Privacy policy
Last updated 5 October 2026
In short: we collect what you give us so you can save, organise, plan and share places, plus your location when you allow it. When you add a post, webpage or screenshot, its content is read by an AI service to find the places in it. We don't sell your information, show ads, use analytics trackers, or track you across other apps and websites. You can export your data, or delete your account and everything in it, from inside the app.
What changed on 5 October 2026:
- Shared collections: what the people you plan with can see (section 6).
- Importing from screenshots, webpages and lists of links or places, including Google Takeout (sections 2 and 3).
- We now keep an import's result, including the transcript, until you remove the import, and we share the analysis of a public post between accounts for up to 30 days, without recording who imported it (section 3).
- Profile photos, private visits, reminders, day plans that sync between your devices, and exporting your data (sections 2, 4 and 11).
- Maps now come from Google Maps, and day planning uses Google's routes and weather services (section 6).
- Updated retention periods (section 8).
1. Who we are
This policy explains how Vouch ("Vouch", "we", "us", "our") collects, uses, shares and protects personal information when you use the Vouch mobile app, the website at heyvouch.app, and the shared pages we host (together, the "Service"). Vouch is the organisation responsible for your personal information. For GDPR purposes, that makes us the data controller.
We handle personal information under the New Zealand Privacy Act 2020 and the privacy laws that apply where our users live, including the EU and UK GDPR and US state privacy laws where they apply. Our Terms of Use also apply to your use of the Service.
2. Information you give us
- Account details: your email address, and a password or a one-time sign-in link. Passwords are stored only as a secure hash by our authentication provider. We never see them.
- Profile: your handle, and optionally a display name, profile photo or emoji avatar, bio, home city, profile colour, and the collections you choose to feature.
- Your places: the places you save, your notes and takes on them ("vouches"), the places you mark as must-go, your collections, and whether each collection or your profile page is shared.
- Visits: when you mark a place as visited, the date, and optionally what you had, a short note and whether it was worth it. Visits are private to you.
- Day plans: the days out you plan and save, so you can open them on any device you sign in on.
- Shared collections: when you plan together, the collections you join or invite people to, the places you add, the group notes you write, and your role (owner, can add places, or can view).
- What you import: the TikTok, Instagram and webpage links you paste or share to Vouch, screenshots you choose to upload, and lists of links or place names you paste, including a Google Takeout "Saved places" file. A note in a Takeout file becomes a private note on that save.
- Reports and messages: if you report content or contact us, we keep what you send, and for a report, a copy of the reported collection as it was when you reported it.
3. How we read posts, webpages and screenshots
Turning something you found into a saved place is the heart of Vouch. When you add something to import:
- TikTok and Instagram posts: our server fetches the post's publicly available content, signed out: its caption or title, the creator's public handle, its cover image, and its audio. For some posts that means the video file or the slideshow's images.
- Webpages: our server fetches the page's publicly available text, without cookies or signing in, and without running the page's scripts.
- Screenshots: the images you pick are uploaded to private storage that only your account can reach.
That content is sent to Google Gemini, a third-party AI service, which transcribes audio, reads text in images, and works out which places it's about and what it says is good there. We send no information that identifies you: no name, email or account ID. You then review the result, edit it if you like, and choose what to save.
What we keep:
- The import itself: the link and the analysis (the places found, and for a post, its caption, creator and transcript) stay in your account so you can review it, retry it, or come back to it. They're deleted when you remove the import, 30 days after you cancel it, or when you delete your account.
- What you save: the place details, your edited notes, a link to the original post or page, and the creator's handle so we can credit them.
- Shared analysis of public posts: if several people import the same public TikTok or Instagram post, we analyse it once and reuse the result for up to 30 days. That shared copy contains only what the post itself says, never who imported it or anything they saved or wrote. Webpages and screenshots are never shared this way.
- Screenshots are deleted 7 days after upload, or straight away when you remove the import. Places you saved from them stay.
- We don't keep a post's video, audio or images. They're held only in memory while the post is analysed, then discarded. We don't copy or re-host anyone's post. Vouch shows where the post points you, and links back to the original.
You agree to this processing when you create your account. Only what you choose to import is sent. If you'd rather not use AI, you can add places by searching for them by name instead. Google processes this content under the Gemini API Additional Terms of Service.
If you're a creator and want your public details removed from a place someone saved, email team@heyvouch.app.
4. Information collected automatically
- Location, only with your permission: your device's location while the app is open. We use it to show you on the map, bias place searches towards where you are, show what's trending nearby, suggest places in your area, bring back places you saved nearby, and plan a day out from where you are, including walking or driving routes and the weather. It's never collected in the background. Your coordinates are used for each request and not stored against your account. When you use Explore, we record the approximate area of the request (a zone a few kilometres across) with the results we cache for that area.
- Photos, only the ones you pick: when you import screenshots or choose a profile photo, the app reads only the images you select.
- Reminders: if you turn on reminders, they're scheduled as notifications on your phone. We don't use push notification services or collect a push token, and you can hide place names on your lock screen.
- Usage records for running the Service: for each import we record technical details such as timing, the type of source, how many places were found, and an estimate of what it cost, but not the link, caption, transcript or place names. We also keep records of usage against daily limits and costs, and which suggestions you acted on in Rediscover (not their content).
- Live updates: while the app is open and you're in a shared collection, it keeps a connection open to hear when a collection you're in changes. The message says only which collection changed.
- Technical and log data: when you use the Service, our hosting and infrastructure providers automatically receive standard request data, such as your IP address, device and browser type, and timestamps, to deliver, secure and fix the Service.
- Your clipboard: read only when you tap Paste, and only to pick up a link.
- Local storage on your device: used to keep you signed in, keep a copy of your saved day plans for offline use, and remember choices such as whether you've seen the welcome guide.
We don't use analytics or advertising SDKs, advertising identifiers, or tracking cookies, and we don't track you across other companies' apps or websites. Our web pages load fonts from Google Fonts, which receives your IP address when a page loads.
5. How we use your information
| Purpose | Legal basis (EU/UK) |
|---|---|
| Create and run your account, save and sync your places, collections and day plans, and show what you choose to share to the people you share it with | Performing our contract with you |
| Let you plan together in shared collections, and update them live for everyone in them | Performing our contract with you |
| Analyse posts, webpages and screenshots you import with AI | Performing our contract with you |
| Use your location for maps, nearby search, trending, Explore, Rediscover and day planning | Your consent (device permission) |
| Schedule reminders on your phone | Your consent (notification permission) |
| Send account emails: confirmation, sign-in links and password resets | Performing our contract with you |
| Keep the Service safe: filter objectionable words, review reports, and enforce our Terms | Legitimate interests and legal obligations |
| Fix bugs, prevent abuse, apply fair-use limits, and understand overall load and cost | Legitimate interests |
| Comply with the law, and respond to lawful requests and disputes | Legal obligations and legitimate interests |
Trending shows how many people saved a place, never who saved it or what they wrote. We don't use your information for advertising or profiling, and we don't use your content to train AI models.
6. How your information is shared
We do not sell your personal information, and we do not share it for targeted advertising. We share it only as follows.
- With people you plan with. In a shared collection, everyone in it (the owner and the people they've invited) can see its places, each place's card, who added it, the group notes, and the handles, display names and photos of the people in it. Places someone adds appear on everyone's map in the app. They never see your private notes, visits, must-go marks, your other collections, or anything else in your account. If you leave or are removed, the places you added stay in the collection, labelled as no longer in it, unless you or the owner take them out.
- With people you share a link with. Your collections are private until you share them. Anyone with a shared collection's link can see the places you added to it, along with your handle, display name and photo. Anyone with your profile link can see your profile page, which is off until you turn it on. Someone viewing a shared collection in the app can save their own copy of it, and that copy stays in their account even if you later stop sharing or delete yours. Shared pages ask search engines not to list them.
- With service providers who run the Service for us, under contracts that require them to protect it and use it only to provide their service:
- Supabase: database, authentication, file storage and live updates
- Vercel: hosting for our servers and web pages
- Google: Gemini, which analyses what you import and suggests places for Explore; Google Maps Platform, for the map, place search, place details, routes and weather; and Google Fonts. Vouch uses Google Maps features, so Google's Privacy Policy also applies to that use.
- Resend: delivers our emails
- A media-processing server that we operate on a cloud host, which fetches the public content of posts you add
- For legal reasons, when we believe in good faith that the law requires it, or that it's needed to protect the safety, rights or property of our users, the public or Vouch.
- In a business transfer, such as a merger or acquisition. The new owner would be bound by this policy, and we'd tell you before your information became subject to a different one.
- With your consent, in any other case.
7. International transfers
Our service providers store and process information in the United States and other countries, which may not have the same privacy laws as where you live. When we send personal information overseas, we take reasonable steps to make sure it gets protection comparable to the New Zealand Privacy Act, as Information Privacy Principle 12 requires. For information from the EU or UK, that means safeguards the GDPR recognises, such as the European Commission's Standard Contractual Clauses.
8. How long we keep it
- Your account and content: your places, notes, visits, collections and saved day plans are kept for as long as you have an account. Anything you delete is removed straight away.
- Imports: kept until you remove them. Cancelled imports are deleted after 30 days, and pasted lists of links or places after 90 days (the places you saved from them stay).
- Screenshots you upload: 7 days, or until you remove the import.
- Shared analysis of public posts: up to 30 days (3 days if it found no place).
- Import and Rediscover records: 180 days. Usage and cost records: 13 months, for billing reconciliation.
- Profile photos: while it's your current photo. A replaced photo is removed.
- Place information from Google is refreshed or removed within the periods Google's terms allow.
- When you delete your account (You → Settings → Delete account): your account, profile, places, notes, visits, imports, day plans and collections are permanently deleted straight away, and every link you shared stops working. Collections you own are deleted for everyone in them, and places you added to other people's collections are removed. Copies other people saved from your shared collections stay in their accounts. Usage records and reports are kept for the periods above with your account removed from them.
- Logs and backups: kept by our providers for limited periods, and then deleted or overwritten on their normal schedules.
9. Security
Information is encrypted in transit. Access to it is restricted by database security rules, so other users can only ever read what you've chosen to share with them. Uploaded screenshots are stored privately, readable only by your account and our servers. Our providers keep industry-standard certifications. No system is perfectly secure, so please use a strong, unique password. If a privacy breach is likely to cause you serious harm, we'll tell you, and the Privacy Commissioner, as the law requires.
10. Children
Vouch is not for children under 13, or under the minimum age for using online services in your country. We don't knowingly collect information from them. If you believe a child has given us personal information, contact team@heyvouch.app and we'll delete it.
11. Your rights and choices
Wherever you live, you can:
- Access or correct your information. Most of it you can see and edit directly in the app.
- Take a copy of your places, notes, visits, collections and day plans with Export my data in Settings, and email us for anything else.
- Delete anything you've saved or imported, or your whole account, from inside the app.
- Leave a shared collection at any time, and choose whether to take the places you added with you.
- Withdraw consent to location, photos or notifications at any time in your device settings. Withdrawing doesn't affect processing that has already happened.
- Stop sharing a collection or your profile page at any time.
EU and UK residents also have the right to data portability, to object to or restrict processing based on legitimate interests, and to complain to their local data protection authority.
US residents of states with consumer privacy laws, such as California, Virginia and Colorado, have the right to know, access, correct and delete personal information, and to opt out of its sale or use for targeted advertising. We do neither of those. We won't treat you differently for using your rights.
To make a request, email team@heyvouch.app. We may need to confirm your identity first. We'll respond within 20 working days, as the New Zealand Privacy Act requires, or sooner if your local law requires it. Requests are free.
12. Complaints
If you have a concern about how we've handled your personal information, please contact us first at team@heyvouch.app and we'll try to resolve it. If you're not satisfied, you can complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz, or to the data protection authority where you live.
13. Third-party links
Vouch links to other services, such as TikTok, Instagram, the webpages you import and Google Maps. Their own privacy policies apply when you use them, and we're not responsible for their practices.
14. Changes to this policy
We'll update this policy as Vouch changes, change the date at the top, and summarise what changed. If we make a significant change, we'll tell you in the app or by email before it takes effect.
15. Contact
Vouch · team@heyvouch.app · heyvouch.app