Privacy
What leaves your phone.
Plain language, with the specifics. The formal version is the privacy policy. If the two ever disagree, tell us; the facts should match.
The short version
- No ads, and your data is never sold.
- Your trips are visible only to the people you put on them. We don’t read them to build a profile of you.
- The AI never sees names, booking codes, dates, links or the trip’s name. They are removed before any text goes to the model, and text that can’t be cleaned is not sent at all.
- Search, reading your documents and natural-language answers happen on the phone.
- Photo locations are rounded to about a hundred metres before upload, and the server refuses anything more precise.
- Delete your account from Settings, with a 7-day grace period, and export everything first.
- Crash reports go to PostHog with no trips, names or account details. They’re on by default, and you can turn them off in Settings. See below.
- There are no product analytics in the app yet. When they come, they’ll be anonymous and used only to improve Faring.
What leaves your phone, and where it goes
Faring sends data to its own service so your group can share a plan. Here is each other party that is involved and exactly what it sees.
| Goes to | What | Why | What it never gets |
|---|---|---|---|
| Faring’s own service | Your account email and name; the trips, days, bookings, places, people, lists, documents and links you and your group put in | So the plan is shared, synced and kept while you are offline | Your device location (Faring doesn’t ask for it), your contacts, your calendar beyond the events you picked |
| Apple Maps | The place name you type when you search for a place | To find the address and a pin | Who you are, the trip, anyone’s dates |
| A weather provider (Open-Meteo) | A 0.1-degree map cell (about 11 km) and the dates, sent by Faring’s server | The forecast on each Day | Your identity, the exact place, the trip name |
| A stock-photo provider (Unsplash) | A city or region name, sent by Faring’s server | The destination photo on Home, with its credit line | Anything about you or your group; the photo is never chosen from trip data |
| The AI model for suggestions | Short text from a booking or activity with every name, code, date, link and the trip name removed | Typed suggestions, such as a missing stay, which you accept or dismiss | Names, codes, dates, links, trip names; text that can’t be cleaned is refused |
| Your assistant (Claude), if you connect one | What your role can see in the trips you choose, through a key you made in Settings | So it can read and, with your confirmation, write to the plan | More than your own role allows; the key can be revoked any time |
| Amazon’s email service (Amazon SES) | Your email address and the email: the link that confirms your place on the waitlist, or your invite code. Amazon keeps a record that it was sent | To deliver the email | Your trips or anything else you put in Faring |
| PostHog, a crash-reporting service, while Share crash reports is on | When the app crashes or hits an error: the app version, iPhone model and screen size, iOS version, language and region, where in the code it failed and the names of the code libraries loaded, the last 20 app steps as short codes, and a random diagnostics ID. Like any web request, it also carries your IP address, which PostHog is set to discard. Faring’s server sends its own error reports too | To find and fix crashes | Your trips, names, messages, location, email or account ID |
| Websites you add as links | A request for the page’s title and picture, with no cookies and over https only | A preview on the Idea | Who you are; Hide photos turns the picture fetches off |
Stays on the phone
- Calendar events: read only between the trip’s dates, only while the From Calendar picker is open, and never sent anywhere. The ones you choose become ordinary bookings.
- Search, the index behind it, the text read out of your documents, and the answers to questions like “when does our ferry leave”.
- Your appearance, units and other preferences.
The AI, in more detail
Faring’s suggestions come from a model that only ever receives cleaned text. Before anything is sent, the server removes every person’s name on the trip (including inside longer words), every booking code, every date, every link and the trip’s name. If a piece of text still looks like it carries one of these, it is not sent, and that costs a suggestion rather than your privacy. Suggestions are typed: the model proposes, you accept or dismiss, and nothing is written without you.
Crash reports
When Faring crashes or runs into an error, the app sends a report to PostHog, a service we use to find and fix crashes. The report says what went wrong and where in the code. It also holds the app version, the iPhone model and screen size, the iOS version, your language and region settings, the names of the code libraries loaded, and the last 20 steps the app took, as short codes with no content. It never includes your trips, names, messages, location, email or sign-in details. Faring’s server also reports its own errors to PostHog, with nothing about you.
Each report carries a diagnostics ID, a random ID the app makes for crash reports only. It isn’t your account ID, and we can’t look it up from your name or email. If you send feedback from the app, the feedback includes it, so we can find the crash. When you email us about a crash, you can copy it from Settings › Privacy & data › Copy diagnostics ID. The app makes a new ID when you turn crash reports off and on again, sign out, sign in to another account, or delete your account.
Crash reports are on by default. To stop them, turn off Share crash reports in Settings › Privacy & data. That also deletes any reports still waiting on the phone. Reports already sent stay at PostHog for up to one year, and we can’t shorten that. Our PostHog project is in the United States. PostHog is set to discard the IP address a report comes from and not to look up a location from it. It handles the reports for us under a data processing agreement.
Product analytics
TBD pending the analytics design
Crash reports aren’t product analytics: the app sends one only when something fails. We plan to add anonymous product analytics to the app so we can see how people use it and where it breaks. The commitments we will hold to: the analytics are anonymous and are not joined to your account or your trips; they are used only to improve Faring and find problems; they are never used for advertising and never sold; and if an opt-out is offered, it will be in Settings. This section will be rewritten with the exact details before the analytics ship.
Deletion and export
Settings has Delete account. Deletion is scheduled 7 days out so a mistake can be cancelled; signing in during those days offers only Cancel deletion and Export my data. The export is a ZIP of JSON plus your own photo originals, built on the server and handed to the share sheet. Your contributions to shared trips stay with the trip, attributed to “a former member”. The step-by-step is on the delete your account page.
This website
getfaring.com sets no cookies, runs no analytics and loads nothing from anyone else: the fonts are served from here. It stores two things on your device: your appearance choice, and whether the wordmark has written today. The waitlist form sends your email address, and nothing else, to Faring, which emails you a link to confirm it. That email goes out through Amazon SES. Without JavaScript the form opens an email in your own mail app instead.