Privacy policy

1. Controller

Christopher Blake Hümmer, Taborstr. 19, 10997 Berlin, Germany
Email: christopher.huemmer@posteo.de · Phone: +49 176 32219031

2. Overview

Mochilo (mochilo.io; called Reiselust in German, reiselust.io) is a web app for planning trips together with friends and family. To provide the service, I process personal data you provide when registering and using it. The service is not aimed at people under 16.

3. Registration & account

On sign-up I collect your email address, a password you choose (stored encrypted), and your display name, to provide you with an account and identify you at login. You can optionally also provide your legal name if your display name is a nickname; this is used only so the AI feature (see Section 12) can recognize you on an uploaded document, and is never displayed anywhere in the app. Because that matching happens on your co-travelers' devices, it is technically accessible to co-travelers on shared trips, and to no one else. Legal basis: Art. 6(1)(b) GDPR (display name), (a) GDPR (legal name, a voluntary entry). Since 22 October 2026 you can use the app right after confirming your email address; I may block an account in case of misuse. At sign-up we check your email address's domain against a public list of disposable addresses; such addresses can't be used to sign up. Forwarding addresses from privacy services (e.g. SimpleLogin or Apple's Hide My Email) are allowed, but are marked in the admin view and don't count for the referral program. Legal basis: Art. 6(1)(f) GDPR (protection against abuse).

As the operator I can see usage figures for each account, for example the number of trips created and joined, expenses added and AI requests, the time of the last sign-in and whether the app is used on an iPhone or an Android device. I don't see content such as trips, bookings or expenses. I use these figures to run the service, detect abuse and improve the app. Legal basis: Art. 6(1)(f) GDPR.

An account needs an email address and a display name; without them you can't use the service. Everything else is optional.

4. Profile data

You can optionally upload a profile picture and add a PayPal.me handle (for settling costs with fellow travelers). Profile pictures are resized to 256×256px and stored privately, accessible only to you and your co-travelers via time-limited links. Legal basis: Art. 6(1)(a) GDPR (uploading is voluntary) / (b) for the PayPal feature.

You can also optionally add an IBAN and account holder. Only your co-travelers on shared trips see these details, so they can transfer money they owe you; for this the app generates a QR code (EPC/GiroCode) in the browser containing the IBAN, name, amount and reference. No data is sent to a bank or payment service. You can change or remove the details on your profile at any time. Legal basis: Art. 6(1)(a) GDPR (voluntary).

Further payment options are voluntary too: a Venmo, Monzo.me or Revolut name, a UK bank account (sort code, account number, holder), an Interac e-Transfer address or a PayID. Only your co-travelers on shared trips see them, and only on trips in a currency the option can pay in. When someone taps a payment link, their device opens the provider’s page (Venmo, Monzo or Revolut) with your name there, the amount and the trip name; we don’t send anything to these providers ourselves. They are deleted when you close your account. Legal basis: Art. 6(1)(a) GDPR (voluntary).

Your nationality is optional too (at signup or in your profile). We only use it to show you under “On the ground” whether you need a visa for a destination (worked out on our server from a list we ship, without asking any third party) and to show you the matching AI suggestions for a destination (see Section 12). Nobody else can see it and it is never sent to the AI. Without it you simply get no visa line and no suggestions. You can change or delete it in your profile at any time. Legal basis: Art. 6(1)(a) GDPR (voluntary entry).

You can also add the country you live in to your profile. We only use it to leave out the “On the ground” panel (plugs, driving side, emergency numbers, exchange rate, local time) on trips to that country, and on trips abroad to show whether your phone plan works there like at home (EU roaming), worked out in your browser. Nobody else can see it, and it is deleted when you close your account. Legal basis: Art. 6(1)(a) GDPR (voluntary entry).

5. Trip data

Trips, stops (including place names and coordinates), stays, flights, car rentals, other transport and any uploaded booking confirmations are stored to enable shared trip planning. This data is visible only to you and the members of that trip, enforced technically via database row-level security. Legal basis: Art. 6(1)(b) GDPR.

Documents you upload to a trip's Documents tab (e.g. tickets, vouchers, booking confirmations) are visible to all members of that trip. Personal documents on your dashboard and profile (e.g. a copy of your passport) are visible only to you. The files are kept in non-public storage at Supabase in the EU and are only served through short-lived signed links. Legal basis: Art. 6(1)(b) GDPR.

This includes the trip checklist: items that members add (e.g. a vaccination or a visa) and who has already ticked them off. Whether you tick an item off is up to you; the tick is visible to everyone on that trip. If an item concerns your health (such as a vaccination), this is health data (Art. 9 GDPR) that you provide voluntarily. The legal basis for that is your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by removing the tick. Reminders about open items are sent as an in-app notification and by email (via Resend, see section 10).

Calendar subscription: if you choose, you create a private link for a trip that your calendar app (e.g. Apple Calendar, Google Calendar, Outlook) fetches regularly. The link contains a random key and returns, without signing in, the trip data that concerns you: the trip dates, your flights and other transport, car rentals, stays with their address and your open checklist items with a due date. This data is passed to your calendar app's provider and stored there under its terms. Anyone who knows the link can fetch this data; you can reset it at any time, after which the old link stops working. If you leave the trip or close your account, the link no longer returns any data. Legal basis: Art. 6(1)(b) GDPR.

Offline on your phone (apps only): when you open a trip in the app, it keeps a copy in the app's storage on your phone (stops with stays, transport with booking codes, your checklist items, the members; no amounts) so you can read it without a connection; at most six trips, each until 3 days after it ends. If you switch a document to "Offline", the app downloads the file into its storage (at most 100 MB, excluded from iCloud and Google backups); it is removed when the document is deleted, 3 days after the trip, when you sign out or when another account signs in. For the home screen widget, the app stores your current or next trip (name, dates, stops with stays) and your flights on it (flight number, airports, times, boarding, gate, terminal, baggage belt) in storage shared by the app and the widget; signing out deletes it. These copies stay on your device and go to no one. Legal basis: Art. 6(1)(b) GDPR.

6. Cost splitting

Costs you add (amounts, who paid, who shares it) are stored and shown to the relevant trip members to enable splitting bills. To settle up, the app can generate a PayPal.me payment link containing the amount and the recipient's PayPal.me handle; no data is sent to PayPal directly by the app: the link simply opens PayPal's own website, where PayPal's privacy policy applies. Legal basis: Art. 6(1)(b) GDPR.

SillyMoney (sillymoney.io), the expense app by the same operator, uses the same account. You only use SillyMoney if you agree on your first visit there. Fellow travelers who use SillyMoney can bring a shared trip's costs over and sync them. If you don't use SillyMoney, you only appear there with your display name on your costs, for the members of that group, who see the same here; your payment details aren't shared there. Legal basis: Art. 6(1)(b) and (f) GDPR (settling up together, which your fellow travelers use).

7. Invitations

A trip member can add another registered user by email, or generate an invite link; adding by email checks whether an account exists for that address. Legal basis: Art. 6(1)(b) GDPR.

For the referral program every account has a personal invite link that you share yourself; we don't send invitation emails. When someone signs up through such a link, we store whose link it was. The person who shared it sees how many signed up through their link and the display names of those who have been on one of their trips for at least 3 days, so they can follow their progress. Legal basis: Art. 6(1)(b) GDPR (taking part in the program) and (f) GDPR (traceability, protection against abuse).

If you sign up through a promo link with a code (e.g. from a forum post), your browser keeps the code in a cookie for 30 days, and we store with your account which code you used and how many extra credits it gave you. This is for crediting them and limiting each code, and it is deleted when you close your account. Legal basis: Art. 6(1)(b) GDPR.

8. Hosting & processors

This site is hosted with:

• Supabase, Inc. (database, authentication, file storage). Data is stored in AWS region eu-west-3 (Paris, France), i.e. within the EU.
• Vercel Inc. (app delivery). Vercel may process requests via servers outside the EU; appropriate safeguards (e.g. EU Standard Contractual Clauses) apply.
• Google Ireland Ltd. / Google LLC (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service), only in the iPhone and Android apps, to deliver push notifications. Processing outside the EU may occur here too; EU Standard Contractual Clauses or the EU-US Data Privacy Framework apply.

Push notifications (apps only): if you allow them when you first sign in to the app, we store a device token, the platform (iOS/Android) and your language, so we can tell you about new invites, costs you're part of, checklist items and changes to your trips. The notification text (e.g. trip name, a person's name, an amount) is passed to Firebase Cloud Messaging and from there to Apple or Google. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your device settings; you can also mute notifications for individual trips. The token is deleted when you close your account or when the push service reports it as invalid.

Under "Notifications" in your profile you choose which kinds of push notifications you get (expenses, trip planning, trip reminders, app news). Trip reminders are one notification at noon the day before a trip starts and, if you have no other trip planned yet, one at noon the day after it ends; so they arrive at the right time, we store your device's time zone with the device token. "App news" are occasional notes from us about new features of Mochilo; they appear in your in-app notifications and as a push notification unless you switch them off (legal basis: Art. 6(1)(f) GDPR). Promotional notifications ("Offers and discounts", e.g. partner offers or discounts) are only sent if you explicitly switch them on there; we store when you gave that consent. You can withdraw it at any time with the same switch. Legal basis: Art. 6(1)(a) GDPR and § 7(2) UWG (German Unfair Competition Act).

Security: all connections are encrypted with TLS. The data is stored in the EU (Paris). Who may read and change which data is enforced by the database itself (row-level security); files are only served through short-lived signed links, and secret keys stay on the server.

If you download the app from Apple's App Store or the Google Play Store, Apple or Google process the download data under their own responsibility and privacy policies.

9. Sign-up notifications

When you register, your display name and email are sent once to ntfy.sh, a push-notification service, to alert me as the operator about the new account so I can spot misuse early. ntfy.sh's own privacy policy applies. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the service from abuse).

10. Approval email

When an account is approved by hand (accounts from before 22 October 2026, when new accounts were still approved manually), I send a one-time email about it via Resend (Plus Five Five, Inc., USA). This transmits your email address and display name to Resend. Processing takes place in the USA; the EU Standard Contractual Clauses incorporated into Resend's Art. 28 GDPR processor agreement apply, as does Resend's certification under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR (performing the registration you requested) / (f) (legitimate interest in a working sign-up process).

11. CAPTCHA protection

To prevent automated mass sign-ups, registering, signing in, and requesting a new confirmation email embed a CAPTCHA widget from Cloudflare (Turnstile). This transmits your IP address and certain browser signals to Cloudflare, Inc. (USA), used there to assess whether the request comes from a real person or a bot. Turnstile doesn't use tracking cookies for advertising purposes. Processing takes place in the USA under EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting against abuse and automated sign-ups).

12. AI assistant

Accounts with access to the optional AI feature can type free text (e.g. a trip description) on the trip page or the dashboard to get automatic suggestions for trip data (stops, stays, flights, car rentals, other transport, costs, trip checklist items) or the basic details of a new trip. Existing checklist items and who has ticked them off are never sent to the AI; new items are only created from what you type yourself. On the trip page, you can also attach a PDF of an existing itinerary to have trip data extracted from it; the file is likewise sent to Anthropic for processing, but we don't store it ourselves, it's read once for that request and then discarded. Likewise, in the dashboard's "Currently underway" area you can send a photo of a receipt (or a short note) to get a single expense suggested; the photo is scaled down in your browser first and isn't stored by us either. This text, together with some context about that trip (e.g. existing stop names, co-travelers' names, the trip's currency), is sent to Anthropic PBC (USA) for processing, which generates the suggestion; you review it before anything is saved, and it's only stored once you confirm it. Anthropic processes the request solely to generate the response and does not use it to train its own models. According to Anthropic, it deletes inputs and outputs within 30 days; requests flagged as violating its usage policy may be kept for up to two years. If the standard model can't read a difficult document, the same request goes once to a larger model of the same provider. The text you enter is also logged in our database together with a timestamp and your user ID, to detect abuse and improve the feature (for an attached file, only a note that a file was attached is logged, not its content). Each request also records whether it was answered, answered with a follow-up question or refused, whether it contained instructions aimed at the AI (e.g. hidden commands in a document), and how many tokens it used. As the operator, I can view refused or flagged requests to detect abuse and, if needed, disable the AI feature for an account. The text you entered is deleted after 90 days; the remaining details (time, outcome, token usage) are kept until you close your account (see Section 15). Legal basis for this: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and controlling costs). Processing in the USA takes place under EU Standard Contractual Clauses. The feature is optional, enabled only for selected accounts, and only triggered when you actively use it. Legal basis: Art. 6(1)(a) GDPR (you decide on each individual input) / (b) (performing this feature you requested).

The AI assistant on trips uses credits. For that, we store your balance and a history with your account: starting credits, top-ups, how many credits each AI request used or got back, and manual adjustments by the operator. You can see the history on your profile, and it is deleted when you close your account. We also store your tier (Daypack, Backpack, Explorer, Globetrotter) with the source and time of each unlock and, for the yearly join allowance, which trips you joined in which year. Legal basis: Art. 6(1)(b) GDPR (providing the feature you use).

AI suggestions for a destination (entry, visa, vaccinations, insurance) are generated in advance per country and nationality from the Federal Foreign Office's public travel advice (for British passports from the UK Foreign Office's on GOV.UK), reviewed by us and stored. No personal data is sent to the AI for this. If you open suggestions for a country that doesn't have any yet, we only store the country and the nationality (not linked to you) so we can add them.

You can also dictate into the AI field on the dashboard. This uses your browser's speech recognition: the recording isn't sent to us but, depending on the browser, to its vendor (Google for Chrome, Apple for Safari, or recognized on the device itself), and only the recognized text ends up in the input field. The microphone is used only after you allow it and only when you tap the microphone icon.

13. Third-party embeds

The maps load their map data from OpenFreeMap (tiles.openfreemap.org), and the place search when adding a stop queries OpenStreetMap's Nominatim service, and the suggestions while typing come from komoot GmbH's Photon service (photon.komoot.io). This transmits your IP address to the respective service, and for the place search also the search term you typed and the trip's countries. Legal basis: Art. 6(1)(f) GDPR.

Exchange rates (for expenses in another currency and the “On the ground” info on a trip) are fetched by your browser from open.er-api.com (ExchangeRate-API). This transmits your IP address and the trip's currency, no details about you or the trip. Local time and time difference are calculated on your device. Legal basis: Art. 6(1)(f) GDPR.

If you turn on flight alerts for a trip, shortly before departure we send the flight number and date of your flights to AeroDataBox, a provider of flight status data, and receive changes such as delays, gate changes or cancellations from them. No names or other details about you are transmitted. We keep the status until the flight is over and show it to everyone on the trip. Legal basis: Art. 6(1)(b) GDPR (a feature you asked for); you can turn flight alerts off at any time on the Flights tab.

For the weather at a trip's stops (forecast, typical weather and severe weather alerts), our servers regularly query Apple Weather (WeatherKit, Apple Inc.). Only the stops' coordinates, rounded to about 11 km, calendar dates and, for alerts, the country are transmitted, no names, addresses or details about you or the trip; trips to the same place share the data. We send you orange and red alerts as notifications; you can turn that off in your profile. When the weather is shown, your browser loads the Apple Weather logo from weatherkit.apple.com, which transmits your IP address. Sunrise and sunset are calculated on your device. Legal basis: Art. 6(1)(f) GDPR.

Under “Hiking” at a trip's stops, “Hikes on komoot” opens komoot (komoot GmbH, Schönefeld, Germany) with the stop's name and its coordinates rounded to about 1 km, and “Trails on Wikiloc” opens Wikiloc (Wikiloc Outdoor, S.L., Spain) with a map area around those coordinates, each without a partner ID or details about you. What komoot or Wikiloc process after the click is governed by their own privacy policies. When you paste a komoot link into an activity, our server loads that one tour page once to take over its name, length, duration and difficulty; only the tour's address is sent, nothing about you. Wikiloc and GetYourGuide links are read from the address alone, without loading anything. Legal basis: Art. 6(1)(f) GDPR.

Partner links: under “What would you like to do?” at a trip's stops, we link to searches on GetYourGuide (GetYourGuide Deutschland GmbH, Berlin). These links are labelled as partner links: if you book through them, we receive a commission, and your price stays the same. The link contains only the place, the travel dates, our partner ID and the chosen category, no names or details about you; we don't learn whether or what you book, only the total commission. What GetYourGuide processes after the click is governed by its own privacy policy. For stops without a place to stay and on the underway card, we also link to an accommodation search through Stay22 (Stay22 Technologies Inc., Canada), which forwards to providers such as Booking.com, Expedia or Vrbo; that link contains the stop's coordinates or name, the travel dates, the number of travelers, language, currency and our partner ID, again no names or details about you. Canada is covered by an adequacy decision of the European Commission. “Restaurants nearby” opens Apple Maps or Google Maps with the stop's coordinates, without a partner ID. Legal basis: Art. 6(1)(f) GDPR.

14. Cookies

This site uses only strictly necessary cookies: one to remember your language choice, Supabase's own session cookies to keep you logged in and, if you arrive through an invite link (cookie "ref") or a promo link (cookie "promo"), one with its code so the invitation or the extra credits reach your new account when you sign up; it is kept for at most 30 days (see section 7). No tracking or marketing cookies are used. Legal basis: § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6(1)(b) and (f) GDPR.

Audience measurement: to see which pages are used, we count page views with Vercel Web Analytics (Vercel Inc.). It sets no cookies and stores nothing on your device. It records the page visited (without parameters or invite codes), the referring page, country, browser, operating system and device type. Visitors are told apart only by a hash derived from the request and discarded daily; your IP address is not stored, and no profile is built across days or websites. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymous usage statistics). For processing outside the EU, see section 8.

15. Retention & deletion

Your data is kept as long as your account exists or you're a member of a trip. You can delete individual trips, bookings and expenses yourself at any time. Using "Close my account" on your profile page, you can close your account yourself at any time: your display name, profile picture, PayPal handle and bank details are removed immediately; on trips you were part of, you remain visible as "Deleted user" so cost-splitting stays correct for your co-travelers. Alternatively, you can always email me for full deletion instead.

A trip's documents are deleted automatically 90 days after its end date, or 30 days after it was archived, whichever comes first. Members are notified at least seven days before. Personal documents stay until you delete them; when you close your account, they are deleted within a day.

16. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) under the GDPR. Just email me.

Right to object (Art. 21 GDPR): where I process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. This covers abuse checks and usage figures per account (sections 3 and 12), sign-up notifications via ntfy.sh (section 9), CAPTCHA protection (section 11), page view counting with Vercel Web Analytics (section 14) and invitation tracking (section 7). An email to me is enough. I will then stop processing the data unless there are compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You can withdraw any consent at any time with effect for the future: push notifications in your device settings, promotional notifications with the "Offers and discounts" switch in your profile, health information in the checklist by removing the tick, and your legal name for document matching by deleting it in your profile.

I make no decisions based solely on automated processing, including profiling (Art. 22 GDPR). AI suggestions are only saved once you confirm them; a person decides on blocking AI access.

17. Right to complain

You may lodge a complaint with a data protection supervisory authority. The competent authority here is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin (datenschutz-berlin.de).

18. Changes

I may update this policy to reflect legal or service changes; the version published here is always the current one.

Last updated: November 2026