Privacy policy

Last updated: 3 October 2026

Who this policy covers

This policy applies to the Trundo mobile app ("Trundo," "the app," "we," "our"), developed and published by Trundo. It explains what happens to information when you use the app.

No account, no login

Trundo does not ask you to create an account, sign in, or provide your name, email address, phone number, or any other identifying information to use the app. There are no user accounts and no user database.

What data Trundo stores, and where

Everything you add to Trundo — trip names, dates, destinations, stops and landmarks, budgets, expenses, checklist items, notes, temporary contacts, and any documents or photos you attach — is stored locally on your device, in a private database and file storage area that only Trundo can access.

There is no cloud sync and no Trundo server that stores your trips. Your trip data only leaves your device when you choose to back it up, export it, or share it yourself (see below). The one exception is the names of the places on your trip, which the online features below use to look up public information about those places.

Anonymous usage and crash reports

Trundo uses Google Firebase Analytics and Firebase Crashlytics to see which features are used and to fix crashes.

What is sent

• Which screens and features are used (for example, "an expense was added").
• Basic device information: device model, operating system version, and app version.
• Crash reports: technical error details and the state of the app at the time of a crash.
• Approximate location at country or city level, derived by Google from a masked IP address. Trundo does not access your device's location.
• Random app-installation identifiers created by Firebase. These are not linked to your name, email, or any account.

What is never sent

• Trip names, destinations, stops, amounts, expenses, budgets, notes, contacts or phone numbers, documents, photos, file names, or anything you type.
• No account, name, or email address is collected.
• The advertising ID is not collected.

How it's used and handled

• This data is used only to understand how the app is used and to fix problems. It is not used for advertising and is not sold.
• It is processed by Google as a service provider under Firebase's terms. See Firebase's privacy and security information.
• Usage data is retained for up to 2 months. Crash reports are kept by Firebase Crashlytics for up to 90 days.
• All of it is encrypted in transit.

Turning it off

You can opt out at any time: open Settings in Trundo and turn off "Share anonymous usage & crash reports". This stops both usage and crash reporting immediately. Every feature of the app keeps working with it turned off.

Online features: things to do, place details and photos

When you're online, Trundo can suggest cities as you type a stop, show things to do and famous places for a stop, show details about a place, and add a photo of each stop and a cover photo for each trip. Some of this also happens in the background while you're online: matching a typed stop to a known city, fetching stop and cover photos, and, for trips that haven't ended yet, saving famous places so you can see them offline. Photo and offline-place downloads pause while Data Saver or Battery Saver is on.

What is sent

Requests go to trundo.app, Trundo's own server, which runs on Cloudflare. They contain only:

• Place names — the cities and stops on your trip, or a famous place you open — and their country.
• Public identifiers for those places (for example, a Viator destination or tour number) and, for a famous place, its public map coordinates.
• Your trip's currency, so prices can be shown in it.
• A random device ID (see below).

trundo.app then looks the place up with our partners: Viator (things to do, tours and place facts), Wikipedia and Wikidata (place descriptions) and Pixabay (photos). It passes on only the place name, country, identifier or coordinates — never your device ID or IP address.

What is never sent

• Trip names, dates, budgets, expenses, notes, checklists, shopping lists, contacts or phone numbers, documents, or photos you add yourself.
• Your device's location. Trundo does not access it.

Without internet, Trundo keeps working fully — these features simply don't show, or show what was saved for offline use.

Device ID

The first time Trundo uses an online feature, it creates a random ID on your device. It isn't linked to you, your Google account or your advertising ID, and it's sent only to trundo.app, only so the server can limit how many requests one device makes. The server hashes the device ID and your IP address before using them for this, keeps the request counts in memory for a minute or two, and doesn't log them. Uninstalling Trundo or clearing its data deletes the ID.

Like any website, Cloudflare — which runs trundo.app — handles your IP address to deliver requests, under Cloudflare's privacy policy.

Partner links and bookings

Tours show a "Book on Viator" button. It opens viator.com in your browser; Trundo doesn't take bookings or payments. Any booking is made with Viator, under Viator's own terms and privacy policy, and what you share there is between you and Viator. The link tells Viator the visit came from Trundo, and Trundo may earn a commission on a booking, at no extra cost to you.

Photos

• Automatic photos of your stops and trip covers come from Pixabay. Trundo finds them through trundo.app, then downloads the image straight from Pixabay's servers — so, as with any website, Pixabay sees your device's IP address for that download, and nothing else. The photo is saved on your device, with credit to its photographer.
• Photos of tours and famous places load straight from Viator's image servers (run by Tripadvisor) — so, as with any website, they see your device's IP address. These images are kept only in the app's temporary image memory, never saved to your device's storage or your backups; Trundo keeps only the image's web address.
• Photos you choose — from your gallery or camera — stay on your device and in your backups. Trundo never uploads them.

Caching

To stay fast and within our partners' limits, trundo.app keeps a copy of public place information — city lists, famous places, tours and prices, place descriptions, and photo search results — for between one hour and 30 days. These copies are stored by the place name or identifier that was looked up, never by device or IP address, and contain no trip data.

On your phone, famous places you've loaded are kept for up to 7 days so you can see them offline. Tours and prices are never kept for offline use.

Permissions Trundo requests, and why

• Camera — used only when you choose to photograph a document (e.g. a ticket or ID) to attach to a trip. The photo is saved directly to Trundo's private storage on your device.
• Storage / files — used to let you pick an existing photo or PDF to attach to a trip (photos for stops are picked with Android's own photo picker, which needs no permission), and to let you choose where to save or restore a backup or export file (for example, Google Drive, your device's local storage, or another folder you select). Trundo only accesses files you explicitly choose through your device's own file picker — it does not browse your storage on its own.
• Notifications — used to remind you about document expiry dates and checklist items you've set reminders for. Reminders are scheduled on your device.
• Internet access — used for the anonymous usage and crash reports and the online features described above. Your trip data is never sent.

Trundo does not request access to your device's contacts, location, or microphone.

Backup and restore

Trundo lets you export a backup of your trip data (and attached documents) as a file, which you save wherever you choose using your device's standard file picker — this might be Google Drive, local storage, or any other location you select. Trundo does not automatically upload this backup anywhere, and does not have access to your cloud storage accounts. Restoring a backup works the same way, in reverse: you select a file, and Trundo reads it locally.

Sharing and exports

If you choose to share a trip's itinerary with someone else, Trundo creates a shareable image or a small file containing only your trip's stops, landmarks, and checklist items — never your budget, expenses, documents, or contacts. Trip Wrapped posters and cards, and CSV exports of your expenses, are also created on your device.

None of these are sent anywhere by Trundo. They only leave your device when you explicitly tap "Share" or "Export" and send or save them using your device's own share menu or file picker (for example, to WhatsApp, email, or a folder you pick).

Temporary contacts

Trundo lets you save a phone number for a trip (for example, a driver or guide) so you can call it directly from within the app. These numbers are stored only inside Trundo's own local database, are never added to your device's Contacts app, and never leave your device.

Advertising and third parties

Trundo does not display ads and does not include any advertising SDKs. We do not sell any data. The third parties involved are Google (Firebase, for the anonymous usage and crash reports), Cloudflare (which runs trundo.app), and, through trundo.app, Viator, Wikipedia/Wikidata and Pixabay for public place information — plus Pixabay directly for photo downloads, and Viator if you open a booking link. None of them receives your trip data.

Children's privacy

Trundo is not directed at children under 13, and does not knowingly collect personal information from anyone, including children. The app has no accounts, and the anonymous usage and crash reports described above do not include names, contact details, or anything you type.

Data deletion

Since your trip data lives only on your device, you're always in full control of it. Deleting a trip removes it (with a 30-day recovery window via the in-app Trash, after which it's permanently erased, including any attached files). Uninstalling Trundo removes all of its local data from your device entirely.

Anonymous usage data and crash reports are deleted automatically after the retention periods above. Turning off "Share anonymous usage & crash reports" stops any new data from being sent. Request counts for the device ID are forgotten within minutes, and cached place information expires on its own.

Terms of use

Using Trundo is also covered by our short terms of use.

Changes to this policy

If this policy changes — for example, if a future version of Trundo adds an optional feature that involves data leaving the device — this page will be updated, and the "Last updated" date above will reflect that change.

Contact

Questions about this policy or how Trundo handles data can be sent to hello@trundo.app.