Privacy policy (draft)

What we collect

When you join the waitlist we store your email address, the language you used, the countries you ticked (if any), the time you joined and the version of this notice you agreed to. We do not keep your IP address with your email.

What we use it for

Only to email you about the OneGulf launch. We do not sell or share the list.

Cookies and analytics

The website does not use analytics. It may set one cookie that remembers your language.

The OneGulf app

The app keeps your answers (language, traveller type, nationality, travel style, and the country of residence if you give it), your trips and their plans, your saved places, and, when you save your trip to an account, the phone number or Apple account you sign in with. You can use the app as a guest; a guest’s answers and trip are kept under an anonymous account. Your answers about food needs and allergies and prayer times are kept only after you agree on that screen; the beta does not ask about accessibility needs. Your precise location never leaves your phone; the app keeps only the starting city you pick.

This data is stored with Supabase in its Mumbai region. Error reports go to Sentry and carry only what locates a fault: the kind of error, where in the app’s code it happened, the app’s version, and the phone’s model and operating system. They never carry an answer, a place, a name, a phone number or your account id. Usage counts go to PostHog in the European Union, and only with your consent, as the next paragraph says.

Two more services take part. To order the places in a plan, our server sends Anthropic’s Claude model the candidate places it chose for your trip, with their names, categories, interests and positions, together with the trip’s pace, the kind of party (such as a family), your interests, the city of each day, and whether a day falls in Ramadan or in a heat window. It never sends your name, phone number, account id, travel dates, or your answers about food, accessibility or prayer; the model only chooses an order, and our server checks every choice. When you first open the app, and when you sign in by phone, a Cloudflare Turnstile check runs in a hidden web view to tell people from bots. Cloudflare sees the device’s IP address and the browser signals that check needs; the app receives only a pass token.

Counting is off until you say yes on a card that appears on Home after your first plan. With your consent, the app counts steps such as an onboarding screen completed, a plan built or a trip saved, with the app’s language and version and whether the account is a guest’s or a member’s. It never sends an answer, a place, a city, a phone number or a search, and nothing about food, accessibility or prayer. These counts are kept by PostHog in the European Union, under your account’s id. You can stop the counting at any time in Profile → Your data. We then ask PostHog to delete what it holds about you, and deleting your account does the same. Until PostHog accepts, we keep only your account’s id, in a list of deletions still to ask for, and we ask again until it does.

The Book rows on Home, under your next trip, link to booking partners, today Trip.com for stays and Airalo for eSIMs, through the Travelpayouts affiliate network. We make a link only when you tap it. It carries the city, the dates and the number of guests of a stay, or the countries of an eSIM, plus a random code that identifies the link, not you. We keep one record per link made: the code, the time, the category, the partner, the destination country and whether the network accepted the link, with no account id, and we delete it after 13 months. From the tap on, the partner’s own privacy policy applies. OneGulf may earn a commission from the partner when you book.

In the app, Profile → Your data lists each consent with a switch to withdraw it, and a button that deletes your account. Deleting removes everything at once: answers, consents, trips, plans, saved places and the sign-in. We then ask PostHog to delete your usage counts, as the paragraph above says. Deleting does not reach the SMS provider’s own logs, or backups until they are replaced.

You can also delete your OneGulf ID without the app, on the page Delete your OneGulf ID.

Deleting your email

Write to privacy@onegulf.app and we will remove your email from the list.

Changes

This text will be replaced by the reviewed policy before launch.