Privacy & data · No surprises
Two columns: the left is what we touch, the right is what we don't. Below them, the one thing we build from everyone's trips together. If anything moves, this page changes first.
What we touch · what we don't
✓ What we read
Hotels, flights, trains, transfers, museum/event tickets.
Dates, times, prices, terms, addresses. Not your replies.
A whitelist of ~200. Booking.com, Expedia, airlines, OTAs.
To know when to file the dossie.
× What we don’t
Mail from people, not businesses, is filtered out before parsing.
OAuth scope is read-only. Send permission is not granted.
Not sold, not rented, never handed to data brokers — not the raw mail, not anything that names you.
Your raw mail does not go into any training corpus. Ever.
Only essential cookies — they keep you signed in and remember your invite. No analytics, no ad pixels, no third-party trackers.
→ What we learn from trips
Where people go, when, for how long — pooled across everyone, never tied to a name.
Sharper tip ranking, “travellers like you found this worth it”, real seasonal price context.
These aggregates improve Dossie. They aren’t sold, licensed, or shared outside the desk.
Three commitments
Cancel and your personal data is deleted within 7 days, logs included. Anonymised aggregates that can’t identify you remain.
EU-resident DB, EU-resident workers. No third-party processors.
OAuth scope is read. Workers can’t send, draft, or forward — the capability isn’t granted on either side of the desk.