Privacy Policy

Last updated: March 31, 2026

Dereho ("we," "our," or "us") operates the Dereho mobile application and the website dereho.com (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address — used for authentication, account recovery, and important service communications.
• Name (optional) — used to personalize your experience.
• Authentication provider data — if you sign in with Google or Apple, we receive your email and name from the provider. When using Sign in with Apple, your email may be hidden by Apple's relay service.

1.2 Travel & Content Data

When you use the Service, we collect:

• Trip details — destinations, duration, travel style preferences, and budget level you provide when creating trips.
• AI chat messages — conversations with our AI travel guide, including your questions and the AI-generated responses.
• Photos — images you upload for landmark identification (processed in real-time and not stored permanently on our servers).
• Favorites and saved places — places you bookmark or save for later.
• Collaboration data — when you share trips with others, we store collaborator relationships and access permissions.
• Feedback — any ratings, reviews, or feedback you submit through the app.

1.3 Location Data

With your explicit permission, we access your device's location to:

• Show nearby places and attractions.
• Provide walking and transit directions.
• Enhance place recommendations based on proximity.

We collect both:

• Precise location — when you grant location permission (for maps, nearby places, and directions).
• Approximate location — derived from your IP address (for trip generation and content relevance).

You can revoke location access at any time through your device settings. The app remains functional without location access.

1.4 Device & Usage Data

We automatically collect:

• Device information — device type, operating system version, app version, and device name.
• Device identifiers — advertising ID (IDFA on iOS, GAID on Android) used by Google AdMob for ad delivery.
• Usage analytics — features used, pages visited, API requests, session duration, and general interaction patterns.
• App interactions — interactions with ads and content, used for analytics and ad measurement.
• IP address — used for security, rate limiting, and approximate geolocation.
• Crash reports and diagnostics — technical error data sent to Sentry to help us fix bugs and improve stability.

1.5 Purchase Data

If you make in-app purchases (energy packs or PRO subscription), we store:

• Transaction identifiers from Apple App Store.
• Purchase type and amount.
• Subscription status and renewal dates.

We do not collect or store your credit card or payment details — all payments are processed by Apple.

2. How We Use Your Information

Purpose	Data Used
Generate personalized trip itineraries	Destination, preferences, budget, duration
Provide AI travel guide chat	Chat messages, trip context
Identify landmarks from photos	Uploaded images (processed, not stored)
Show nearby places and directions	Location data
Display relevant advertisements	Device identifiers (advertising ID), IP address, app interactions
Send push notifications	Device token, notification preferences
Process purchases and subscriptions	Transaction IDs, subscription status
Improve the Service	Usage analytics, crash reports, feedback
Prevent abuse and ensure security	IP address, device info, login attempts
Communicate with you	Email address

3. Third-Party Services

We use the following third-party services to operate Dereho. Each service receives only the minimum data necessary to perform its function:

Service	Purpose	Data Shared
Google AdMob	In-app advertising	Device identifiers (advertising ID), IP address, app interactions, ad viewing data
Google Gemini AI	AI trip generation, travel guide chat, landmark identification	Trip preferences, chat messages, uploaded photos
Google Cloud Platform	Server infrastructure and hosting	All service data (stored securely)
Google Maps Platform	Maps, places, directions	Location coordinates, place queries, device metadata
Apple (App Store)	Authentication, in-app purchases	Purchase receipts, account tokens
Google (OAuth)	Sign in with Google	Authentication tokens
Sentry	Crash reporting and error tracking	Device info, crash logs, stack traces, diagnostics
Expo	Push notifications	Device push token, notification content
Open-Meteo	Weather forecasts	Location coordinates (no account required)
Wikipedia	City and place images	Place names (public API, no account required)

4. Advertising and Tracking

Dereho displays advertisements through Google AdMob to support the free version of our app. To deliver relevant ads, AdMob collects and processes certain data:

• Advertising identifiers — IDFA (Identifier for Advertisers) on iOS and GAID (Google Advertising ID) on Android are used to deliver personalized advertisements.
• IP address — used for approximate geolocation and fraud prevention.
• App interaction data — information about how you interact with ads (views, clicks, engagement) is used for ad measurement and reporting.
• Device information — device type, OS version, and screen size help deliver appropriately formatted ads.

AdMob may share anonymized and aggregated data with advertising partners for ad targeting and measurement purposes.

Opting Out of Personalized Ads

You can opt out of personalized advertising at any time through your device settings:

• iOS: Go to Settings > Privacy & Security > Tracking, and disable "Allow Apps to Request to Track." You can also go to Settings > Privacy & Security > Apple Advertising and turn off "Personalized Ads."
• Android: Go to Settings > Google > Ads, and enable "Opt out of Ads Personalization." You can also reset your advertising ID or delete it entirely.

Even if you opt out of personalized ads, you may still see non-personalized advertisements in the app.

For more information about how Google handles advertising data, please visit: Google Advertising Privacy Policy.

5. Cookies and Tracking Technologies

The Dereho mobile application does not use browser cookies directly. However, third-party SDKs integrated into the app may use tracking technologies:

• Google AdMob may use device identifiers and mobile advertising technologies to serve and measure advertisements.
• Google Maps SDK may use device identifiers for service improvement and analytics purposes.
• Sentry uses device identifiers for crash report correlation and diagnostics.

You can control tracking technologies through your device settings as described in the "Opting Out of Personalized Ads" section above.

6. Data Storage & Security

• Your data is stored on secure servers hosted on Google Cloud Platform.
• All data in transit is encrypted using TLS/HTTPS.
• Passwords are hashed using Argon2 (industry-standard algorithm).
• Authentication tokens (JWT) expire after 15 minutes; refresh tokens expire after 7 days.
• Account lockout is enforced after 5 failed login attempts.
• We implement rate limiting and security headers following OWASP guidelines.
• Sensitive tokens are stored in your device's secure enclave (iOS Keychain / Android Keystore).

7. Data Retention

• Account data — retained as long as your account is active.
• Trip data — retained as long as your account is active. You can delete individual trips at any time.
• Chat history — retained as long as the associated trip exists.
• Uploaded photos — processed in real-time for landmark identification and not permanently stored on our servers.
• Analytics and logs — retained for up to 12 months for service improvement.
• Crash logs — retained for 90 days by Sentry for diagnostic purposes.
• Advertising data — retention is controlled by Google AdMob according to their data retention policies.
• Deleted accounts — all associated data is permanently deleted within 30 days of account deletion request.

8. Your Rights

You have the right to:

• Access your personal data — contact us to receive a copy of the data we hold about you.
• Correct inaccurate data — update your name, email, or preferences in the app settings.
• Delete your account and all associated data — use the "Delete Account" option in app settings or contact us.
• Export your data — request a copy of your trip data and personal information.
• Opt out of personalized advertising — use your device settings to disable ad tracking (see Section 4).
• Withdraw consent — revoke location, camera, or notification permissions at any time through your device settings.
• Opt out of non-essential communications — manage notification preferences in the app.

9. Children's Privacy

Dereho is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete that information promptly.

10. Push Notifications

With your permission, we may send push notifications for:

• Trip reminders and daily itinerary updates.
• Collaborator activity on shared trips.
• Place of the Day recommendations.
• New guide availability.
• Weekly travel digest.

You can manage notification preferences within the app or disable them entirely through your device settings.

11. International Data Transfers

Your data may be processed in countries other than your own. We ensure appropriate safeguards are in place when transferring data internationally, in compliance with applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you through the app or by email. Continued use of the Service after changes constitutes acceptance of the updated policy.