Menu Close

Legal

Privacy policy

DRAFT for legal review. This text was prepared from Faring’s own technical records and has not yet been reviewed by a lawyer. It is published so the facts can be checked; it does not yet bind anyone. Last edited 14 October 2026.

This policy explains what Faring (the iPhone app and the service behind it, operated by the company named at the end, “we”) does with information about you. The plain-language companion is the privacy page; where the two differ, this policy governs once it is final.

1. What we collect and why

Most of what we hold about you is there so your group can share a trip plan. We collect:

  • Account data: your email address and display name, from the sign-in provider, to run your account and so the people on your trips can see who you are.
  • Trip content: the trips, days, activities, places, bookings, people, dates, lists, notes, links, documents and photos that you and the members of your trips put in. Places come from pins picked in Apple Maps, not from your device’s location, which Faring never requests.
  • Feedback: if you send feedback from the app, the text you write, the screenshot you chose to attach, and context such as your device model, OS version, locale, app version and sync state, and the diagnostics ID while crash reports are on. Names and codes in the text are masked on the phone first. Your email is attached only if you tick the box asking for a reply.
  • Assistant connections: if you connect an assistant, the name you gave the connection key and a hash of the key. We never store the key itself.
  • Service records: ordinary server logs (request counts, error classes, timings) without trip content, kept to run the service safely.
  • Crash reports: when the app crashes or runs into an error, it sends a report to PostHog, a service we use to find and fix crashes (section 3). A report holds the app version, the iPhone model and screen size, the iOS version, the language and region settings, where in the code the problem happened, the names of the code libraries loaded, and the last 20 steps the app took, as short codes with no content. It never includes your trips, names, messages, location, email or sign-in details. Our server also sends PostHog a report when something fails on it, with where in the code it failed, the kind of error and a random request ID, and nothing about you. Crash reports are on by default. You can turn them off in Settings › Privacy & data › Crash reports, which also deletes any reports on the phone that have not been sent yet.
  • Diagnostics ID: each crash report from the app carries a random ID that the app makes for crash reports only. It is not your account ID, and PostHog never learns your account, your email or your trips. The ID is linked to you only when you send it to us: feedback from the app includes it while crash reports are on, and you can copy it from Settings to put in an email. We use it only to find the crash reports from your phone. The app makes a new ID when you turn crash reports off and on again, sign out, sign in to another account, or delete your account.

We do not collect your precise or coarse device location, your contacts, your purchases, or the advertising and vendor identifiers Apple assigns to your device. Faring contains no advertising SDK.

2. Product analytics

TBD pending the analytics design

Crash reports (section 1) are not product analytics: the app sends one only when something fails, and we use it only to find and fix the problem.

We intend to add anonymous product analytics to the app to understand how it is used and where it fails. When we do: the data will be anonymous and not joined to your account, your identity or your trips; it will be used only to improve Faring and find problems; it will never be used for advertising and never sold; and if an opt-out is offered it will be in the app’s Settings. This section will be rewritten with the specific categories, provider (if any) and retention before the analytics are released.

3. Who else sees data, and what

  • Apple Maps receives the text you type when searching for a place, from your phone.
  • Open-Meteo (weather) receives a 0.1-degree map cell and dates from our server, never your identity or an exact place.
  • Unsplash (destination photos) receives a city or region name from our server, never trip or personal data; your phone then loads the chosen image from Unsplash’s image host.
  • The AI model used for suggestions receives short text from a booking or activity after our server has removed every person’s name on the trip, booking codes, dates, links and the trip’s name. Text that cannot be cleaned is not sent.
  • An assistant you connect (such as Claude Desktop or Claude Code) can read what your role can read in the trips you allow, and write with your confirmation, through a key you can revoke in Settings. The assistant’s own provider handles that data under its terms.
  • Websites you add as links receive a request for the page’s title and picture, without cookies, from your phone or the phone of a member viewing the link.
  • Amazon SES, the email service of Amazon Web Services, sends two kinds of email for us: the link that confirms your place on the waitlist, sent from getfaring.com, and the code that invites you into the app. It receives your email address and the email itself, and uses them only to deliver the email. Amazon keeps a record of each delivery. If an email to you can’t be delivered at all, or you mark it as spam, Amazon may add your address to a list of addresses we no longer send to. When you ask us to take you off the waitlist, we ask Amazon to take that address off the list. When you delete your account, we ask Amazon to remove the address you sign in with.
  • PostHog receives crash and error reports from the app and from our server (section 1). They contain no trip content and no account ID. PostHog is set to discard the IP address a report comes from and not to look up a location from it. Our PostHog project is hosted in the United States. PostHog processes the reports on our behalf under a data processing agreement. Its sub-processors are listed at posthog.com/subprocessors.
  • Our hosting providers store the service’s data on our behalf under contracts that forbid any other use.
  • The sign-in provider we operate handles your email and password or Apple sign-in; it is part of our service.

We do not sell personal data, share it for advertising, or give it to data brokers.

4. The members of your trips

Trip content is visible to the members of that trip according to their role. The Organizer and Co-organizers decide who is a member. Documents marked “Only you” are visible only to you. Your changes are recorded with your name so members can see who changed what. If you leave or delete your account, your contributions stay with the trip attributed to “a former member”.

5. Where processing happens on your phone

Search, the index behind it, text recognised in your documents, natural-language answers, calendar reading (only between the trip’s dates and only while the picker is open), and link previews all run on your phone and are not sent to us. The trip is kept on your phone so it works offline, for up to 30 days without a connection.

6. Photos

If you add photos to a trip, we store the originals you chose. Any location in a photo is rounded to about a hundred metres on the phone before upload, and the server refuses precise coordinates.

7. How long we keep data

  • Trip content: as long as the trip exists. Removed items are kept in history for 90 days so they can be undone, then purged.
  • Account data: until you delete your account (section 8).
  • Feedback: until it has been acted on and purged by us.
  • Server logs: a short rolling window for operating the service.
  • Crash reports: up to one year at PostHog, a period we cannot shorten. Turning crash reports off in Settings stops new reports and deletes unsent ones on the phone. It does not remove reports already sent.

8. Deleting your account and exporting your data

You can delete your account from Settings in the app. Deletion is scheduled 7 days after the request, during which you can cancel it by signing in. Your sessions, assistant keys and pending invitations end at once. At the end of the grace period we delete your identities, sign-in account, sessions, keys, private lists, your own photos, solo trips and exports, and we anonymise your account record so that your contributions to shared trips remain readable to their members as “a former member”. Trips you organize need a choice first: hand over, archive then delete, or delete now for everyone. You receive a receipt code whose status can be checked without an account.

You can export your data from Settings at any time, including during the grace period: a ZIP of JSON and your own photo originals, built on our server and delivered to your phone. See delete your account for the steps.

9. Your rights

Depending on where you live you may have rights to access, correct, export, restrict or delete personal data, and to complain to a supervisory authority. The app gives you access, correction, export and deletion directly. For anything else, email hello@getfaring.com.

10. Children

Faring accounts are for adults. A person under the age of digital consent may be on a trip as a name and dates added by an adult, without an account.

11. Security

Data travels over encrypted connections. Documents are scanned for malware on upload. Access is limited by role, and our systems deny access by default. [Legal review: confirm the at-rest encryption statement for production storage before publishing.]

12. This website

getfaring.com sets no cookies, runs no analytics and loads no third-party resources. If you join the waitlist we keep your email until the beta is over or you ask us to remove it. The confirmation email goes out through Amazon SES (section 3). Apart from Amazon sending that email, nobody else gets your address. [Legal review: as built, an address that is not confirmed is removed once its link expires, 7 days after the last confirmation email, at the next clean-up run; a confirmed one is kept until we invite that person or they ask us to remove it. Draft wording is in faring docs/design/waitlist.md, “Privacy policy: draft note”.]

13. Changes to this policy

We will post changes here with the date, and tell members in the app when a change matters.

14. Contact

[Legal review: company name, registered address and jurisdiction to be inserted.]
Email: hello@getfaring.com