Privacy Policy
Who we are
hi tabi (“we”) is a curated, offline-first travel-planning service. This policy explains what personal data we process and why. For any privacy request, contact us at [email protected].
What we collect
Account: your email address, received from Google when you sign in. We never receive your Google password.
Trip data: the surveys you fill in and the plans you generate or save to your account.
Optional preferences: dietary and accessibility needs. These are special-category data and are stored only with your explicit consent.
If you join the waitlist or send feedback, the email or message you provide.
Basic, privacy-friendly usage measurement via Cloudflare's cookieless Web Analytics — no tracking cookies, no cross-site profiling.
Why we process it (legal basis)
To provide the service you ask for — generating, saving, and sharing plans (GDPR Art. 6(1)(b) performance of a contract).
To keep the service secure, reliable, and improving, including aggregate usage counts (GDPR Art. 6(1)(f) legitimate interests).
For your optional dietary/accessibility preferences, your explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6). You can withdraw it at any time.
Cookies & analytics
We use a single strictly-necessary cookie to keep you signed in. We do not use advertising or cross-site tracking cookies, and our analytics is cookieless — so no consent banner is required.
Service providers (sub-processors)
We share the minimum data needed with these providers, who process it on our behalf. They may process data outside Türkiye/the EEA under appropriate safeguards (e.g. Standard Contractual Clauses):
- Google — Sign-in (OAuth identity)
- Cloudflare — Hosting, database, CDN, and cookieless analytics
- Anthropic — AI plan sequencing — your trip inputs are sent to build a personalised plan when you are signed in
Retention
We keep your account data while your account exists. When you delete your account, your account record and saved plans are erased. Plans you chose to share by link remain available via that link until you delete them.
Your rights
Under GDPR and KVKK you can access, export, correct, or erase your data, object to or restrict processing, and withdraw consent. From your account page you can download your data (export) and delete your account at any time; for anything else, contact [email protected]. You may also complain to your data protection authority (in Türkiye, the KVKK Board).
Changes
We may update this policy; we will revise the date above and, for material changes, take reasonable steps to notify you.
Last updated: 2026-06-18