Version of 2 November 2026
This page says what AltosTrip records, where, why, who can see it, and how to erase all of it. It was written from how the app actually works, not from a template: where something cannot be guaranteed, it says so plainly.
What changes compared with the version of 5 October 2026
What had changed compared with the version of 30 September 2026
AltosTrip is published from Switzerland by an independent developer, who alone decides what is recorded and why. For any question or request about your data, one address: info@altostrip.ch.
Processing is governed by the Swiss Federal Act on Data Protection (FADP) and, for people resident in the European Union, by the GDPR.
No need to sign up to get started. The first time you open it, the app creates an account without sign-up: a technical identifier (a random code), the first name and colour you type, and the app's language. No email address, no password.
From that moment, your trip data is stored on our servers, like an account's, not only on your phone. But only this phone can reach it: if you lose it, if you change phones or if you delete the app, your trips become inaccessible — nobody, not even us, can give them back, since nothing shows that this account is yours. And if it goes 6 months without being opened, it is erased (point 7).
Creating an account — with an email and password, with Apple or with Google — is free. It is needed to share a trip — with an invitation or with the web link to its plan —, to subscribe to AltosTrip Pro or to find your trips on another device. It is not a new account: it is the same one, with your sign-in identity added to it; everything you entered is kept, nothing is copied. To join a trip you received by link, your first name is enough.
If you already have an account, “I already have an account” attaches the trips created on this phone to that account, then erases the account without sign-up.
The app keeps working offline: entries stay on the device and are sent as soon as the connection returns.
| Category | Detail |
|---|---|
| Account | Email address, password (never in clear: only a hash is kept), or your Google / Apple identity if you sign in through them. First name, last name, nickname and avatar colour. For an account without sign-up: no email and no password, only a technical identifier, the first name, the colour and the app's language (point 2). |
| Last opened | For an account without sign-up only: the date the app was last opened, sent by the app when it opens with an Internet connection. It is used only to erase the account after 6 months without being opened (point 7). |
| Trips | Name, description, emoji, dates, currencies, budget. |
| Participants | First name, last name and, if you enter them, the email addresses of the people you add to a trip. The households you group them into. |
| Expenses | Amount, currency, exchange rate used, category, date and time, place, city, country and GPS coordinates if you record them, free-text notes, the split between participants, who paid. |
| Receipt photos | The images you attach to an expense. A receipt often shows the merchant, its address, the date, the itemised purchase, sometimes the last digits of a card. |
| Payment methods | The label you choose, the type, the colour, and the last 4 digits if you enter them. Never a full card number, a security code or an IBAN: the app does not ask for them. |
| Cash and cards | Cash envelopes, trip cards, holders, movements — including, for an ATM withdrawal, the amount debited, the currency, the fees and the rate you enter —, and the free-text note on a movement, with the account of the person who wrote it. |
| Reimbursements | Who paid back whom, how much, by what means, and any free-text note. |
| Change log | Who created, edited or deleted what, and when, with the author's name and account and a before/after snapshot of the change. |
| Subscription | If you subscribe to AltosTrip Pro: the fact that it is active, its expiry date, the platform, and the purchase reference the store provides — on iPhone, Apple's transaction identifier; on Android, the Google Play purchase token. No banking data: Apple or Google collects the payment. |
| Invitations | The share links you issue (role given, expiry date), and who accepted them. If you invite someone by email: their address, entered in the sending log — to which address, by whom, when, and whether it went out —, which serves to limit repeated sending and to know what was sent. The log is kept for 30 days; the address is not kept in the link itself. |
| Plan | An outing's planned activities: title, start and end day and time, place, price or estimate, organiser, and each person's answer (“I'm in”, “not this time”, paid). For accommodation, if you enter them: meals, parking, rooms and beds, amenities, phone number, platform, booking reference and link, free-cancellation date, access code (door, key box) and notes. For a journey: means of transport, destination, company, number, terminal, gate, luggage, the seats assigned to each person, the group's meeting point, booking reference and link, notes. |
| Polls | The question, the options, the deadline, each participant's vote, the option chosen and the participant who started the poll. |
| Outing type and guest of honour | An outing's type (trip, stag or hen party, birthday, weekend), the participant named guest of honour and what the group pays for them. |
| Plan link | For a trip whose plan is shared through a web link: a random code, its creation date and the account that created it (point 5). |
| Deletions | When a row is deleted (expense, share, trip…), its identifier — a random code —, the name of the table and the date. Nothing else: no content, no author. These identifiers stop a device that stayed offline from bringing it back. |
No advertising, no tracking, no advertising identifier, no analytics, no crash reports sent to a third party. There is no such tool anywhere in the app — save the reservation described just below —, and the Android app does not even request permission to read the advertising identifier.
One reservation, on Android only: the two Google modules the app ships with — ML Kit, which reads the amount off a receipt, and the QR-code scanner of Google Play services — send Google technical metrics of their own accord: the phone's manufacturer, model and system version, the app's name and version, a per-installation identifier (which does not designate a person), the format and size of the image processed, processing times and error codes. Never the image, nor the text of the receipt, nor the content of the QR code. Google uses them for diagnostics and usage statistics of its modules; we receive none of these metrics, and these modules offer no way to turn them off.
Reading the amount off a receipt photo happens entirely on your phone. The image is not sent to anyone to be analysed.
The database and the receipt photos are hosted with Supabase, in its Ireland data centre — so inside the European Union. The database is not transferred to any third country.
The emails the service sends, however, go through Resend, in the United States: what it receives, and on what basis, is in point 6.
A copy of your trip data stays on your phone, so the app works offline.
A shared trip really is shared: its members see the trip's expenses with their amounts, places and coordinates, your free-text notes, the receipt photos attached, the split, the reimbursements, the trip's cards and envelopes with their movements and their notes, and the change log with your name on it. They also see your first name, last name, nickname and avatar colour, and the plan with the details of accommodation and journeys — access codes, booking references and notes included —, each person's answers, the polls and each person's vote.
A trip's administrators also see the log of invitations sent by email for that trip: the address, the date and the outcome of each sending.
That is how the tool works, but it is worth saying outright: do not write in a note — on an expense, a reimbursement, a cash movement or the plan — anything you would not say to the group, and only put an access code there if the whole group may see it.
A member who can edit the trip, with an account, can share the plan through a web link (altostrip.ch/programme/…), for instance in the outing's group chat. AltosTrip sends this link to no one: it only travels if a member passes it on. Anyone who has this link, even without the app and without an account, sees:
They never see email addresses, last names, expenses, balances, nor the other details of accommodation or a journey: access codes, booking references and links, phone number, rooms and beds, seats assigned, meeting point and notes. A participant who has become “Voyageur” (point 8) no longer appears there, nor do their answers or votes.
They can answer “I'm in” or “not this time” to an activity and vote in a poll on behalf of any participant of the trip: like a sheet pinned up for a group, the link does not check who is answering. The name they pick is kept in their browser, nothing else.
The link does not expire. If it has travelled too far, or someone leaves the group, a member who can edit the trip revokes it by creating a new link (“New web link”, in the plan's share menu on iPhone, below the share button on Android): the old one stops working at once.
This has to be said frankly: administering the service technically means having access to the whole database and storage, private expenses and receipt photos included. That is inherent to running a hosted service. We use that access only to keep the service running, to fix a fault, and to answer your support requests. We do not look at trip data for other reasons, we do not sell it, and we disclose it to no one, save a legal obligation.
Only one of these third parties holds all of your data: the host, because hosting the service is precisely holding the database and the storage. Every other one receives a single precise item — an exact or approximate position, two currency codes, a place you type, a sign-in identity, a payment, an email to deliver, technical metrics — and none of them gets the detail of your expenses: not your amounts, not your notes, not your receipt photos. Here, precisely, is what each one gets and why.
| Third party | What it receives | Why |
|---|---|---|
| Supabase (Ireland, EU) | Everything described in point 3 | Hosts the database, the receipt storage and authentication |
| Apple | On iPhone: an expense's GPS coordinates, to look up the address and nearby places; the map area displayed; when you search for a place or an address, the text you type, with the map area displayed for an expense's place, or an area around the outing for a plan activity's place (the position of one of the trip's located expenses, or yours if you have already allowed it), to suggest nearby places first. If you use “Sign in with Apple”: your Apple identity. If you subscribe on iPhone: the subscription payment. | Address from a position, place search, map tiles, sign-in, collecting the subscription payment |
| On Android: the GPS coordinates passed to the phone's address service. If you use “Continue with Google”: your Google identity. If you subscribe on Android: the subscription payment, through Google Play. The ML Kit (reading a receipt's amount) and QR-code scanner modules of Google Play services: the technical metrics described in point 3 — never the image, nor the text of the receipt, nor the content of the QR code. | Address from a position, sign-in, collecting the subscription payment, reading a receipt or an invitation QR code; Google uses the metrics for diagnostics and usage statistics of its modules | |
| Resend (United States) | The recipient's email address and the message. For confirming your address or a forgotten password: your address and the link. For an invitation: the invited person's address, their first name if you entered it, your name as it appears on your profile (failing that, the part of your address before the @), the trip's name, the invitation link and its expiry date. | Sending AltosTrip's emails. Resend keeps the message and its delivery log for 30 days. Transfer covered by the European Commission's standard contractual clauses, adapted to Swiss law, and by the EU–U.S. Data Privacy Framework |
| OpenStreetMap | On Android: the geographic area you look at on the map. And, when you search for a place by typing, the text you type. | Map tiles and address search |
| komoot (Germany) — Photon service | On Android: the coordinates of a position, rounded to about 110 metres — yours when you fill in an expense's place; when you search for the place of a plan activity, that of the trip's last located expense or, failing that, your phone's last known position if you have already allowed it —, the text you type in that search, and your IP address. Nothing else — no account, no email, no amount, no trip name. | To suggest the places around you (restaurant, shop, hotel…) when you fill in an expense's place, and to find the place of a plan activity. Never in the background |
| Frankfurter and open.er-api.com | Two currency codes and a date. No amount, no identifier. | The day's exchange rate |
In every case, merely calling a service from your phone makes your IP address visible to it; that is true of any connected app.
Settlement reminders and plan reminders are local notifications: your phone schedules them, and nothing is sent to a notification server. Their text — two first names and an amount for a settlement; the title, time, place and trip name for an activity, and for a journey the time and place of the meeting point — is however handed to the operating system, like any notification.
Your data is kept as long as your account exists, except what has a period of its own, below. For an account with sign-up, there is no automatic deletion after a delay: you decide, with the buttons described next. An account without sign-up, on the other hand, erases itself once it is no longer used.
Two distinct actions, in the app's settings. If you no longer have the app, or the device, the Delete your account or your data page says how to ask for the same thing by email.
Without an account, there is only one button: “Delete my data” also erases the account without sign-up. It is therefore the full deletion described below, under “Delete my account”, and the app starts again from scratch.
Everything goes: trips, expenses (private ones included), cash, cards, receipts, payment methods, invitations you issued — links and the log of invitations sent by email —, your memberships of other people's trips, and the local copy on your phone. Receipt photos are erased from storage within the following minutes. Your other devices are signed out; the copy they hold is not erased remotely, it goes when the app is uninstalled. Your account and any subscription you paid for are kept — you can sign back in to an empty space.
If someone had entered your email address on a participant card, or had invited you by email, that address is erased too.
In the shared trips that remain, your votes in polls still open are withdrawn. Your answers to the plan (“I'm in”, “not this time”, paid) and your votes in polls already closed stay, under your participant row renamed “Voyageur” (see below): an answer counts in the expense the organiser will create from the activity, just as your shares count in the expenses. The plan's web-link page no longer shows them.
Three things cannot simply vanish, because they also belong to the other travellers:
And five limits it is only honest to state:
Finally, if you then sign in again with Google or Apple, your first and last name will be supplied by them once more: unavoidable, since your sign-in identity is the thing being kept.
The same purge, plus permanent deletion of the account: your address no longer allows signing in. The same three exceptions apply, for the same reason — not to destroy the other travellers' records.
You can request access to your data, its correction, its deletion, its portability, and object to processing.
For everything else, write to info@altostrip.ch: we answer within 30 days. You may also complain to the Federal Data Protection and Information Commissioner (Switzerland) or, if you live in the European Union, to your country's supervisory authority.
Traffic between the app and our servers is encrypted (HTTPS). Session tokens are kept in the phone's secure keychain. Receipt photos live in private storage whose access is checked on every read. Separation between accounts and between trips is enforced by the server, not by the app: a modified client cannot go and read another trip's data. The plan link rests on a long random code that cannot be guessed, placed after the “#” of the address: the browser does not send it to the website's server, which therefore writes it in no log.
No system is infallible. Use a password you use nowhere else, and export what matters to you from time to time.
AltosTrip is not intended for children. You must be 16 or older to create an account. The app does not ask for a date of birth and does not verify age: this limit is contractual. If you find that an account was created by a child, write to us and we will delete it.
This policy will change as the app does. The version in force is the one published here, with its date. A change affecting what is recorded, or who receives it, will be announced in the app or by email before it takes effect.