass sign-ups, registering, signing in, and requesting a new confirmation email embed a CAPTCHA widget from Cloudflare (Turnstile). This transmits your IP address and certain browser signals to Cloudflare, Inc. (USA), used there to assess whether the request comes from a real person or a bot. Turnstile doesn't use tracking cookies for advertising purposes. Processing takes place in the USA under EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting against abuse and automated sign-ups).

12. AI assistant

Accounts with access to the optional AI feature can type free text (e.g. a trip description) on the trip page or the dashboard to get automatic suggestions for trip data (stops, stays, flights, car rentals, other transport, costs, trip checklist items) or the basic details of a new trip. Existing checklist items and who has ticked them off are never sent to the AI; new items are only created from what you type yourself. On the trip page, you can also attach a PDF of an existing itinerary to have trip data extracted from it; the file is likewise sent to Anthropic for processing, but we don't store it ourselves, it's read once for that request and then discarded. Likewise, in the dashboard's "Currently underway" area you can send a photo of a receipt (or a short note) to get a single expense suggested; the photo is scaled down in your browser first and isn't stored by us either. This text, together with some context about that trip (e.g. existing stop names, co-travelers' names, the trip's currency), is sent to Anthropic PBC (USA) for processing, which generates the suggestion; you review it before anything is saved, and it's only stored once you confirm it. Anthropic processes the request solely to generate the response and does not use it to train its own models. The text you enter is also logged in our database together with a timestamp and your user ID, to detect abuse and improve the feature (for an attached file, only a note that a file was attached is logged, not its content). Each request also records whether it was answered, answered with a follow-up question or refused, whether it contained instructions aimed at the AI (e.g. hidden commands in a document), and how many tokens it used. As the operator, I can view refused or flagged requests to detect abuse and, if needed, disable the AI feature for an account. The text you entered is deleted after 90 days; the remaining details (time, outcome, token usage) are kept until you close your account (see Section 15). Legal basis for this: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and controlling costs). Processing in the USA takes place under EU Standard Contractual Clauses. The feature is optional, enabled only for selected accounts, and only triggered when you actively use it. Legal basis: Art. 6(1)(a) GDPR (you decide on each individual input) / (b) (performing this feature you requested).

AI suggestions for a destination (entry, visa, vaccinations, insurance) are generated in advance per country and nationality from the Federal Foreign Office's public travel advice, reviewed by us and stored. No personal data is sent to the AI for this. If you open suggestions for a country that doesn't have any yet, we only store the country and the nationality (not linked to you) so we can add them.

You can also dictate into the AI field on the dashboard. This uses your browser's speech recognition: the recording isn't sent to us but, depending on the browser, to its vendor (Google for Chrome, Apple for Safari, or recognized on the device itself), and only the recognized text ends up in the input field. The microphone is used only after you allow it and only when you tap the microphone icon.

13. Third-party embeds

The maps load their map data from OpenFreeMap (tiles.openfreemap.org), and the place search when adding a stop queries OpenStreetMap's Nominatim service. This transmits your IP address to the respective service, and for the place search also the search term you typed. Legal basis: Art. 6(1)(f) GDPR.

Exchange rates (for expenses in another currency and the “On the ground” info on a trip) are fetched by your browser from open.er-api.com (ExchangeRate-API). This transmits your IP address and the trip's currency, no details about you or the trip. Local time and time difference are calculated on your device. Legal basis: Art. 6(1)(f) GDPR.

If you turn on flight alerts for a trip, shortly before departure we send the flight number and date of your flights to AeroDataBox, a provider of flight status data, and receive changes such as delays, gate changes or cancellations from them. No names or other details about you are transmitted. We keep the status until the flight is over and show it to everyone on the trip. Legal basis: Art. 6(1)(b) GDPR (a feature you asked for); you can turn flight alerts off at any time on the Flights tab.

14. Cookies

This site uses only strictly necessary cookies: one to remember your language choice, and Supabase's own session cookies to keep you logged in. No tracking or marketing cookies are used.

15. Retention & deletion

Your data is kept as long as your account exists or you're a member of a trip. You can delete individual trips, bookings and expenses yourself at any time. Using "Close my account" on your profile page, you can close your account yourself at any time: your display name, profile picture, PayPal handle and bank details are removed immediately; on trips you were part of, you remain visible as "Deleted user" so cost-splitting stays correct for your co-travelers. Alternatively, you can always email me for full deletion instead.

16. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) under the GDPR. Just email me.

17. Right to complain

You may lodge a complaint with a data protection supervisory authority. The competent authority here is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin (datenschutz-berlin.de).

18. Changes

I may update this policy to reflect legal or service changes; the version published here is always the current one.

Last updated: October 2026