Privacy policy

Journii is a journey platform for students on exchange. It is run by Bart Sebastiaan Zanen and Ricard Tuneu Font, at Barcelona, ES.

Under the General Data Protection Regulation (GDPR) we are joint data controllers for the personal data described on this page. That means we decide together what is collected and why, and we are the people you hold responsible for it. You can exercise your rights with either of us, and one address reaches both: privacy@journiiapp.com.

This policy covers:

• the Journii mobile app for iOS and Android;
• the website journiiapp.com, including the waitlist form and invite links.

Wherever you live, the same rules and the same rights apply to you.

When you create an account

• Your email address, and a password if you sign up with email. We never see your password: it is stored only as a one-way hash.
• Sign in with Apple or Google — if you use one, we receive your name and email address from Apple or Google, and an identifier for your account with them. If you choose Apple’s “Hide My Email”, we only get the relay address Apple gives us. We never receive your Apple or Google password.
• Your date of birth — to check that you are at least 16. It is never shown to anyone else.

Your profile

• Your name, username, and, if you add them, a profile photo and a short bio.
• Your exchange city, the date your exchange started, your home university and host university, and your home country if you choose to give it.

What you post and do in Journii

• Posts — photos, captions, the category you tag them with, who they are shared with, and any people you mention.
• Places you tag — when you add a location to a post, we store the name and map coordinates of the place you picked. That is a place you chose, not your device’s position.
• Interactions — comments, likes, saved trips and places, friend requests, and the groups and trips you join.
• Messages — the messages you send in direct chats, trip chats, and city group chats.
• Trips — what you add to a trip you plan with others: dates, stops on the map, the itinerary, shared notes, and expenses and who owes what. If you share a finished trip as a post, the parts you chose to share go with it.
• Safety tools — the people you block or mute, the posts you hide, and reports you file about a person, post, comment, or message, including the reason and any details you write. Nobody else can see who you mute or what you hide, and the person you mute is not told.
• Feedback — what you send us through the in-app feedback button, together with the screen you sent it from, the app version, and whether your phone runs iOS or Android.

From your device

• A push notification token and your platform (iOS or Android), if you allow notifications. It lets us send notifications to that phone and nothing else.
• Your notification choices — which kinds of notification you have turned on or off.
• Technical logs — when the app talks to our servers, our hosting providers record your IP address, the time, and basic request details, such as the app version and device type. We use these to keep the service running, to stop abuse, and to investigate security problems.

The app keeps your sign-in session and a few settings, such as your light or dark theme, stored on your phone. It does not use those to track you.

On the website and waitlist

• If you join the waitlist: your email address, the city you type (and a tidied-up version of it, so “Milano” and “Milan” count as one city), when you signed up, and the username of the friend who invited you, if you came through an invite link.
• To stop scripts flooding the waitlist form, a one-way fingerprint of your IP address. The address itself is never written to our database, the fingerprint cannot be turned back into it, it is not linked to your waitlist entry, and it is deleted within two hours.
• Cloudflare serves the website. To deliver a page and block attacks it processes your IP address and basic request details.

What we do not collect

Journii does not access your phone’s location, your contacts, or your microphone. It contains no advertising identifiers, no analytics or advertising SDKs, and no tracking pixels. We do not buy data about you from anyone.

The app only asks for a permission when you use the feature that needs it, and every one is optional. You can change them at any time in your phone’s settings.

• Photos — so you can pick photos for a post, your profile, or a group. Only the photos you pick leave your phone.
• Camera — so you can take a photo inside the app.
• Notifications — so we can tell you about messages, comments, friend requests, trip invites, and similar. Day milestone reminders (“Day 30 of your exchange”) are scheduled on your phone itself and are not sent from our servers.

The GDPR requires a legal basis for each thing we do with your data. Here is each purpose with the basis we rely on:

• Running Journii for you — your account, profile, posts, chats, trips, friends, and notifications you asked for. Basis: performing our contract with you, the terms of service (Art. 6(1)(b)).
• Checking your age — Journii is for people aged 16 and over. Basis: performing our contract (Art. 6(1)(b)) and complying with the law on minors’ consent (Art. 6(1)(c) and Art. 8).
• Keeping people safe and enforcing our rules — content moderation, reports, blocking, banning accounts that break the terms, and limiting how fast an account can post, so that spam and abuse do not take over. Basis: our legitimate interest, and yours, in a safe community (Art. 6(1)(f)).
• Security — technical logs, preventing fraud and attacks, investigating incidents. Basis: legitimate interests (Art. 6(1)(f)).
• Improving Journii — the feedback you send us, and fixing what breaks. Basis: legitimate interests (Art. 6(1)(f)).
• Service emails — confirming your email address and resetting your password. Basis: performing our contract (Art. 6(1)(b)). We do not send marketing email from the app.
• Push notifications — only after you allow them on your phone. Basis: your consent (Art. 6(1)(a)), which you withdraw by turning them off.
• The waitlist — emailing you once when Journii opens in your city, and deciding which cities to open first. Basis: your consent (Art. 6(1)(a)), given by submitting the form. Withdraw it with the unsubscribe link in any email we send, or by writing to privacy@journiiapp.com.
• Legal obligations — answering lawful requests from authorities, and keeping records the law requires. Basis: legal obligation (Art. 6(1)(c)).

Where we rely on legitimate interests, we have weighed them against your rights, and you can object; see Your rights below. We do not use your data for advertising, and we do not build profiles of you for marketing.

Journii is a social app, so some of what you add is visible to other people. You decide most of it.

• Your profile — your name, username, photo, bio, city, universities, home country, and the day of your exchange are visible to other signed-in Journii users. Your profile photo is stored at a public web address, so anyone who has that address can open the image.
• Never shown to anyone — your email address and your date of birth.
• Posts — you choose the audience for each post: everyone in your city, or only your friends. Post photos are never at a public address; they can only be loaded by signed-in users who are allowed to see that post.
• Messages — only the people in that chat can read them. City group chats are open to everyone who joins that city’s group.
• Trips — only the trip’s members can see its plan, notes, and expenses, unless you share the trip as a post.
• Blocking — when you block someone, they can no longer see your profile, posts, or comments, or message you, and you no longer see theirs.

Messages are encrypted in transit and at rest, but they are not end-to-end encrypted. We do not read your messages. The exception is a message someone reports to us: our moderators see that message so they can act on the report.

To keep Journii safe, we check content in three ways:

• A list of blocked words stops some posts, comments, messages, and bios from being published.
• Post captions, post photos, comments, profile photos, and bios are sent to OpenAI’s moderation service, which scores them for things like harassment, hate, violence, and sexual content. Private chat messages are never sent. Content scored as clearly harmful is hidden from other users automatically; anything borderline waits for a person on our team to review it.
• Reports from users go to our moderators. A report alone never hides anything automatically.

If something of yours was hidden or removed and you think we got it wrong, write to privacy@journiiapp.com. A person will review the decision. Our moderation does not produce legal effects for you; at most it hides a piece of content or, after human review, suspends an account that breaks our terms.

We use the following companies to run Journii. Each one processes data only on our instructions, for the purpose listed, under a data processing agreement or equivalent terms:

• Supabase — database, sign-in, file storage, and server functions. Your data is stored in the EU (Ireland).
• OpenAI — automated content moderation, as described above. OpenAI does not use this data to train its models.
• Expo (650 Industries) — delivering push notifications to Apple and Google, and delivering app updates.
• Apple and Google — delivering push notifications to your phone (Apple Push Notification service, Firebase Cloud Messaging), Sign in with Apple and Google Sign-In if you use them, and maps. On Android, maps are displayed with Google Maps.
• Google (Places API) — finding a place when you search for one to tag on a post. Only the search text is sent, through our own server; Google does not receive your name or account.
• Resend — sending sign-up confirmation and password-reset emails.
• Cloudflare — serving journiiapp.com, protecting it from attack, and handling email sent to @journiiapp.com addresses.

Apple and Google also process data under their own privacy policies when you download the app from their stores or sign in with their accounts.

No one else receives your data. We may disclose it if the law compels us to, or if it is necessary to protect someone from serious harm, and we will tell you unless we are forbidden from doing so. If Journii is ever sold or merged, your data would pass to the new operator only under this policy, and we would tell you first.

Our database is in the EU. Some of the companies above — OpenAI, Expo, Resend, Cloudflare, Apple, and Google — are based in the United States or operate global networks, so some data may be processed outside the European Economic Area. When that happens, the transfer is protected by the EU–US Data Privacy Framework where the company is certified under it, or by the European Commission’s Standard Contractual Clauses. Ask us and we will tell you which applies to which company.

• Your account — for as long as you have it. When you delete it, we delete or anonymise your data straight away, as described in the next section.
• Unconfirmed sign-ups — an email sign-up that is never confirmed is deleted automatically after 7 days.
• Posts, comments, messages — until you delete them or your account.
• Push tokens — until you sign out on that phone, turn notifications off, or delete your account.
• Moderation records — when content is flagged or reported, we keep a record of what was flagged and what we decided for as long as we need it to deal with repeat abuse and answer appeals, and no longer.
• Technical logs — kept by our hosting providers for a limited period, after which they are deleted automatically.
• Anti-abuse counters — deleted within two days.
• Waitlist entries — until twelve months after Journii opens in your city, or until you ask us to delete yours, whichever comes first.
• Backups — deleted data may remain in encrypted backups for a limited period, until those backups are replaced. Nobody uses them except to recover from a failure.

You can delete your Journii account at any time, for free, and you do not need to give a reason.

In the app

1. Open Journii and go to your profile.
2. Open Settings.
3. Under Account, tap Delete account, and confirm.

Deletion takes effect immediately and cannot be undone. You are signed out on every device.

Without the app

If you no longer have the app, email privacy@journiiapp.com from the address your account uses, with the subject “Delete my account”. We delete it within one month and confirm by email.

What is deleted

• Your email address, sign-in details, date of birth, profile photo, name, username, bio, city, universities, home country, and exchange date.
• All your posts and their photos, your comments, likes, mentions, saved places, friendships, blocks, mutes, hidden posts, the reports you filed, the feedback you sent, your notification settings, and your push tokens.
• Your messages in city group chats.

What stays, and why

• Messages you sent in direct and trip chats stay in the other people’s conversation history, shown as coming from “Deleted user”. They are part of the other person’s conversation too.
• In trips you planned with others, the expenses, notes, and stops that the group still relies on stay with the trip, without your name on them. You are removed from every trip, and a trip only you were on is deleted.
• Moderation records about content you posted, for as long as we need them, as described above.
• An anonymous placeholder for the account remains, with no personal details, so that the shared conversations and trips above still work.
• Copies in encrypted backups, for a limited period until those backups are replaced.

We do not sell, rent, or trade your data. We do not share it with data brokers, advertisers, or ad networks. There are no ads in Journii, no third-party advertising or analytics code in the app or on the site, no cross-app or cross-site tracking, and no behavioural profiling.

The website sets no cookies of its own. Cloudflare may set a strictly necessary cookie to tell real visitors from bots. It carries no advertising identifier.

You have the following rights over your personal data. They are free to use.

• Access — ask what we hold about you and get a copy of it.
• Rectification — have anything wrong corrected. Most of your profile you can edit yourself in the app.
• Erasure — have your data deleted. Deleting your account does most of this at once; see Deleting your account.
• Restriction — have us pause processing while a dispute is sorted out.
• Portability — receive the data you gave us in a machine-readable file.
• Objection — object to processing we base on legitimate interests.
• Withdrawal of consent — take back consent at any time, for example by turning off notifications or leaving the waitlist. It does not make what we did before unlawful.
• Human review — ask for a person to look again at an automated moderation decision.
• Complaint — lodge a complaint with a data protection supervisory authority.

To use any of them, email privacy@journiiapp.com. We reply within one month. If a request is complicated we may take up to two months more, and we will tell you why within the first month. We may ask you to write from the email address on your account, so that we do not hand your data to someone else.

You can complain to the supervisory authority where you live, where you work, or where you think the problem happened. Our lead authority is the Agencia Española de Protección de Datos (AEPD) in Spain. You do not have to talk to us first, though we would rather you did.

Everything travels over encrypted connections (HTTPS/TLS), and the database and file storage are encrypted at rest. Access is enforced inside the database itself, row by row, so the app can only ever read what you are allowed to see. Passwords are stored only as one-way hashes. Only the people who need access to our systems have it. No system is perfectly secure, but if a breach happens and it is likely to put your rights at risk, we notify the supervisory authority within 72 hours and tell you without undue delay.

Journii is for people aged 16 and over, and the app checks your date of birth when you sign up. We do not knowingly collect data from anyone younger. If you believe someone under 16 is using Journii, report the account in the app or write to privacy@journiiapp.com and we will delete it.

We update this page when what we do changes, and we change the “last updated” date at the top. If a change is significant — new data, a new purpose, a new kind of company receiving data — we tell you in the app or by email before it takes effect. Ask us and we will send you the previous version.

Email privacy@journiiapp.com, or write to Bart Sebastiaan Zanen and Ricard Tuneu Font, Barcelona, ES.

We have not appointed a Data Protection Officer. If Journii grows to the point where the law requires one, we will appoint one and name them here.