TravelSocial helps you map where you've been, plan where you're going, and share travel discoveries with other travelers. This policy explains what information we collect, how we use and share it, how long we keep it, and the choices and rights you have.
TravelSocial is operated by Bloom Digital Labs LLC, a Massachusetts limited liability company located at 535 Ocean Street, Hyannis, MA 02601 ("we", "us"). This policy covers the TravelSocial mobile app, the website at gettravelsocial.com, and the Founding Traveler waitlist (together, the "Service").
1. Information we collect
Information you give us
Category
Examples
Account
Your name, email address and password. We never see your password in readable form; our authentication provider stores only a protected (hashed) version.
Sign in with Apple or Google
If you choose either, we receive an account identifier from Apple or Google, your email address and, if you share it, your name. With Apple's "Hide My Email", we receive a private relay address instead of your real one.
Profile
Username, display name, profile photo, bio, home city and country, website and social media links (Instagram, TikTok, YouTube, X, Facebook), and the traveler types, travel goals, interests and travel style you choose during setup.
Places
Places you mark as visited or want to visit, visit dates, overall and category ratings (such as food, lodging, scenery, nightlife, value and safety), whether you would return, and your notes.
Posts and social activity
Posts, photos, captions, the place you attach, people you tag, comments, likes, and accounts you follow.
Trips
Trip names, descriptions, dates, stops and notes, flight details you add (airline, flight number, airports, dates, times, terminal, gate and notes), bookable experiences you save, and the collaborators you invite.
TravelSocial AI
The messages you send to TravelSocial AI, its replies and suggested places, and the trip a conversation is linked to (see section 5).
Reports and support
Reports you submit about profiles, posts or comments (the reason and any details you add), appeals you submit about moderation decisions, reports that a business's details are wrong, the travelers you block, and anything you send us when you contact support.
Agreements
The versions of our Terms of Service and Privacy Policy you accepted, when you accepted them, and your confirmation that you are 18 or older.
Settings
Your notification preferences, and your language choice (saved to your account so it follows you across devices).
Waitlist (website)
Email address and, if you provide them, first name, Instagram username and traveler type, whether you agreed to marketing emails, and the campaign link that brought you to the site.
Information collected automatically
Usage records: the days you open the app (with the first and last time that day), when you were last active, steps reached during sign-up and onboarding, notification opt-in choices, points and badge activity, and anonymous identifiers for AI requests and for experiences you view or save. We do not store the text of your AI prompts in these records.
Diagnostics: when the app hits an error, a short error category, your platform (such as iOS) and the app build number. We do not collect error messages, stack traces, screen content or chat text.
Push notifications: if you turn on notifications, a push token for your device and a one-way code identifying this installation of the app, so notifications reach the right account. On Android, notifications are delivered through Google Firebase Cloud Messaging, and Google's Firebase Installations service creates an identifier for each installation of the app. This can happen when the app starts, before you are asked about notifications, and turning notifications off does not necessarily stop it. Expo registers your device's push token and an installation identifier to issue the push token we store. We use these identifiers and tokens only to deliver notifications and operate the app.
Abuse prevention: counts of requests to features such as search and AI, used to enforce fair-use limits.
Technical logs: our hosting and infrastructure providers automatically log technical details of requests, such as IP address, device and browser type, and timestamps.
Website analytics: our website's home page uses Vercel Web Analytics, which counts page views in aggregate without setting cookies. The app contains no analytics, advertising or tracking tools, and its crash-reporting component is turned off.
Information from other sources
Apple and Google, when you use their sign-in (described above).
Google Places (business names, addresses, coordinates, hours and similar details) and Viator (tour and activity listings), used to show places and experiences.
Other travelers, for example when someone tags you in a post or invites you to a trip.
2. Device permissions
TravelSocial asks for device permissions only when you use a feature that needs them. You can change any permission at any time in your device settings.
Location (only while you're using the app): used to show nearby places, tours and activities, to sort place search results, and when you ask TravelSocial AI for ideas near you. Your coordinates are sent at that moment to the providers that answer the request (see section 6). We do not save your device's coordinates to your account, and we do not track your location in the background. The places you choose to save, post or add to a trip do include that place's location.
Contacts: used only when you tap to find friends from your contacts. The app reads contact names and compares them on your device with names of TravelSocial travelers. Your contacts are never uploaded to us or stored by us.
Photos: only the photos you select are uploaded, for your profile or posts. Before uploading, the app re-encodes each photo, which removes embedded camera metadata such as the location where the photo was taken. On October 21, 2026, we also removed embedded location information from all photos uploaded with earlier beta versions of the app.
Notifications: used to tell you about follows, comments, likes, trip activity, recommendations and daily challenges, according to the preferences you set in the app.
3. How we use information
To create and secure your account, sign you in, and verify your email address.
To provide the Service: show your travel map, profile, posts and trips to the people allowed to see them, run trip collaboration, and deliver notifications you've turned on.
To provide TravelSocial AI and personalized place, trip and experience suggestions using your saved places, ratings, trips and profile preferences.
To check that places suggested by AI exist and are open, using Google Places.
To keep the Service safe: prevent abuse, spam and fraud, enforce fair-use limits and our Terms of Service, and investigate reports.
To moderate content: text in posts, comments and profiles is automatically checked on our own servers against a list of prohibited words and phrases. Matching text may be refused or sent to a moderator for review; nothing is shared with another company for this check, and matches never suspend an account automatically.
To understand how the Service is used and improve it, using the usage and diagnostic records described above.
To communicate with you: account and security emails, responses to support requests, waitlist and beta-access emails, and, only if you opted in, launch news and product updates.
To comply with law and protect the rights, safety and property of our users, us and others.
We do not sell your personal information, and we do not use or share it for targeted (cross-context behavioral) advertising. The app contains no advertising and no third-party advertising or tracking tools. Some services built into the app to make it work, such as Google Maps and Firebase on Android, collect technical identifiers and usage metrics (for example, map interactions) to run and improve their services (see section 6).
4. What other people can see
TravelSocial is a social service. Please think about what you share.
Your profile is public. Your username, display name, profile photo, bio, home city and country, website and social links, travel style, Founding Traveler status and join date can be seen by anyone, including people who are not signed in.
Signed-in travelers can also see the traveler types, goals and interests on your profile. When you were last active is not shown to other travelers.
Posts and trips can be public (anyone), followers-only, or private. Public posts, including their photos, place, comments and likes, and public trips can be seen by people who are not signed in.
Saved places can be public or private. Public places show your ratings, notes and visit dates.
Trip collaborators you invite can see that trip's details, including stops, dates, notes, flights and saved experiences.
Tags and mentions: people you tag in a post are named on it, and other travelers can tag you.
Blocking: when you block someone, neither of you can see the other's profile, posts, comments or trips, and you stop following each other. They are not told that you blocked them.
Reports: reports you submit are seen only by our administrators. The person you report is not told who reported them.
The founder: when you join, you and TravelSocial's founder (@matt) follow each other automatically. Either of you can unfollow at any time.
Anyone who can see your content can screenshot, save or share it, and we can't control copies made outside TravelSocial.
5. TravelSocial AI
TravelSocial AI is powered by OpenAI. When you use it, we send OpenAI:
your message and recent messages from the same conversation;
relevant context from your account: your home city and country, traveler types, goals, interests and travel style; places you've visited or want to visit with your ratings; and your trips (names, descriptions, dates, stops and stop notes), or only the trip you selected;
your current coordinates, and nearby place names from OpenStreetMap, only when you ask for ideas near your current location.
We send these requests with OpenAI's response storage turned off, so OpenAI does not keep them for later retrieval through its service. OpenAI processes them on our behalf under its API terms, and may retain them for a limited period, for example to detect and prevent abuse. Your conversations are saved to your TravelSocial account so you can return to them; you can delete a conversation in the app at any time.
AI responses can be wrong, out of date or incomplete. We check suggested places against Google Places and hide places that can't be confirmed, but you should verify important details yourself. Please don't share sensitive personal information (such as health, financial or government ID details) with TravelSocial AI.
6. How we share information
We share information only as described here:
With other users, according to your visibility settings (see section 4).
With service providers that process information on our behalf to run the Service:
Provider
What it does
Information involved
Supabase
Database, authentication, file storage and server functions
All account, profile, content, trip and usage information
Place search and verification (Google Places); Sign in with Google; on Android, push notification delivery (Firebase Cloud Messaging and Firebase Installations), maps (Google Maps) and turning coordinates into a city name
Search text, AI-suggested place names, and your coordinates for nearby searches; sign-in details; on Android, push token, Firebase installation identifier and notification content, map requests and technical details such as IP address, and coordinates
Apple
Sign in with Apple; push notification delivery; on iPhone, turning coordinates into a city name
Sign-in details; push token and notification content; coordinates
Expo
Push token registration and push notification delivery
Push token, your device's push token and an installation identifier, and notification content (for example, the name of the person who followed you)
Viator (Tripadvisor)
Tour and activity listings
Search phrases such as a destination and activity. Your coordinates are not sent to Viator.
Resend
Account and verification emails
Email address and email content
Vercel
Website hosting and cookie-free website analytics
Technical request data and page views
Microsoft (Microsoft 365)
Our support mailbox
Messages you send to support and our replies
With independent third parties that provide part of a feature but are not our service providers and handle information under their own privacy policies:
OpenStreetMap (Nominatim), operated by the OpenStreetMap Foundation, for place search and nearby place names for TravelSocial AI: search text you type, sent directly from the app; an area around a trip location or, where you've allowed location, your coordinates, to sort results; and your coordinates for "near me" requests.
Google also uses technical and usage data from Google Maps on Android (such as your IP address, an identifier for the app's maps and map interactions) to maintain and improve its services.
Bookings with third parties: booking links open Viator's website or app. Anything you provide there is handled under Viator's own privacy policy, not this one. We may earn a commission on bookings made through these links.
For legal reasons: when we believe in good faith that disclosure is required by law or legal process, or necessary to protect the safety, rights or property of any person, or to investigate fraud or security issues.
Business transfers: as part of a merger, acquisition, financing or sale of assets, subject to this policy.
With your consent or at your direction.
7. How long we keep information
While your account is open, we keep your account information and content until you delete it or delete your account. You can delete posts (with their photos and comments), your own comments, trips, saved places and AI conversations in the app at any time.
When you delete your account, we delete your account and the records linked to it from our live systems, including your profile, photos and other uploaded files, posts, comments, likes, follows, blocks, saved places, trips you own that have no collaborators, AI conversations, notification settings, push registrations, usage records and any waitlist entry with your account's email address. If you use Sign in with Apple, we revoke TravelSocial's access to your Apple ID. A trip you own that has collaborators passes to the collaborator who joined it first, without your trip photos, and becomes private. Some items remain without your name attached: flights or experiences you added to someone else's trip, places you added to the shared place directory, replies other people wrote to your comments, and reports you submitted. We keep a record that the account was deleted (its internal ID, sign-in method types and when each deletion step finished), which contains no name, email address or content, for as long as we need it to show that the request was completed and to prevent abuse.
Backups: our database provider keeps daily encrypted backups for about 7 days, after which they are overwritten, so deleted information can remain in a backup for up to about 7 days. Before planned maintenance we may also take an encrypted backup, which we keep for 30 days and then delete, unless we need to keep it longer for a security investigation or a legal obligation.
Waitlist: we keep waitlist entries until you ask us to remove them. Deleting your account also removes a waitlist entry with your account's email address.
Moderation records: decisions moderators make about content or accounts (what was decided, when and the moderator's reason) are kept in an audit log for as long as needed to handle appeals, prevent repeated abuse and meet legal obligations, including after an account is deleted, where they are identified only by the account's internal ID.
Support emails and legal needs: we may keep correspondence, and information we need to comply with the law, resolve disputes or enforce our terms, for as long as reasonably necessary.
Information held by providers: some providers keep their own records for a period under their policies, for example Supabase's authentication event log (which may include your email address), email delivery logs at Resend, and server logs.
8. Your choices and controls
Edit your profile and links at any time in the app.
Choose who sees each post, trip and saved place using its visibility setting.
Notifications: choose categories in TravelSocial Settings, or turn notifications off in your device settings. On Android, this does not necessarily stop Firebase from creating an installation identifier (see section 1).
Permissions: turn location, contacts or photo access on or off in your device settings.
Marketing emails: use the unsubscribe link in any marketing email, or contact us. You will still receive account, security and beta-access emails.
Block travelers from their profile, posts or comments, and unblock them in Settings → Account → Blocked travelers.
Delete your account in the app: Profile → Settings → Account → Delete account. You confirm with your password, with Sign in with Apple, or (for Sign in with Google) by having signed in within the last 10 minutes. If you use Sign in with Google, you can also remove TravelSocial from your Google Account at myaccount.google.com/permissions. You can also email support@bloomdigitallabs.com from the address on your account, and we will delete it after confirming your identity.
9. Your privacy rights
Depending on where you live, you may have the right to:
know what personal information we have about you and get a copy;
correct inaccurate information;
delete your information;
object to or restrict certain uses, or withdraw consent you've given;
receive your information in a portable format; and
opt out of the sale of personal information or its sharing for targeted advertising (we do neither).
To make a request, contact us at support@bloomdigitallabs.com. We will verify your identity before responding, usually by confirming you control your account's email address, and we will respond within the time the law requires. You may use an authorized agent where the law allows. We will not discriminate against you for exercising your rights. If we decline your request, you can appeal by replying to our decision, and in some places you can also complain to your local data protection authority.
California residents: in the past 12 months we have collected the categories of information described in section 1: identifiers, profile and account information, user content, internet and app activity, approximate and precise location (when you allow it), and inferences about travel preferences. We use and disclose them for the business purposes described in sections 3 and 6. We do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information to infer characteristics about you.
10. Children
TravelSocial is only for people 18 and older, and everyone confirms they are 18 or older when they agree to our terms. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact us and we will delete it.
11. Security
We protect information with measures including encrypted connections, database access rules that limit each account to the information it is allowed to see, and limited internal access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your device secure.
12. International users
We are based in the United States, and our service providers may process information in the United States and other countries. Those countries' data protection laws may differ from the laws where you live. The expanded TravelSocial beta is offered in the United States.
13. Changes to this policy
We may update this policy as the Service changes. We will change the effective date above. For material changes, we will notify you in the app or by email before they take effect, and the app will ask you to review and accept the updated policy before you continue using it.