Privacy policy

1. What Vivenro collects

• Account: your Google account email, name and profile picture when you sign in with Google (or your email for a magic link).
• What you add yourself: countries and cities, trips, photos and videos you upload, answers to story prompts, captions, your handle and bio, friends you invite, questions and tips.
• From Gmail, only if you connect it: Vivenro searches your mailbox with travel-specific queries (bookings, itineraries, e-tickets, confirmations from known travel senders) and reads the matching messages to find trips. It keeps message references and short snippets (sender, subject, date, a booking reference, a few lines of context) — not whole mailboxes and not unrelated mail. Full message text is processed in memory to extract a trip and is not stored.
• From Google Calendar, only if you connect it: read-only event titles, dates and locations that look like travel, to suggest trips. The grant is separate from Gmail and can be removed on its own.
• Compliments and complaints you send: the draft, the recipient, what you told us happened, and the outcome you record. Sending uses your own Gmail address and happens only when you tap Approve.
• Assistant connections: if you connect Claude, ChatGPT, Gemini, Cursor or another assistant over MCP, Vivenro records the client name, the permissions you granted and when. Anything an assistant proposes is a draft until you confirm it in Vivenro.
• Technical: server logs with request paths, timestamps and error messages, and an audit log of actions taken on your account (drafted, sent, published, shared, deleted). No advertising identifiers, no third-party analytics.

2. How Vivenro uses it

• To rebuild your trips, countries and cities, and draft stories, compliments and complaints for you to review.
• To show friends only what you explicitly shared with them, and the public only what you explicitly published.
• To send a compliment or complaint from your Gmail when you approve it — never automatically.
• To keep your world current with a nightly incremental resync of the accounts you connected (you can disconnect at any time).

Vivenro does not sell or rent your data, does not use it for advertising, and does not use it to train general-purpose AI models.

3. Google user data and the Limited Use policy

Vivenro's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

• Gmail data is used only to find and reconstruct your trips and to send messages you approve. Calendar data is used only to suggest trips.
• It is never transferred to others except as needed to provide the feature (see §4), never used for advertising, and never read by a human except with your explicit consent for support, for security, or where the law requires it.
• The scopes requested are gmail.readonly, gmail.send (used only for compliments and complaints you approve) and calendar.readonly, plus basic profile for sign-in.
• You can revoke access at any time in Vivenro (Sources → Disconnect) or at myaccount.google.com/permissions. Disconnecting deletes the stored tokens immediately.

4. Who processes your data

Vivenro runs on infrastructure providers that process data on its behalf under their own security and privacy commitments:

• Railway — application servers and the Postgres database (US).
• Cloudflare — DNS, and R2 object storage for the photos and videos you upload (served through short-lived signed links; originals are private).
• Anthropic (and, only if you choose them in Settings, OpenAI or Google Gemini) — the AI models that draft stories, extract trips from emails and write compliments or complaints. They receive the text needed for that task and are used under API terms that do not permit training on your data.
• Google — sign-in, Gmail and Calendar APIs as described above.
• Resend — transactional email (magic links, friend invites).
• Wikimedia Commons / Openverse — when a story has no photo of yours for a section, Vivenro searches these for an openly licensed photo and shows the credit. Nothing about you is sent; only the place name.

No other sharing takes place. Public story pages are, by definition, visible to anyone with the link and to search engines and AI answer engines; you control that with one tap.

5. Private by default, and what friends and the public can see

• Your inbox evidence, bookings, trips you confirm, uploads and the map are private. Importing and confirming never publish anything.
• Stories are public by default: the first time a story is drafted it goes live at your public page, unless you set that story (or your account default in Settings) to private first. One tap makes any story private again, and its page stops resolving immediately. A published page is a snapshot; later private edits never leak.
• Friends see only journeys you marked for friends. If you share a complaint or compliment with friends, they see your own words, the place and the outcome — never the email, the recipient or booking references.
• Public pages never include booking references, email addresses or evidence.

6. Security

• Google and assistant tokens are encrypted at rest with a server-side key and are never in the browser.
• Ownership and audience checks run on the server for every record and every media request.
• Uploaded photos have location and camera metadata (EXIF) stripped from the versions that are served.
• Assistants act through scoped, revocable OAuth 2.1 tokens or API keys you create; any publish, share or send still needs your approval in Vivenro.

7. Retention, export and deletion

• Your data stays until you delete it. Disconnecting Gmail or Calendar deletes the tokens at once; trips you already confirmed stay unless you remove them.
• Export: Settings → Your data → Export my data gives you one JSON file with your profile, journeys, every story revision and what was published, visits, stays, experiences, planned destinations, trip candidates, captions, compliments & complaints, and connection records (tokens redacted).
• Delete: Settings → Your data → Delete my account removes everything — profile, journeys, stories (public pages stop resolving immediately), uploads in storage, inbox evidence, connections, assistant tokens, audit entries. Backups roll off within 30 days.
• Server logs are kept for up to 30 days for debugging and security.

8. Children

Vivenro is not directed at children under 16 and does not knowingly collect their data. If you believe a child has created an account, write to the address below and it will be deleted.

9. Your rights and how to reach us

Depending on where you live (including California and the EU/UK), you may have rights to access, correct, export, restrict or delete your data, and to object to certain processing. The controls in Settings cover most of this instantly; for anything else email privacy@vivenro.com. Varshyl Inc., San Jose, CA, USA.

10. Changes

When this policy changes in a way that matters, the date at the top changes and you will see a notice in the app before the change applies to your account.