Traceflap Privacy Policy

Last updated: 24 October 2026 (draft, review by a specialist pending)

This is a translation for convenience. The German version is binding.

Controller: Gregor Scheiwiller, LAB336, Switzerland. Contact: gregor@lab336.ch

Traceflap processes as much as possible directly on your iPhone. There is no account, no advertising and no tracking.

This website

• Hosting: The website is served by Vercel Inc. (USA). When you visit, Vercel processes technical data (time, page, IP address, browser) in logs that are deleted after a short time.
• No cookies without consent: The start page and the legal pages set no cookies and load no third-party services. We do not embed analytics or advertising services.
• Font: We serve the Sora font ourselves; no fonts are loaded from Google or other providers.
• City guide pages (traceflap.com/en/guide/…): The map loads tiles from OpenFreeMap (no cookies; OpenFreeMap sees your IP address). Photos are served by us. Links to partners (Tiqets, WeGoTrip, Aviasales, Kiwi.com, Welcome Pickups, Airalo) are marked as partner links; if you click them, the provider's and Travelpayouts' terms apply, and we earn a commission on bookings.
• Images from venue websites: Where no freely licensed photo exists, the city guide pages show the preview image from the venue's own website, with credit and link. Your browser loads it directly from there, so the venue sees your IP address, as when visiting its site. We do not store these images.
• Stay22 (hotels, only with consent): The hotel map on the city guide pages and on the flight search comes from Stay22 (Canada). It loads only after your yes; Stay22 sees your IP address and the map area and sets cookies to attribute bookings. If someone books, we earn a commission.
• Flight search (flights.traceflap.com): The flight search is a page run by Travelpayouts (Go Travel Un Limited, Hong Kong) with prices from Aviasales; we only design its look and texts. When it loads, scripts from Travelpayouts and Aviasales and fonts from Google Fonts are fetched; these services see your IP address. Travelpayouts sets cookies for language, currency and recent searches and records usage statistics (Snowplow). Your search details (places, dates, number of travellers) go to Travelpayouts and the flight sites. If you choose an offer, you move to that provider; its terms apply, the provider is your contracting party, and we earn a commission on a booking. The Stay22 hotel map there loads only after your click.
• Travelpayouts Drive (only with consent): On the city guide pages we ask whether we may load a script from Travelpayouts (Go Travel Un Limited, Hong Kong). It turns links to travel providers into partner links, shows previews when you hover over a link and sets cookies that let Travelpayouts count clicks and bookings. Nothing is loaded without your yes. We remember your choice in your browser; you can withdraw it any time via "Change consent" at the bottom of the page.
• Mail: If you write to us, we use your address only to reply.

The following statement applies to the app.

1. What stays on your iPhone

• Trips and journal: stored only on the iPhone.
• Location: for your position during the trip, the arrow to the platform or gate and suggestions nearby. In the background only during a trip (blue indicator at the top).
• Motion and fitness: to detect whether you have taken a trip.
• Calendar and photos (optional): appointments for trip suggestions, photos for the journal and places visited.
• Importing bookings: emails, PDFs and screenshots are read by Apple's AI on the iPhone. They are not sent to us. A saved rental car (rental company, station, times, booking number) also stays on the iPhone; to find the station on the map, the rental company and station are sent to Apple Maps.
• Dietary preferences, preferences, places visited, boarding pass (name, booking code, seat).

2. What is sent to our server

Our server (Switzerland) fetches timetables and live data and sends alerts to the iPhone. For this, it receives:

• For connections and flights: origin, destination and time (as coordinates for addresses), flight number and date, and for "What now?" your current position. Connections abroad (e.g. from the airport to the hotel) are calculated by our server itself from open timetables; origin and destination are not passed on to any other provider.
• For the travel guide: city, location of the hotel, arrival, your preferences and, on request, your location in the city.
• For notifications and the lock screen: a device identifier from Apple (push token), the key data of the current trip and the content of the lock screen display. We delete this information 60 days after last use.
• When sharing live: trip, current leg and your position, until arrival or until you stop sharing. They are deleted afterwards.

The server stores no names, no email addresses and no boarding passes. Technical logs (time, request, IP address) are limited in size and are continuously overwritten.

3. Services of other providers

For the data, our server or the app queries these providers. They receive only the information required for the request, and the app sees their responses:

• Apple: Maps, Look Around, place search, weather (WeatherKit), notifications (APNs), on-device AI. For the passport, the app sends the origin and destination places of your trips to Apple's place search to determine the country and city.
• Timetable providers worldwide (e.g. Entur, Translink, MTA, BODS): our server regularly downloads timetables and real-time data in full, without any information about you.
• opentransportdata.swiss, Deutsche Bahn, VBB Berlin: timetables and real-time data (stops, times; for "On the way" the coordinates of your location).
• AeroDataBox (via API.Market): flight status (flight number, date, airport).
• OpenStreetMap (Overpass): gates, car parks, places (coordinates).
• Wiener Linien, Transport for London: departures at nearby stops (coordinates of the hotel or location).
• OpenHolidays API: school holidays (only country and travel date, no personal data).
• sharedmobility.ch (Swiss Federal Office of Energy): available e-scooters and bikes (coordinates of the hotel or location).
• Wikimedia Commons: photos of places (loaded directly by the app).
• Websites of venues: for preview images, the app loads the website and image of a venue directly from the iPhone. In doing so, this provider sees your IP address, as when opening the page in a browser.
• Stay22 (hotels and prices): the app loads the hotel map with prices from Stay22 as soon as you see it in the travel guide or while browsing, or tap a hotel. In doing so, the place (coordinates of the suggested neighbourhood or of the hotel), arrival and departure date, number of people, in the travel guide the location of the places in your plan, and your IP address are sent to Stay22; cookies are kept only for the session. If you tap "Book" or a hotel, the Stay22 page opens. Stay22 forwards you to a booking provider (e.g. Booking.com); their terms apply there. If someone books, we receive a commission.
• Travelpayouts (partner links to AirHelp, Welcome Pickups, Airalo, Aviasales): our server fetches flight prices while browsing (departure airport and destination city) and eSIM prices (destination country, length of trip) from Aviasales or Airalo, without any information about you. If you tap "Check compensation", "Airport pickup", a flight or the eSIM in the packing list, our server requests the partner link for the provider's page from Travelpayouts (only the address of the page, e.g. "Transfer London", no information about you). The page opens in the browser window in the app; there, Travelpayouts and the provider see your IP address and set cookies, and their terms apply. If someone books, we receive a commission.
• Tailscale: encrypted connection between the app and our server.

4. Your rights

You can request information about your data and have it corrected or deleted. You delete data on the iPhone by removing trips or deleting the app. You can change permissions (location, notifications, calendar, photos, motion) at any time in the iOS settings.

5. Changes

We amend this policy when Traceflap changes. The version in the app applies.