Privacy Policy

Variare is a travel-planning app for Android and iOS. The service described in this policy is operated by Bayram Ünal, an individual developer rather than a company, and Bayram Ünal is responsible for the personal data it covers.

Your account

You sign in with Google on Android, or with Sign in with Apple on iOS. Variare requests only the standard sign-in information. With Google, that is your identifier, email address and basic profile. With Apple, it is your identifier, your email address and — the first time only, if you choose to share it — your name. Variare does not request access to any other Google or Apple service, your contacts, or your files. If you choose Apple's "Hide My Email", Apple gives Variare a private relay address instead of your own, and Variare stores that address. Variare stores your account identifier and, where Google or Apple provides them, your email address (or Apple's relay address) and your display name.

Sign-in problems

If a sign-in attempt fails, the app sends Variare a short technical record of it: the steps it reached, the errors they reported, the sign-in method, and the app, platform and system versions, with a keyed one-way hash of the network address it came from, used to limit abuse. It contains no name, email address or account identifier.

Your trips

Everything you enter to plan a trip, and everything generated from it: destinations and places, dates and times with their time zones, the route legs between places, travelers on the trip, accommodation and travel decisions, notes, packing items, and the day-by-day itinerary itself. If you tell Variare about dietary needs or accessibility needs so the itinerary can account for them, that information is part of the trip and is stored with it. These needs are optional. Some of them — for example halal food, wheelchair access or an allergy you mention — can reveal something about your health or religion. Variare uses them only to plan that trip; they are stored with the trip and sent to the AI provider as part of it (section 6).

If you tap "Add to calendar", the app asks permission to add the trip's events to your device calendar and writes them there. Variare does not upload your calendar.

Purchases and entitlements

Generating a trip — including your first trip — requires a Trip Pass. When you buy a Trip Pass, the purchase itself happens in Google Play on Android or in the App Store on iOS — Variare never sees your card or payment details. The app sends the store's purchase identifiers to Variare's backend so the purchase can be verified and the pass credited to your account. On iOS, the purchase is tagged with your Variare account identifier, and Variare's backend confirms it through RevenueCat, a service that checks App Store purchases on Variare's behalf. Variare stores the verified result: your remaining Trip Pass balance, and the store transaction identifiers needed to make sure the same purchase is never credited twice. Variare currently does not offer a subscription; if one is introduced later, this policy and the Terms of Service will be updated first.

Crash reports and performance data

On Android, Variare uses two Google-operated diagnostic tools: Firebase Crashlytics and Firebase Performance Monitoring. The iOS app uses neither. When the app crashes, or hits an error it handles internally, Crashlytics records the device model, the operating system version, the app version, Firebase's own installation identifier for the app on your device, and a stack trace. It also receives your account identifier if you are signed in at the time — set only while you are signed in and cleared the moment you sign out — but never your email address or display name. A short trail of the same closed, prose-free event names used for product analytics (see below) is attached as context leading up to a crash; nothing you typed — a trip name, a place, a note, an error message — is ever attached, and no free-text custom fields are added to a crash report.

Performance Monitoring separately times things like app start-up, screen rendering and network requests, to find what is slow. It does not carry the content of your trips.

Google's Maps SDK and Firebase Cloud Messaging, which are built into the app on both platforms, may themselves collect device identifiers and diagnostic and usage information — such as crash, performance and map-interaction data — and send it to Google under Google's own privacy policy.

Product analytics

The app records a small, fixed set of product events — which screens are opened, whether a generation succeeded or failed, how long a step took — so its owner can see what is broken and what is used. These events are structurally incapable of carrying free text: the app's analytics code can only send counts, true/false flags, durations, and values drawn from a closed list. A search query, a place name, an email address, a packing note or an error message has nowhere to go in that format.

Each event carries a per-installation identifier — a random value created by the app, not a hardware or advertising identifier, and regenerated if you reinstall — plus your account identifier if you were signed in at the time, and the app version, platform and language.

Feedback you send

If you use Send feedback, Variare keeps your message exactly as you wrote it and the category you picked, together with the app's installation identifier, the platform (Android or iOS), the app version, the app's language and the time it arrived, and — if you were signed in — your account identifier, so the owner can reply. To spot an accidental duplicate, the server also keeps a one-way hash of the message. You choose what goes in the message; please do not put anything in it you would not want read.

Messages sent from this website

The Support and Delete your account pages have a form. Sending one stores the email address you type and anything you write, so that the request can be answered — for a deletion request, the address is also how the account is found.

To stop the form being used to send bulk mail, the server also keeps a one-way hash of the network address the message came from. The address itself is never stored and never written to a log, and the hash cannot be turned back into an address by anyone who does not hold the key. It is used to count recent submissions and for nothing else.

Apart from that hash, this website sets no cookies, loads nothing from anywhere else, and has no analytics or trackers of any kind. Its pages run one small script of its own, which opens the language menu and the collapsible sections and keeps the language you choose in your browser's local storage; it sends nothing anywhere. Reading these pages is not recorded.

Community: public trips, handles and comments

Public handle. When you first sign in, Variare gives your account a public handle: the part of your e-mail address before the @, or, if that is not available (for example an Apple “Hide My Email” address), the name you shared when signing in, or otherwise a random eight-character id. Accents are removed and, if the handle is already taken, digits are added. Other travelers see your handle only on trips you make public and on comments you write. A random handle can be changed once in the app; to change another handle, ask through Support. Variare also records when you accepted the Community Guidelines, and which version.

Public trips. In current versions of the app, new trips you create are public by default. The first time, the app tells you so and lets you keep them public or make that trip private, and you can make any trip private later from the top of the trip. For a public trip, Variare stores a separate public version: a title (by default the number of days and the first destination), the places, nights, days and stops of the plan, the month and length of the trip, a group-size range, the choices it was planned with, and an approximate per-person budget when there is enough to estimate from. Your exact dates, bookings, notes, the names of the people you travel with, your starting point, your name and your e-mail address are never part of the public version.

Comments, likes, saves, reports and blocks. The comments and replies you write, and the traveler you mention at the start of a comment, are stored with your handle and are visible to people who can see the trip. Which public trips and comments you liked or saved is stored; other people see only the counts. If you report a trip or a comment, Variare stores what you reported, the reason you chose and when. If you block a traveler, the block is stored. If Community activity notifications are on, Variare sends notifications about comments, replies and mentions on your public trips and comments.

Shared trips

Who is on a trip. When you invite people to a trip, or join someone else's, Variare stores who is on that trip, each person's role (owner, editor or viewer) and when they joined. The people on a trip see each other's names — the name on your profile or the one you shared when signing in, never your e-mail address — and the trip itself: its plan and what the people on it add. A booking's confirmation code is visible only to the person who added it; flight numbers are shared. If you leave a trip, or its owner removes you, the stops, bookings and expenses you added stay on the trip.

Invitations. An invitation is a link that works for 7 days, until the owner closes it, or until the trip is full. Anyone who opens the link sees the owner's first name, the trip's name, cities and dates, and how many people are on it; after signing in, also the first names of the people on it and a short outline of the first days. If the owner approves new people, Variare stores your request to join, and the owner sees your name.

Meeting points. On a trip day, anyone on the trip can leave a meeting point: a place, a time and an optional note. The people on that trip see it and who answered “I'm coming”. A meeting point and its answers are deleted two hours after the meeting time, or earlier if someone replaces or clears it.

“I'm here”. Sending your location is optional. Only when you tap “I'm here” — after the app has asked you once on that device — Variare takes one reading of your location and shows it to the people on that trip, and to no one else. On Android the reading is approximate; on iPhone it is accurate to about 100 metres, or approximate if you have allowed only approximate location. It is not tracked, is never written to logs or analytics, and is deleted two hours after you send it (a scheduled job removes it within minutes of that), or earlier if the meeting point is replaced or cleared or you leave the trip.

Notifications about a shared trip. If notifications are on, the people on a trip are told when someone asks to join or joins, when a meeting point is left or someone arrives, and, at most once an hour, what others changed in the plan (for example how many stops were added, or which stop moved to which day). These notifications show first names, the trip's name and the meeting place, and are delivered as described under Notifications below. The record of changes behind these summaries is deleted after 30 days.

Invite reward. When someone new to Variare joins through your invitation and later creates their own first trip, Variare may add a Trip Pass to your account and tells you their first name. For this, Variare stores who invited whom.

Notifications

If you allow notifications, the app registers a push token for your installation so it can send trip reminders. On iOS, a notification travels from Variare's backend through Google's Firebase Cloud Messaging to Apple's Push Notification service (APNs), which delivers it to your device. You can withdraw that permission in your device settings at any time.

Variare has no advertising identifiers, no ad networks and no third-party marketing or attribution SDKs. It does not ask for, infer or store your occupation, industry, income or ethnicity. It does not track your location in the background. The map's "where am I" control asks for your approximate (town-level, not precise) location only when you tap it, takes one reading and keeps it on the screen you asked it from — that reading is never sent anywhere. The only time a location reading leaves your phone is when you tap “I'm here” in a shared trip, as described in section 2. Place coordinates elsewhere in the app come from the places you choose for a trip, not from following your device.

Apart from what you send through its forms (described in section 2), this website collects nothing — no cookies, no analytics.

• Account data — to sign you in, to keep your trips attached to you rather than to a device, and to let you reach them from a new phone.
• Trip data — to provide the product. This is the thing the app is for.
• Purchase and entitlement data — to honour what you paid for, to stop the same purchase being spent twice, and to satisfy the app stores' verification requirements.
• Crash and performance data (Android) — to find and fix defects and slow screens. Never to build a profile of you or to target advertising.
• Analytics — to find defects and understand which parts of the product are used. Never to build a profile of you or to target advertising.
• Sign-in problem records — to find and fix sign-in failures, and to limit abuse.
• Feedback — to read and act on what you said, and to reply.
• Push tokens — to deliver the trip notifications you asked for.
• Community data — to show your public trips and comments to other travelers under your handle, to let them find, save and adapt trips, and to handle reports and keep the community safe.
• Shared-trip data — to let the people on a trip plan it together, meet up, and know what changed.

Variare does not sell your data and does not share it for anyone else's marketing. It is handled by the following service providers, each for a specific purpose:

• Supabase — hosts the account system, the database and the file storage behind Variare. Your account, trips, entitlements, analytics events and feedback live here.
• Google Maps Platform (Maps, Places and Routes) — the trip map is drawn by Google's Maps SDK, which loads map tiles directly from Google and may collect the information described in section 2. When you search for a place or the app works out travel between two places, the search text or the coordinates involved are sent to Google to get results back. Place photos shown in the app are fetched from the same service, or from Wikimedia as a fallback.
• A weather provider — coordinates and dates for your trip's destinations are sent to retrieve a forecast.
• An AI provider (Google Gemini) — see section 6.
• Google Play — distributes the app and processes payments under its own privacy policy.
• Apple (App Store) — distributes the iOS app and processes payments under its own privacy policy.
• RevenueCat — on iOS, confirms App Store purchases for Variare's backend. It receives your Variare account identifier, the history and App Store transaction identifiers of your Variare purchases, and your device's locale and currency code — not your payment details or your location. RevenueCat, a US company, stores this data in the United States under its own privacy policy.
• Apple (Sign in with Apple) — authenticates you on iOS. When you delete your account in the app, Variare asks Apple to revoke Variare's access to your Apple ID.
• Google (Firebase Cloud Messaging), and on iOS Apple Push Notification service — deliver push notifications to your device, if you enabled them.
• Google (Firebase Crashlytics and Firebase Performance Monitoring) — on Android, collect the crash and performance diagnostics described in section 2, above.
• Wikimedia Foundation (Wikidata) — when a trip is made public, Variare may look up its places on Wikidata, Wikimedia's open-data service, to link them to a public place record. Only place names produced by Variare's trip generator or matched by a place provider are sent, never anything you typed yourself, together with the server's network address. No account, trip, handle or date is sent.
• Cloudflare (Email Routing) — e-mail you send to support@variare.app passes through Cloudflare, which forwards it to the mailbox Variare's support is answered from. Cloudflare handles the message — your address and what you wrote — only to deliver it, under its own privacy policy. Messages sent with the support or account-deletion forms do not pass through Cloudflare.

Variare's database, authentication and backend functions are hosted in the European Union (Frankfurt). Some of the providers listed above operate in other countries, so your data may be processed outside the country you live in. Variare does not sell your data, and does not share it with anyone beyond the providers listed above.

Variare may also disclose data where the law genuinely requires it, or where it is necessary to investigate abuse or protect someone's safety.

When you ask Variare to generate an itinerary, the details of that trip — destinations, dates, travelers, how you like to travel, and any preferences or needs you entered — are sent to an AI provider so it can produce a plan. Your email address, your name and your account identifier are not part of that request.

Generation runs as a server-side job. If you close the app it keeps running, and returning to the app reconnects to the job in progress rather than starting a new one. The resulting itinerary is stored with your trip like anything else you created.

What is sent is the trip, not you. The request is made by Variare's own backend, not by your device, and it contains only the trip details described above. Your name, your email address, your account identifier and your device identifier are not included in it — the AI provider is never told whose trip it is.

Google processes that request under its own terms for the Gemini API and its own privacy policy. Variare does not control how that company runs its own service, so this policy describes only what Variare sends and what Variare does with the answer.

Variare keeps a local copy of your trips on the device so the app works without a connection, and syncs it with your account when a connection is available. That local copy is stored per account: signing out clears or rebinds it, so one account's trips cannot appear under another account on the same phone. Removing the app removes the local copy; it does not delete the copy on the server.

• Trips and account data — until you delete the trip or your account.
• Analytics events — deleted automatically once they are 180 days old. This is not a promise to review them by hand: a scheduled job runs every day and removes anything past that age, so the window holds whether or not anyone is watching.
• Crash and performance data (Android) — kept by Google under Firebase's own retention periods. Crashlytics keeps crash reports and the identifiers attached to them for 90 days, and Performance Monitoring keeps events linked to an IP address for 30 days and other performance data for 60 days; after that, Google starts deleting them (Privacy and Security in Firebase). Variare has not set a separate, shorter window.
• Feedback and messages you send us — feedback sent from inside the app is kept until you delete your account, which deletes it. Messages sent through this website's forms are kept so we can answer them and as a record of what you asked. You can ask for either to be deleted at any time through Support.
• Sign-in problem records — deleted after 30 days.
• Purchase and entitlement records — kept for as long as your account exists, so your Trip Pass balance and purchase history stay correct and so the same purchase cannot be credited twice. When you delete your account, your Trip Pass balance is deleted, and the record of each purchase — the store, the store's transaction identifier, the product, the quantity and the time — is kept without a time limit and with your account removed from it, so that the same purchase can never be credited again. The store you bought from (Google Play or the App Store) keeps its own purchase records under its own policies. On iOS, deleting your account also asks RevenueCat to delete its record of you.
• Records of refunded purchases — when a store reports that a purchase was refunded, a record is kept even after you delete your account, identified only by the store's own transaction identifier and with your account removed from it, so that a refunded purchase cannot be redeemed again by another account. It is kept without a time limit, because the store's transaction identifier never expires; once your account is deleted, nothing in it identifies you.
• Public trips, comments, likes and saves — until you make the trip private or delete its public version, delete the comment, or delete your account. Making a trip private hides its public version and keeps its likes, comments and saves; deleting the public version removes them with it. Deleting your own trip does not remove its public version: it stays in Explore and can no longer be updated, and the app says so before you delete.
• Shared trips — who is on a trip, until they leave, are removed, or the trip or their account is deleted. Invitation links and requests to join are kept until the trip or the account is deleted. A meeting point and its answers are deleted two hours after the meeting time, and an “I'm here” location two hours after it was sent. The record of changes behind shared-trip summaries is deleted after 30 days. Who invited whom is kept until either account is deleted. The notifications Variare has sent you are deleted 90 days after they were sent, or earlier when you delete your account.
• Comments removed by a moderator — their text is kept internally for 90 days after the removal, so the decision can be reviewed or reversed, and is then deleted. It is never shown in the app.
• Reports — kept as a moderation record. When an account is deleted, the reports it filed are kept without its identity.

Deleting your account deletes your trips and everything in them, your profile and preferences, your notification settings and device registrations, your Trip Pass balance, and your feedback. Records of purchases and refunds are kept with your account removed from them, as described above.

Deleting your account also removes your Community presence: your public handle, your public trips (with the likes, saves and comments other people left on them), your likes, saves and blocks, your replies, and your comments that have no replies. A comment of yours that still has replies from others stays as a placeholder with no text and no author.

Deleting your account also takes you off trips other people own; what you added to them stays on those trips. A trip you own that other people are still on is not deleted: it passes to the person who has been on it longest, who is told that the trip is now theirs. A trip nobody else is on is deleted with your account.

If you signed in with Apple, deleting your account in the app also revokes Variare's access to your Apple ID: Variare asks you to confirm with Apple first, and if Apple cannot be reached nothing is deleted and you can try again.

Analytics events are the one deliberate exception, and it is worth being exact about it. They are not deleted. Instead the identifiers that could tie them back to you are irreversibly removed, and what remains is the anonymous shape of the activity: that a screen was opened, when, on which platform and app version.

That removal covers your account identifier and the per-installation identifier, and the second one matters as much as the first: without it, a later sign-up on the same handset could be lined up against the deleted account's history, which is exactly the reconnection this is meant to prevent. Once detached, these records cannot be tied back to you — by us or by anyone else.

Deletion takes effect immediately in the live database. Copies of earlier data can persist for a short time in the routine backups our hosting provider takes, and age out on that provider's own schedule; they are never used to restore a deleted account.

You can, at any time:

• Delete your account from within the app (You → Settings → Delete account — the app asks you to sign in again, with Google or Apple, to confirm it is you), which removes the data described above immediately. If you can no longer sign in, ask through Delete your account instead.
• Delete individual trips, which removes them from the device and the server.
• Make any trip private, or delete its public version, from the icon at the top of the trip, and delete your comments.
• Block or report travelers and content, and turn Community activity notifications off in the app's notification settings.
• Turn notifications off in your device settings.
• Ask for a copy of your data, or ask for it to be corrected or erased, through Support.

Depending on where you live you may have additional statutory rights, including the right to complain to the data-protection authority in the country you live in.

Purchases are handled by the store you bought from — Google Play or the App Store — so refunds are requested there, under that store's own refund policies, rather than through Variare.

Variare is not designed for children and is not directed at them. You must be at least 18 to create an account. If you believe a child has created an account, tell us through Support and it will be removed.

If this policy changes in a way that materially affects you, the updated version will be published here with a new effective date. Continuing to use Variare after that date means the updated policy applies.

Privacy questions and requests go through Support. To ask for your account and data to be deleted, use Delete your account.

This policy is issued by Bayram Ünal. Direct contact: support@variare.app.