Travel Vault

Privacy policy

Last updated 7 October 2026.

Travel Vault is made by Pikeworks, a sole trader in Northern Ireland. This is what the app keeps, what leaves your phone, and why. The short version: where you have been lives on your phone, and if you sign in to a Pikeworks account, a private copy is kept with it so you can get it back. The map's tiles come from OpenFreeMap, and nothing about you goes with those requests. Your location is only read if you turn fog clearing on, and it never leaves the phone as you move: only the squares of fog you have cleared go in that private copy. A Pikeworks account and friends are optional and off until you choose them, and friends only ever see a flight you choose to share. There are no adverts, no analytics and no tracking.

What stays on your phone

The countries, cities and places of your own you mark, with their dates and notes; your flights, with everything you add to them, such as the seat, the cabin, the booking reference and notes; the squares of the map you have cleared of fog; and your settings. They are kept in the app's private storage on your phone. Without an account none of it is sent anywhere. Signed in, a private copy of it all, fog included, is kept with your account for you to bring back, as described under Cloud backup below; it never goes to friends.

If your phone backs up its apps to your Google account or to iCloud, that backup includes this app's data. Google or Apple keep it for you. It isn't sent to me.

The map

The map is drawn from OpenFreeMap's tiles, which are built from OpenStreetMap. When you look at a part of the map, your phone asks OpenFreeMap for the pieces of map it needs, directly and not through me, and keeps them so they need not be fetched again. OpenFreeMap receives those requests and, like any website, your IP address. Nothing you have marked, and not your location, goes with them.

The country outlines, the cities and towns, and the airports, airlines and aircraft are built into the app, from Natural Earth, GeoNames and OurAirports. Searching for a place or an airport happens on the phone.

Your location, and clearing the fog

Travel Vault only reads your location in two cases, both of which you start: when you turn on fog clearing, and when you tap the button that shows where you are on the map. The first time, your phone asks you to allow it, and you can say no. The app only ever asks for location while it is in use. It never asks to read it all the time.

While fog clearing is on, the app follows where you go so it can clear the fog along the way. On Android a notification shows the whole time it runs, with a button to stop it. On iPhone the blue location indicator shows. It rests the GPS when you stop moving. Turn it off in the app at any time.

What it keeps is which squares of the map (each about the size of a street block) you have been near, with the day each was first and last cleared, and whether it was on foot or on wheels. It does not keep a timeline of where you were and when. If you leave "Add places I stay in" on, a city or country you spend a quarter of an hour in is marked as been, and the app tells you when it does. All of this stays on your phone. If you're signed in, the squares and their days are in your private cloud copy too (Cloud backup, below), and nowhere else.

Bringing in your travels

Importing a Google Maps Timeline file, a GPX track, or flights exported from another app reads the file on your phone. Nothing in it is uploaded anywhere. Reading where your photos were taken also happens on the phone: on iPhone, only after you allow access to your photos (and only to the photos you allow); on Android, only the photos you pick. The app reads each photo's place and date, and does not copy, change or upload the photos.

Scanning a boarding pass

The camera is used only when you tap to scan a boarding pass, and a screenshot is read only when you pick one. The barcode is read on the phone: on Android by Google's ML Kit, which runs on the device, and on iPhone by Apple's own frameworks. The pass isn't sent anywhere.

On Android, when the scanner is used, ML Kit sends Google some technical details: the phone's model and Android version, the app's name and version, a random number for this installation, and how well the scanner worked. Google uses them to keep ML Kit working and to measure how it's used. They don't include what you scanned.

Backups and spreadsheets

A backup file or a spreadsheet (CSV) export is only made when you tap to make one, and it goes wherever you choose to send it. A backup includes the squares of fog you have cleared.

Sharing

The share pictures, the poster and "share as text" are made on your phone and handed to your phone's own share menu. They go only where you send them.

Your Pikeworks account, if you make one

You don't need an account to use Travel Vault. Without one, everything stays on your phone and the app works fully. A Pikeworks account is one sign-in for every Vault app, and you choose whether to make one, in Settings.

If you make one, the Pikeworks account service keeps:

• the email address you sign in with, if you use one, stored encrypted, with a scrambled copy so it can be found when you sign in;
• if you sign in with Google or Apple, the account number they give me, and with Apple a token I keep only so I can tell Apple when you delete your account. If you use Apple's Hide My Email, I only ever see the hidden address;
• your password, if you set one, scrambled so it can't be read back, not even by me;
• the public half of any passkey you make (the private half never leaves your phone);
• which phones and apps are signed in: the app, the kind of phone, and when each was last used;
• a short security log of sign-ins and changes to the account, which for 30 days also holds a scrambled tag made from your internet address, to slow down anyone guessing passwords.

I use these only to run the account you asked for and to keep it secure. Keeping it secure is a legitimate interest; running it is what you asked me to do. I never sell any of it, never use it for marketing, and never send you anything but sign-in codes and notices about your own account, such as a new way in being added.

Who handles it for me: Cloudflare runs the service and stores it in the European Union. Sign-in codes and notices are sent by Resend, which keeps the messages it sends in the United States under its data processing agreement, protected by the standard contractual clauses and the UK's addendum to them, and by Cloudflare's own email service. Cloudflare and Resend are companies in the United States.

How long I keep it: for as long as you have the account. A phone that hasn't used it for 18 months is signed out. If nobody signs in to the account for 24 months, I email you once, and delete it 30 days later unless you sign in. The security log is kept for 12 months. When you delete the account, everything above goes at once, and it is gone from my backups within 30 days.

Deleting it: in any Vault app, open Settings, then Pikeworks account, then Delete account. You can also do it on the web, from pikeworks.co.uk/delete-account, or by emailing travelvault@pikeworks.co.uk. Your entries on your phone stay where they are.

Your rights: you can ask for a copy of what the account holds, ask for it to be corrected or deleted, or object to how it's used, by emailing travelvault@pikeworks.co.uk. Where the account has an email address, the copy is sent to that address as a file, so it only reaches you. I reply within a month. If you want to complain about how I handle your information, write to the same address: I'll say within 30 days that I have it, and what happens next. If you're still unhappy, you can go to the Information Commissioner's Office at ico.org.uk.

The account isn't for anyone under 13.

Cloud backup, while you're signed in

While you're signed in to your Pikeworks account, Travel Vault keeps a copy of everything you've logged in it with your account, so you can get it back on a new phone or have it on another one. The copy is the same as Travel Vault's own backup file: everything you've logged, with any photos. It's saved by itself a minute or so after you change something, and only while you're signed in. Signed out, nothing is saved.

Only you can reach it: the copy is read only by Travel Vault, signed in to your account. I don't look at it or use it for anything else, and it never goes to friends. Cloudflare stores it for me in the European Union, in storage that isn't public. Cloudflare is a company in the United States.

One copy is kept, the newest. On a new phone, Travel Vault offers to bring it back when you sign in; what's on that phone stays, and the copy is added to it. If you use two phones, each adds the other's entries before it saves.

Deleting it: in Travel Vault, open Settings and use Delete the cloud copy. Everything on your phone stays. Deleting your Pikeworks account deletes every app's copy at once. Either way it's gone straight away; I keep no other copy of it.

Friends, if you turn them on

Friends is optional, and it's off until you turn it on. It needs a Pikeworks account. With it on, you can add people you know by their handle, a link or a QR code, see what they choose to share, and react and comment. Nobody can search for you, nothing suggests you to anyone, there are no public profiles, and nothing can be reshared. You can have up to 200 friends.

Every app starts private. Nothing from Travel Vault reaches anyone until you say so in Travel Vault, and then only the entries you switch sharing on for when you save them. A note starts switched off every time, and so does anything that says where you were.

If you turn friends on, the friends service keeps:

• your handle, and a display name if you add one. Your picture is drawn from a random pattern; you can't upload one;
• your invite code, which version of the community rules you agreed to, for each app whether it's shared with friends or private and whether you want a notice when a friend posts, and which app gets notices about friend requests;
• your friends, the friend requests you've sent and received, and the people you've blocked;
• the posts you share: what the share screen showed for that entry, such as its name and your rating, and only if you switched them on, a note, a photo or where it was;
• the comments and reactions you add;
• notices for you, such as a friend accepting your request or commenting on your post;
• in apps with friends tables, a few numbers for this year worked out from your log, such as how many different things you've logged, and for some tables the name of your top entry. The log itself never leaves your phone for this;
• for each phone that gets friends notifications: an identifier that Google's Firebase, or Apple, gives that phone for Travel Vault, whether it's Android or iPhone, and the phone's time zone, so notices arrive quietly at night;
• photos you share. Your phone makes a copy 1,080 pixels across and takes out everything the camera recorded, such as where and when it was taken, and the service turns away any photo that still has those details;
• any report you make, and if someone reports something of yours, a copy of what they reported, kept so that deleting it doesn't destroy the evidence;
• a record of anything I do about a report, such as taking something down or switching friends off for an account. If an account is barred from friends for good, I also keep the Google or Apple account number it signed in with and a scrambled fingerprint of its email address (never the address itself), so the same sign-in can't come back to friends on a new account.

Travel Vault also keeps a copy of what you've seen in friends on your phone, so it works without signal. That copy is kept apart from your log, isn't included in your phone's backup or the app's backup file, and is wiped when you sign out.

Who sees what: your friends see your posts from Travel Vault, and where you come in Travel Vault's tables, while Travel Vault is shared with friends and neither of you has blocked the other. Set Travel Vault back to private and they stop seeing them, without anything being deleted. Comments and reactions are seen with the post they're on, by the person whose post it is and by their friends who can see it. Some of them may not be your friends, so they see your handle, your display name and what you added. Someone you send a friend request to sees your handle and display name. Anyone with your invite link or QR code can send you a request; the link carries a code, not your handle, and making a new link stops the old one working. Handles, display names, posts and comments are checked automatically against a list of words that aren't allowed, and a display name can't hold a web address. Nothing else is read unless it is reported, and then I read it myself.

I use all this to run friends, which you asked for when you turned it on, and to keep it safe, which is a legitimate interest. When the law requires me to report something, as it does for anything that puts a child at risk, I do so because of that legal duty. I never sell any of it and never use it for marketing.

Who handles it for me: Cloudflare runs the friends service and stores what it holds, photos included, in the European Union. Notifications go through Google's Firebase Cloud Messaging and, for iPhones, Apple's push service. Each one carries the app's name and one plain line saying who did what, with the title of the post it is about cut to 40 characters, such as "Sam commented on your Neck Oil": never a note, a comment, anything else anyone wrote, or a photo. Where Firebase is used on your phone, it starts only when you turn friends on, with its analytics off. When something is reported, a private Discord channel gets a one-line alert with the kind of report, the app, the reason and a reference number, never a handle or what was written. Cloudflare, Google, Apple and Discord are companies in the United States. Friends never sends email, so Resend, which sends the account's sign-in codes, handles none of it. If something shared puts a child at risk, I report it to the National Crime Agency, as UK law requires, with the details of the account that shared it.

How long I keep it: for as long as you have the account, except where it says otherwise here.

• A photo on a post is deleted after 90 days, and the post stays, saying the photo is no longer shared. A photo that isn't added to a post within a day is deleted.
• Notices are kept for 60 days, and only this year's table numbers are kept.
• A friend request nobody answers lapses after 30 days.
• A phone's notification identifier goes when you sign out on that phone, or when the phone hasn't refreshed it for 30 days.
• When you change your handle, the old one is held for you for 30 days.
• Something taken down for breaking the rules is deleted 30 days later, and its photo straight away.
• Something reported is kept, where nobody in the app can see it, until the report is dealt with, even if it is deleted or its 90 days pass. A report is kept for a year after it is closed, and the record of what I did about it for a year.
• Anything reported because it may put a child at risk is kept until I have looked at it, even if it is deleted. If it is child abuse, I report it to the National Crime Agency, as the law requires, and it is kept for a year from the day I send that report, with what the law calls relevant data about the account that shared it: its posts, comments, photos, fish handed over, sessions and friend connections from the two weeks before. Then it is deleted unless the Agency asks me to keep it longer. The Agency's reference number for my report is kept for five years. If it is not child abuse, it is let go that night.
• A bar from friends for good is kept after the account is deleted, because that is its purpose.

Whatever is deleted is gone from my backups within 30 days.

Block and Report: every post, comment, friend and friend request has Block and Report, and so does everything else friends lets someone send you. Blocking someone works in every Vault at once. It ends the friendship, cancels your requests to them, and hides your posts, comments, reactions, notices and table rows from each other. They aren't told, and a request from them never reaches you. You can unblock someone under Blocked in Friends; that doesn't bring the friendship back. I read every report myself and aim to do it within a day, and the person you report is never told who reported them. Anything reported as putting a child at risk is hidden straight away, and anything three people report is hidden until I've looked at it. Breaking the rules can mean what you shared is taken down, and friends switched off for your account for 7 days, 30 days or for good; your own log and backups aren't touched.

Deleting it: you can delete any post or comment of yours, and any comment on your own posts, at any time. Deleting your Pikeworks account, as above, deletes everything friends holds about you too: your profile, friends, requests, blocks, posts, comments, reactions, notices, numbers and photos. Reports about you are closed and their copies deleted, apart from anything held because it may put a child at risk. Reports you made stay open, with your account taken off them, so what you reported is still looked at. Your handle is freed 30 days later.

Your rights: the rights described for the account cover friends too. Email travelvault@pikeworks.co.uk to ask for a copy of what friends holds about you, to have it corrected or deleted, or to object to how it's used.

Friends isn't for anyone under 13, or under 18 in an app that is for adults.

What a flight shared with friends carries

In Travel Vault, friends start private: nothing from Travel Vault reaches them until you turn sharing on in Friends. Even then, a flight only goes when you add it and switch Tell friends on, and that switch starts off every time. Only a flight that has already happened can be shared, never one in the future. It carries the two airports, the airline and the month. Never the day, the flight number, your seat, your cabin, the aircraft, your notes or your booking reference, and never anything from your map: not the countries or cities you've marked, not the fog, not your location and nothing you bring in from elsewhere. The app doesn't read them to make a post.

Travel Vault's tables show how many countries and how many airports each of you has flown to this year. Your phone works those numbers out from the flights in your log and sends only the two numbers.

Feedback you send

Feedback is only sent when you tap Send under Send feedback in Settings. It contains what you type, and your email address if you choose to give one so I can write back. So I don't have to ask, it also carries the app's version, whether you're on Android or iPhone, and the model of phone. Nothing from your travels goes with it: no places, flights, fog or location, and not your account or any identifier.

It goes to the Pikeworks feedback service, which runs on Cloudflare and keeps what you send in the European Union; Cloudflare is a company in the United States. Your IP address is used to stop abuse and is never stored. A copy of the message is posted to a private Discord channel that only I can read, so I see it on my phone straight away; Discord is a company in the United States. Feedback is kept until it has been dealt with, and deleted within six months after that, Discord copy included. You can ask for yours to be deleted sooner using the address below.

Purchases

Everything you record in Travel Vault is free. Travel Vault Pro is a one-off purchase through Google Play or the App Store, so I never see your card details. RevenueCat, a company in the United States, processes the purchase record to confirm it, using a random anonymous ID rather than your name or email address. It isn't told about your Pikeworks account. RevenueCat's policy is at revenuecat.com/privacy.

Partner links

On a country you want to go to, the app may show a link to buy an eSIM from a partner, marked as a partner link. Nothing is sent when it is shown. If you tap it, it opens the partner's website in your browser, which then knows you came from Travel Vault; what you do there is covered by the partner's own policy. You can turn partner links off in Settings.

Rating the app

The app may offer to let you rate Travel Vault in the store. That prompt is shown by Google or Apple, and anything you write in it goes to them, not to me.

Permissions

Travel Vault asks for the camera only when you first tap to scan a boarding pass; for your location only when you turn on fog clearing or tap to see where you are; for notifications (Android) only when you turn on fog clearing, for the notification that shows it is running; and for your photos only when you choose to bring in places from them; and for the camera again when you scan a friend's code. It doesn't ask for your contacts.

Age

Travel Vault isn't aimed at children under 13. A Pikeworks account and friends aren't for anyone under 13.

Deleting your information

Settings has "Erase everything", and uninstalling Travel Vault deletes everything it stored on your phone. A cloud copy, if you were signed in, stays with your account until you delete it in Settings or delete the account. Deleting your Pikeworks account deletes the account and everything friends holds about you, as described above, and it's gone from my backups within 30 days. Do it in Settings, then Pikeworks account, then Delete account, or on the web from pikeworks.co.uk/delete-account, without installing anything. Deleting the account doesn't touch your travels on your phone. To have feedback you sent deleted, email the address below.

Your rights

For your Pikeworks account, its cloud copy, friends and anything you've sent me, you can ask for a copy, ask for it to be corrected or deleted, or object to how it's used, by emailing the address below, and complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this policy changes, the date at the top changes and the new version is posted on this page.

Contact

Email me at travelvault@pikeworks.co.uk.