Privacy Policy

You sign in with your email address, with Apple, or with Google. An account is what lets your trips follow you between the website and your phone, and it is what makes the data yours rather than one device's — reinstall the app or change phone and everything is still there.

We ask for as little as we can to do that: an email address, and the travel details you choose to enter. Everything we hold is listed below.

• Your email address, used to identify your account and send sign-in codes. If you sign in with Apple or Google, we receive your email address from them — nothing else in that account, and with Apple you can choose to hide your real address behind their private relay.
• Your trips — departure and return dates, destination country, Indian port of exit and entry, and any note you add.
• Your calendar events — the name and date range of anything you add to plan around.
• Your residency profile — the settings that drive the day-count rules, such as your residency type and whether you've told us your Indian income is over ₹15 lakh.
• Files you attach to a trip, such as a boarding pass or passport stamp. These are stored privately and are reachable only through short-lived links generated for you.
• Itineraries you email in, if you forward one to our trips address — the sender address, subject, and message text, held until you import or dismiss it.

We do not ask for your passport number, visa details, financial account details, or precise location, and the apps never request location access.

Only to run the features you use: counting your days, showing your calendar, syncing across your devices, and letting you export your records. We do not sell your data, we do not share it for advertising, and we do not track you across other apps or websites.

• Supabase — hosts the database, sign-in, and file storage.
• Vercel — hosts the website and the API.
• Google (Gemini API) — when you use AI import, the text and files you supply are sent to Google's model to extract trip details. Only what you put into that import is sent — never your stored trips, attachments, or profile. We use the paid Gemini API, under which Google does not use what you send to train or improve their models.
• Resend — delivers feedback you submit through the app to us, including the email address you provide.
• Cloudflare — receives itineraries you email in and passes them to the app.

The mobile app contains no analytics or tracking of any kind. The website may load Google Analytics and PostHog to count page views and understand which features get used. Both are skipped entirely if your browser sends a Do Not Track signal, and IP addresses are anonymised. Neither receives your trips, your attachments, or your residency profile.

• Export — download all your trips, and your calendar events, as CSV files at any time from the Trips screen.
• Delete your data — clear every trip, event, and attachment while keeping your account, from Settings.
• Delete your account — from Settings in either app. This permanently removes your account, every row of your data, and every file you uploaded. It cannot be undone, and we keep no backup copy of it afterwards.

We keep your data for as long as your account exists. If you want a copy of anything the export doesn't cover, or want us to delete something on your behalf, email support@tracknivaas.com.

Every record is scoped to its owner at the database level, so one account cannot read or modify another's data even if the app had a bug. Attachments live in a private store and are served through links that expire. Traffic is encrypted in transit.

No system is perfect, and we won't pretend otherwise. If you find a security problem, please report it to support@tracknivaas.com and we'll look at it promptly.

Nivaas is not directed at children and we don't knowingly collect data from anyone under 13.

If this policy changes materially we'll update the date at the top and, for anything significant, tell you in the app.

Questions about this policy or your data: support@tracknivaas.com.