Privacy policy
Patorana is built to work offline. Most of what you put into it — saved places, trips, journal, expenses and photos — stays on your device. This policy explains the few things that do leave it, and only when you choose.
The short version
- No advertising, no third-party analytics and no tracking. We do not sell or rent your information, and we do not build advertising profiles.
- You do not need an account to browse destinations, plan trips, keep a journal or track expenses.
- Your location is used on your device. It is sent to us only if you choose to place a sighting on the map.
- If you create an account, we store what you sync so you can use it on your other devices, and you can delete the account in the app at any time.
- You can ask us what we hold about you, ask us to correct or delete it, and complain to a data protection authority.
1. Who is responsible
Patorana is made by Terrigence Labs TODO: registered legal name, company registration number and registered address in Kenya. Terrigence Labs decides how and why your information is used and is the data controller for it under Kenya's Data Protection Act, 2019 and, where it applies, the EU and UK General Data Protection Regulation (GDPR).
Contact for anything in this policy, including requests about your data: hello@terrigencelabs.com TODO: confirm the address exists; consider a separate privacy@ address and naming a data protection officer if one is appointed.
TODO (legal review): whether an EU representative under GDPR Article 27 is needed while Patorana is offered to people in the EU — see docs/release/COMPLIANCE_ASSESSMENTS.md.
2. What stays on your device
These are stored only on your iPhone, iPad or Apple Watch and are not sent to us unless a later section says so:
- Destination information — the destination packs, maps and photos you download. Downloading them does not identify you.
- Saved places, trips, day plans, budgets, journal entries (memories), expenses and photos you add. Photos you pick are copied into the app with their location data removed; Patorana never reads the rest of your photo library.
- Your location, when you allow it "while using the app": to show where you are on the map, sort places by distance and suggest marking a trip stop as visited. Patorana never asks for location in the background.
- Settings and preferences, recent searches and the list of story authors you have blocked.
- Widgets, Lock Screen and Apple Watch — your next stop, trip days and sunrise and sunset times are shared between the app, its widgets and your paired Apple Watch on your devices only.
- Diagnostics — crash and performance reports that iOS gives the app (MetricKit) are kept on the device and never sent automatically. You can share or delete them in Settings → Privacy. If you choose to send one to us, it contains technical information about the app and device, not your trips or photos.
- Sign-in details, if you have an account, are kept in the device's secure Keychain.
Apple also provides parts of the app: maps, directions between your trip stops and map images on trip cards come from Apple Maps, and Apple's own privacy policy covers those requests. When you ask for directions, Apple receives the two stops, not your current position.
3. What we receive, and why
| When | What we receive | Why | Legal basis |
|---|---|---|---|
| The app checks for destination updates and loads public content (catalogue, search, live notices, stories, cost insights) | The request itself: your IP address, the app version and the device's language. Search words are used to answer the search and are not stored with anything that identifies you. | To deliver content, keep the service secure and stop abuse (rate limits). | Legitimate interests (running a secure service) |
| You report a problem with a place | Your message, the place, the app and pack version, and your email address only if you add it. | To check and correct the information, and to reply if you asked us to. | Legitimate interests (accurate information); consent for the optional email |
| You ask for a place to be removed (owners and managers) | Your name, email, your relationship to the place and your reasons. | To handle the request and contact you about it. | Legitimate interests; legal obligation where the law requires removal |
| You post a road or trail condition report | The destination, route, condition and your optional note. Sent without your account. | Shown to other travellers for a short time (see §5). | Legitimate interests (traveller safety) |
| You report a wildlife sighting (opt-in) | The species, time, count, optional note and the point you place on the map — which is your current position only if you tap "Use my current location". Sent without your account. | Shown to others only as a wider area after a delay, and never for sensitive species, to protect wildlife (§5). | Consent (you opt in to sightings) |
| You turn on trip alerts | A notification token for this device from Apple, the device language and time zone, and which alerts you chose. Not linked to your account; never your location. | To send the alerts you asked for, at sensible local times. | Consent (you can turn alerts off at any time) |
| You create an account (Sign in with Apple or an emailed sign-in link) | An account ID, your email address (or Apple's private relay address), and your name if you share it through Sign in with Apple. | To sign you in and keep your data separate from everyone else's. | Contract (providing the account you asked for) |
| While you are signed in, sync runs automatically | Your trips (including notes, booking references, the names of people you travel with and the coordinates of any custom stops you type), journal entries, ratings, budgets and expenses (amounts, categories, payment method and who paid), and your photos. Photos are uploaded only on Wi-Fi or other unmetered connections and are re-encoded first so they carry no location or camera data. | To keep your devices in step and restore your data on a new device. | Contract |
| You publish a trip story | The story you write and the details you choose to include (dates, number of days, travel style, optional costs, tips, ratings and photos), shown with your display name. | To show your story to other travellers, publicly or by private link, as you choose. | Contract; consent for optional costs and ratings |
| You report or block a story author | The reason and optional message; blocks are linked to your account. | Moderation and to hide content you don't want to see. | Legitimate interests (a safe community) |
We do not use your information for automated decisions that have legal or similarly significant effects on you. New stories are checked by a person before they appear.
4. Stories: what other people can see
- A public story shows your display name, the trip's length and end date, and what you chose to include. It never shows your home, where your trip started, or location data from your photos.
- Stories appear only after your trip has ended and at least 24 hours after you submit them, and only after review.
- You can edit or withdraw a story at any time. Withdrawn stories disappear from the app straight away and are deleted from our systems within 30 days.
- Other people can report a story; stories with several reports are hidden until we review them.
5. How long we keep it
| Information | How long |
|---|---|
| Your account and synced data | Until you delete them or the account. After you delete your account, sign-in is blocked immediately, your email and name are removed straight away, and everything else — synced records, photos and stories — is erased within 30 days. |
| Backups | Encrypted daily backups are kept for 35 days and monthly backups for 12 months, then deleted, so deleted information can remain in a backup until then. We do not restore deleted accounts from backups. |
| Sign-in links | Valid for 15 minutes and usable once. TODO: delete expired links (and the email address they carry) after a set period, e.g. 7 days. |
| Problem reports and removal requests | TODO: decide and implement, e.g. 24 months after the report is closed, then deleted or anonymised. |
| Road and trail reports | Shown for 72 hours (roads) or 7 days (trails). TODO: how long expired reports are kept. |
| Sightings | The exact point is kept for up to 30 days, then only the wider area remains. |
| Alert tokens | Until you turn alerts off. TODO: delete deactivated tokens after a set period instead of keeping them. |
| Server logs (including IP addresses) | TODO: set log rotation, e.g. 30 days. |
6. Who we share it with
We never sell your information. We share it only with service providers who process it on our behalf, under contract, to run Patorana:
- Hosting for the Patorana server and database — Microsoft Azure, South Africa.
- Network security and delivery — Cloudflare, on its global network. Traffic is decrypted at Cloudflare's edge so it can be inspected and passed on.
- File storage and delivery for destination packs, maps and synced or published photos — Cloudflare R2, stored in Western Europe.
- Email delivery for sign-in links — TODO: provider and country.
- Apple — Sign in with Apple, and Apple Push Notification service to deliver the alerts you turn on.
We may also disclose information when the law requires it, to protect people from harm, or as part of a sale or reorganisation of Terrigence Labs (in which case this policy continues to apply).
7. International transfers
Terrigence Labs is based in Kenya. Our service providers may store or process information in other countries TODO: list them once hosting is chosen. Where information leaves Kenya, the European Economic Area or the UK, we rely on the safeguards those laws require — for example contractual clauses approved for the purpose — and you can ask us for details.
8. How we protect it
- All connections between the app and our server use HTTPS.
- Sign-in tokens are stored in the device Keychain; on the server, refresh tokens and sign-in links are stored only as one-way hashes.
- Your photos are stored on the device with iOS data protection; location metadata is removed before any photo leaves the device.
- Our backups are encrypted, and access to admin tools is limited to approved networks.
If a breach puts your information at risk, we will notify the Office of the Data Protection Commissioner (Kenya) and, where required, other authorities within the time the law sets (72 hours under Kenyan law and the GDPR), and tell you without undue delay when it is likely to affect you.
9. Your rights
Under Kenya's Data Protection Act, 2019 and, where it applies, the GDPR, you have the right to:
- be told how your information is used (this policy);
- get a copy of the information we hold about you;
- have inaccurate information corrected;
- have your information deleted — you can delete your account yourself in the app under Settings → Account → Delete account;
- object to, or ask us to restrict, how we use it;
- receive the information you gave us in a portable format;
- withdraw consent at any time (for example by turning off sightings or alerts) without affecting what happened before.
To use any of these rights, email hello@terrigencelabs.com. We may need to confirm it is you. We reply within the time the law allows and without charge in most cases. TODO: confirm response deadlines under the Data Protection (General) Regulations, 2021 and build a data-export process — the app has no export button yet.
You can also complain to the Office of the Data Protection Commissioner, Kenya (odpc.go.ke), or to the data protection authority where you live or work in the EU or the UK. We would appreciate the chance to put things right first.
10. Children
Patorana is a travel planning app for adults and families; it is not directed at children. Under Kenyan law anyone under 18 is a child, and their information needs a parent's or guardian's consent. An account and published stories are for people aged 18 or over, or younger people with a parent's or guardian's permission TODO (product and legal decision): minimum age and how it is checked — see 06 §7. If you believe a child has given us information without that consent, contact us and we will delete it.
11. Tracking, cookies and advertising
The app contains no advertising, no third-party analytics and no tracking tools, and does not track you across other companies' apps or websites. This website uses no cookies, analytics or external fonts or scripts.
12. Changes to this policy
When we change this policy we update the date and version at the top. If a change affects what we collect or how we use it, we will tell you in the app before it takes effect. Previous versions are available on request.