隐私政策

1. Who we are

TourLore is an AI tour guide and trip planner for iOS and Android, together with the website at tourlore.co. TourLore is operated by Luis Otávio Martins, a sole proprietor (MEI, CNPJ 40.822.339/0001-98) based in Sorocaba, São Paulo, Brazil (“TourLore”, “we”, “us”).

We are the controller of the personal data described in this policy. For any privacy question or request, contact us at founder@tourlore.co.

2. What this policy covers

This policy explains what personal data we collect when you use the TourLore mobile app and the TourLore website, why we collect it, who we share it with, and the choices and rights you have. It does not cover third-party websites or services we link to, such as the maps app that opens when you tap “Go there”.

3. Data we collect

We collect only what we need to plan and narrate your tours:

• Account data. When you sign in with Google, we receive your name, email address, profile picture URL, and Google account identifier, plus the sign-in tokens Google issues so we can keep you signed in. See section 4.
• Session and technical data. To keep your session secure we store the IP address and device user agent associated with each sign-in session. Our servers and error monitoring also process basic technical data such as app version, operating system, and error details. On Android, when you chat with the guide, build a tour or trip, or send a voice message, the app asks Google Play's Integrity API to confirm the request comes from the genuine TourLore app on a genuine device. Our servers receive Google's verdict (for example, whether the app came from Google Play and whether the device passes Google's integrity checks), not your device's identifiers, and use it only to protect TourLore against abuse.
• Abuse and fraud prevention. The app sends a device identifier with its requests to our servers: the Android ID on Android, or the identifier-for-vendor Apple assigns to our apps on iOS. When you chat with the guide, build a tour or trip, or send a voice message, our servers store it only as a keyed hash (an HMAC made with a secret only our servers hold), never the identifier itself, with when that device was first and last seen on your account; we use it to spot one account being used from many devices at once. Each time you sign in, our servers also look up the country of your IP address in a database stored on our own servers (DB-IP; see section 7), so no lookup leaves our servers. Only your latest sign-in's country and time are kept, on your account's standing record; this check doesn't store the IP address (the IP address kept with your sign-in session is described above). If these checks, or an unusual number of tours built in one day, flag unusual activity, we record the flag (counts, country codes, and distances, never an IP address or a raw device identifier). Depending on how many flags your account has had in the last 30 days, the app may show you a warning, lower your hourly usage limits, or ask you to sign in again. These checks never block or close an account, and a person can review a flag and clear it.
• Preferences and taste profile. The interests you pick, your app language, the narration voice you choose, and a short taste profile our AI infers from how you use TourLore (for example, which kinds of places you tend to enjoy). It learns from your past plans and tours: places the guide suggested that you left out of a plan, stops you remove or swap during a tour, stops you mark as visited, and stops you rate “Loved this” or “Not my thing”. You can see and adjust it — mute, pin, or reset interests — on the Preferences screen.
• Chats, tours, and trips. The messages you exchange with the guide while planning (we keep the most recent 50 messages of each conversation), the city you're planning for, and the tours and multi-day trips we generate for you.
• Purchases and usage. When you buy a plan, trip pass, or top-up pack in the app, we and our billing provider RevenueCat (section 7) receive the purchase record from the App Store or Google Play: what you bought, the store, the store transaction ID, trial, renewal, and expiry dates, and the price, currency, and country the store reports. We also track how much of your plan's usage allowance you've used (tours, chats, photo questions, and voice input are metered by their estimated cost) and keep short-term counters that protect TourLore against abuse. Payment itself is handled by Apple or Google — we never see your card or other payment details.
• Location. If you allow location access, the app uses your device location while it is open (never in the background) to show you on the map and to detect the city you're in. When you plan a tour from your current location, those coordinates are sent to our servers, saved with that conversation, and used to find nearby places. If you type a city instead, we don't store your coordinates.
• Photos you choose to send. If you allow camera or photo-library access, you can show the guide a photo of what you're looking at. The photo is resized on your device and sent to our AI provider to answer your question. We do not save photos in our database; see section 9 for how long monitoring copies may be kept.
• Voice input. If you allow microphone access, you can tap the mic to speak to the guide instead of typing. The app records a short clip (up to 60 seconds) only while you're recording, sends it to our servers, and deletes it from your device. We send the clip to our AI provider only to turn it into text, which appears in the message box for you to edit and send. We do not store the audio, and it is not kept in our AI-monitoring or error logs.
• App usage analytics. While the “Share usage analytics” setting is on (section 5), the app sends product-analytics events to PostHog (section 7): which screens you open, and events such as signing in, finishing onboarding, sending a chat message, viewing the plans screen, a purchase succeeding or failing, building a tour, playing narration, and downloading a tour for offline use. Events carry identifiers and counts (for example a tour ID, the number of stops, or whether the message was the first in a chat) — never the text of your messages, your name, or your email. They also include basic device and app data (operating system and version, app version, device type), and PostHog uses your IP address to estimate your approximate location (country and city). Before you sign in, events are linked to a random identifier stored on your device; when you sign in, they are linked to your internal TourLore user ID, together with your earlier events from that device. Subscription events from our billing provider (such as a trial starting or a renewal) may be linked to the same ID. Signing out starts a new random identifier.
• Website waitlist. If you join the waitlist on our website, we store your email address, the language of the page you signed up on (so we can write to you in it), and which signup form you used. To stop repeated automated sign-ups, your IP address is counted for one minute and is not stored with your email. We may ask you to confirm your address: if we do, we send you one email with a confirmation link and send no launch news until you click it. We send at most one such email to an address per week, record when we sent it and when you confirmed, and an address that is never confirmed stays on file, marked as not subscribed, until you ask us to delete it.
• Website analytics. Our website uses privacy-friendly, cookieless analytics (see section 14).

We do not request access to your contacts or background location, we do not use the microphone except while you are recording a voice message, and we do not collect precise location history.

4. Google user data

TourLore offers Sign in with Google. We request only the basic “openid”, “email”, and “profile” scopes. Through them we access your name, email address, profile picture, and Google account identifier. We do not access your Gmail, Drive, Calendar, Contacts, or any other Google service data.

We use this information only to create and identify your TourLore account, sign you in, show your name and picture in the app, and contact you about your account. Google sign-in tokens are stored on our servers solely to maintain your session.

We do not sell Google user data, use it for advertising, share it with third parties except the service providers in section 7 that help us run TourLore, or use it to develop, improve, or train generalized AI or machine-learning models.

TourLore's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use your data, and our legal bases

• To provide the service — create your account, plan and narrate tours, answer your questions, keep tours available offline, and remember your preferences (performance of our contract with you).
• To sell and manage paid plans — verify your purchases, unlock your plan, meter its usage allowance, and restore purchases on your other devices (performance of contract); and to prevent fraud and abuse of free trials and usage limits (legitimate interests).
• To personalise your tours over time with your taste profile (performance of contract; you can reset or adjust it at any time).
• To use your location, camera, photos, or microphone — only after you grant the corresponding permission on your device, which you can withdraw at any time in your device settings (consent).
• To keep TourLore secure and reliable, prevent abuse, fix bugs, and monitor the quality of AI responses (legitimate interests).
• To prevent abuse and fraud with the hashed device identifier, your latest sign-in country, and the flags and account standing built from them (section 3) — for example, one account shared across many devices or a sign-in from a country too far from your previous sign-in's to have travelled there in the time between (legitimate interests).
• To understand how the app is used and improve it — product analytics measured with ids and counts, not the content of your messages. You control this with the “Share usage analytics” switch in the app's Account tab. In the EU, the EEA, the UK, and Switzerland it starts off, and the app sends no analytics until you turn it on (on the last onboarding step or in Account); we decide this from your device's language and region settings, not from where you are, and it also starts off when your device sets no region. Elsewhere it starts on. Either way, you can turn it off or on at any time, and turning it off stops the app sending analytics from that device. Legal basis: your consent where the switch starts off; legitimate interests elsewhere, where you can object by turning it off. Turning it off doesn't delete events already sent; to have those deleted, email us (section 10) or delete your account (section 11).
• To send you launch news if you joined the waitlist (consent; you can unsubscribe at any time).
• To comply with legal obligations and to establish, exercise, or defend legal claims.

These legal bases are those of the Brazilian General Data Protection Law (LGPD) and, where it applies, the EU and UK GDPR.

6. How AI is used

Tours, narration, and chat replies are generated by Google's Gemini models on Google Cloud Vertex AI. To do that, we send the AI the content relevant to your request: your messages, any photo or voice recording you choose to send, your city and (if shared) coordinates, your language, your interests and taste profile, and your current itinerary. Voice recordings are used only to transcribe what you said and are not stored. Narration scripts are written for your interests and taste profile, then turned into audio with Google Cloud Text-to-Speech, which receives only the script text and the voice you chose.

Under Google Cloud's terms, Google processes this data on our behalf and does not use it to train its models. We do not use your personal data to train AI models.

AI output can be wrong. We use it to suggest and describe places — it does not make decisions about you that have legal or similarly significant effects.

7. Who we share data with

We don't sell or rent your personal data. We share it only with service providers that process it on our behalf, under contracts that limit their use of it:

• Google Cloud (Cloud Run, Vertex AI Gemini, Text-to-Speech, Places API, Secret Manager) — hosting our API, generating content, finding places near you. Our API runs in Frankfurt, Germany; AI requests may be processed in other Google regions.
• Neon — our database (AWS Frankfurt, Germany).
• Inngest — background job processing; receives internal account and tour identifiers and, for tour generation, the request details (city, coordinates if shared, interests, duration, language) (United States).
• Cloudflare R2 — storage and delivery of tour narration audio (global network). Audio files contain narration about places, not personal data.
• RevenueCat — in-app purchase and subscription management; receives your internal TourLore user ID, your App Store / Google Play purchase records, and basic device and app data (such as platform and app version) from the app (United States).
• Langfuse — AI quality monitoring; receives prompts and responses, which can include your messages, photos, and the text transcribed from your voice recordings (never the audio itself), linked to an internal user ID (EU).
• Sentry — crash and error reporting; may receive the request that caused an error, such as a chat message or coordinates (EU, Germany).
• Tavily — web search used to research places; receives search queries written by our AI, which may reflect what you asked about.
• Wikipedia / Wikidata — article lookups about places; receive only place names.
• OpenStreetMap Overpass API (FOSSGIS e.V., Germany) — finding places near you; receives the coordinates of the area you're planning in, sent from our servers (never your IP address).
• OpenFreeMap — map tiles; like any website you load, it sees your device's IP address and the map area being viewed.
• Resend — stores waitlist sign-ups: email address, signup language, and which form was used, and, when we ask you to confirm your address, sends that confirmation email and records when it was sent and when you confirmed.
• Upstash (when enabled) — counts waitlist sign-up attempts per IP address for one minute and holds a keyed hash of a waitlist email address for up to 7 days, so we send no more than one confirmation email per address per week. It never sees the address itself.
• PostHog — product analytics for the app (events linked to a device identifier or your internal user ID; see section 3) and cookieless website analytics (EU).
• Netlify — hosting for this website.
• Google Play Integrity API — on Android, checks that requests come from the genuine TourLore app on a genuine device; Google receives the check from your device and returns its verdict to our servers.

To find the country of a sign-in's IP address, we use a geolocation database that runs on our own servers, so no data is sent to its provider: IP Geolocation by DB-IP, licensed under CC BY 4.0.

When you buy something in the app, Apple (App Store) or Google (Google Play) processes the payment as an independent controller, under its own privacy policy.

We may also disclose data when required by law or valid legal process, to protect the rights, safety, or property of our users or others, or in connection with a merger, acquisition, or sale of assets (in which case we'll notify you).

8. International transfers

Our core infrastructure is in the European Union, but TourLore is operated from Brazil and some providers (for example Inngest, RevenueCat, and Google when processing AI requests) may process data in the United States or other countries. When we transfer personal data internationally, we rely on safeguards permitted by the LGPD and GDPR, such as standard contractual clauses and our providers' data processing agreements.

9. How long we keep data

• Account data, preferences, chats, tours, and trips: for as long as your account exists. When you delete your account, they are deleted from our database.
• Plan, usage, and purchase records: for as long as your account exists. When you delete your account, they are deleted from our database and your RevenueCat record is deleted shortly afterwards. Apple and Google keep their own records of your purchases under their policies.
• Photos: not stored in our database. Copies within AI-monitoring and error logs are kept for a limited period (up to 90 days) and then deleted.
• Monitoring and error logs: up to 90 days.
• Narration audio: kept to serve your tours; it contains no personal data. When you delete your account, the audio for your tours is deleted too (cached copies on our delivery network can persist for a while until they're evicted).
• Voice recordings: not stored. The clip is deleted from your device once it's sent, and our servers discard it after transcribing it.
• App analytics events: kept in PostHog for as long as we need them to understand how the app is used, within PostHog's retention limits. When you delete your account, your PostHog profile and the events linked to your TourLore user ID are deleted shortly afterwards. Events sent before you first signed in on a device are anonymous and not linked to you, so they may remain.
• Abuse-prevention data (hashed device identifiers, your latest sign-in country, flags, and your account's standing): for as long as your account exists, and deleted from our database when you delete your account. Flags older than 30 days no longer count toward your account's standing, but they are not deleted before then.
• Waitlist email: until you unsubscribe or ask us to delete it.
• Data we must keep for legal reasons: only as long as the law requires.

Tours you downloaded for offline use are stored on your device and stay there until you remove them or uninstall the app.

10. Your rights

Depending on where you live (including under the LGPD, GDPR, UK GDPR, and California law), you have the right to:

• confirm whether we process your data and access a copy of it;
• correct inaccurate or incomplete data;
• delete your data or account;
• receive your data in a portable format;
• object to or restrict certain processing, and withdraw consent at any time;
• obtain information about who we share your data with;
• not be discriminated against for exercising your rights.

To exercise any of these rights, email founder@tourlore.co from the address linked to your account. We'll respond within 15 days, and in any case within the period required by applicable law. You can also complain to a data protection authority — in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados); in the EU/UK, the authority where you live.

11. Deleting your account

You can delete your TourLore account at any time in the app: go to the Account tab → Delete account. This immediately deletes your account and its data from our database — profile, preferences, chats, tours, trips, your plan, usage, and purchase records, and your abuse-prevention data — and signs you out on every device. The narration audio for your tours, your purchase record at RevenueCat, and your app analytics data in PostHog (your PostHog profile and the events linked to your account) are deleted shortly afterwards.

If you no longer have the app, follow the steps at tourlore.co/delete-account: email founder@tourlore.co from the address linked to your account and we'll delete it for you. We'll confirm and complete the deletion within 30 days.

Copies of your data in our AI-monitoring (Langfuse) and error-reporting (Sentry) logs are not deleted on request; they expire automatically within 90 days.

Analytics events sent before you first signed in on a device are anonymous and not linked to your account, so they may remain in PostHog.

Deleting your account does not cancel a subscription bought through the App Store or Google Play. Cancel it in your App Store or Google Play account settings, or you may keep being charged.

You can also revoke TourLore's access to your Google account at any time from your Google Account settings (Security → Third-party apps & services). Deleting the app from your device removes offline tours stored on it, but does not delete your account.

12. Security

We protect your data with encryption in transit (HTTPS), secure credential storage on your device (Keychain / Keystore), access-controlled infrastructure, and secrets kept in a managed secret store. No system is perfectly secure; if a breach affects your data, we'll notify you and the authorities as the law requires.

13. Children

TourLore is not directed at children. You must be at least 16 years old to use it. We don't knowingly collect personal data from anyone under 16; if you believe a child has given us data, contact us and we'll delete it.

14. Cookies, device storage, and analytics

Our website does not use advertising or tracking cookies. We measure visits with PostHog in a cookieless mode: nothing is stored on your device, and each page load is counted as an anonymous visit.

The mobile app doesn't use cookies or advertising identifiers. While “Share usage analytics” is on (section 5), the PostHog SDK stores on your device a random identifier (your TourLore user ID once you sign in) and a queue of pending analytics events, and reads basic device information such as the operating system and app version, to measure how the app is used (section 3). While it's off, the app doesn't start the SDK; turning it off clears that identifier. The app keeps your choice on your device. Deleting the app removes all of these.

15. No sale of data, no ads

We don't sell or share personal data for cross-context behavioural advertising, we don't show ads, and we don't track you across other companies' apps or websites.

16. Changes to this policy

We'll update this policy as TourLore evolves — for example, when we add new features or sign-in options. We'll change the “Last updated” date above, and if a change is material we'll notify you in the app or by email before it takes effect.

17. Contact

Luis Otávio Martins (CNPJ 40.822.339/0001-98) — TourLore, Sorocaba, São Paulo, Brazil. Email: founder@tourlore.co. This address also serves as our contact for data protection matters (encarregado / DPO contact).