Privacy Policy

Explorust is a travel product operated by Kyle Francis(“Explorust,” “we,” “us”). We help you corral travel inspiration and confirmation emails onto a single timeline per trip.

This policy explains what data we collect, why, where it lives, who sees it, and how you get rid of it. Questions: privacy@explorust.com.

What we collect and how we use it (this is a summary — sections below are authoritative):

• Contact info — email, name. Used to create your account, sign you in, and send service notices. Linked to your identity.
• User content — trips, notes, saved inspiration, forwarded emails, connected-inbox messages matching travel confirmations. Used only to build your timeline. Linked to your identity.
• Usage data — pages viewed, features used, crash reports. Used to improve the product. Not sold. Linked to your identity so we can support you.
• Identifiers — an internal user ID and, for iOS, an IDFV (identifier for vendor). Not used for advertising or cross-app tracking.

We do notsell your data, serve ads, use your content to train generalized AI models, or track you across other companies’ apps or websites.

Account data

Your email address, name, and any profile information you provide. Stored when you sign in via magic link, Google, or Apple.

Trip content you create or import

The trips, timeline items, notes, and inspiration you add — either by typing them in, forwarding email to trips@in.explorust.com, sharing a link from another app, or connecting your inbox.

Google user data (when you connect Gmail)

If you choose to connect a Google account, we request the following scopes:

• userinfo.email, userinfo.profile — so we can show the connected account back to you.
• gmail.readonly — so we can read confirmation emails from airlines, hotels, and travel booking sites, and convert them into trip items on your timeline.

We do notsend email, modify your inbox, read labels you haven’t granted us, or index messages unrelated to travel for any purpose other than filtering the relevant confirmations.

Usage data

Standard product analytics — pages viewed, features used, errors. We use PostHog for this. We do not sell this data.

• To build your trip timelines from the emails and content you supply.
• To send transactional messages (sign-in links, import confirmations, account notices).
• To operate, improve, and debug the product.
• To route inspiration and briefs to a travel advisor only when you explicitly initiate that handoff.

We do not use your email content or trip data to train generalized AI models, and we do not sell your data to third parties.

Explorust’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, information we receive from Google APIs (including Gmail message content and metadata):

• Is used only to provide or improve the user-facing travel-timeline feature you connected Gmail for — extracting flights, hotels, reservations, and other travel confirmations, and showing them back to you in your trips.
• Is nottransferred to others, except as necessary to provide that feature (see our sub-processor list below), to comply with applicable law, or as part of a merger, acquisition, or asset sale — in which case we’ll notify you and require equivalent protections.
• Is not used to serve advertisements — including personalized, retargeted, or interest-based ads.
• Is notused to train generalized or third-party AI/ML models. We pass email content to Anthropic’s Claude API for extraction; Anthropic does not train on API inputs.
• Is notread by humans, except: (a) with your explicit consent, (b) to comply with applicable law, (c) for aggregated, anonymized security or internal-operations purposes, or (d) when absolutely necessary to investigate a specific bug or abuse you’ve reported to us.

Before you grant access, Google will show you a consent screen listing the exact scopes Explorust is requesting. You can revoke that access at any time — see Revoking Google access below.

We rely on the following sub-processors:

• Supabase — database, auth, and file storage (US region).
• Anthropic (Claude) — extraction of flights, hotels, and places from email content and shared URLs. Anthropic does not train on API inputs.
• Cloudflare R2 — screenshot and media storage.
• Vercel — web hosting.
• Postmark — transactional email and inboundtrips@in.explorust.com forwarding.
• PostHog — product analytics.

Your data is stored in the United States. We keep it as long as your account is active. When you delete your account, we delete your trip content, inspiration sources, and Google OAuth tokens within 30 days. Some system logs may persist up to 90 days for security and debugging, then are purged.

• See it. You can export your trips at any time from the account settings page.
• Delete it. Deleting your account removes your data on the schedule above. You can also disconnect Gmail at any time — that revokes our access and deletes the stored refresh token immediately.
• Correct it. Edit any trip item directly.
• Residents of California, the EU, UK, and similar jurisdictions have additional rights under GDPR/CCPA. Email privacy@explorust.com and we’ll handle it.

On iOS, you can sign in with your Apple Account using Sign in with Apple. When you do, Apple sends us a stable user identifier and either your real email address or an Apple-provided private relay email (of the form…@privaterelay.appleid.com), based on your choice in the Apple consent screen. Explorust treats the private relay address exactly like a real email — we send transactional messages to it, and Apple forwards them to you. We don’t attempt to correlate relay addresses back to your real Apple Account.

If you install the Explorust iOS app, we follow Apple’s App Store privacy requirements, including the App Privacy nutrition labels you see on our App Store listing. We do not use Apple’s Advertising Identifier (IDFA) and we do not request App Tracking Transparency permission, because Explorust does not track you across other companies’ apps or websites.

Your use of any iOS version of Explorust is additionally governed by the Apple Media Services Terms and the App Store’s Licensed Application End User License Agreement.

You can delete your Explorust account, and all data associated with it, from inside the app — open Settings → Account → Delete account. Account deletion is permanent. Once you confirm:

• Your trips, trip items, and inspiration sources are removed.
• Any stored Google OAuth refresh tokens are deleted immediately, which revokes our ability to read your Gmail.
• Your Sign in with Apple identifier, email, and profile are removed from our database.
• Backups and system logs are purged on the schedule described in Where we store it, and for how long above.

If you can’t reach the in-app flow for any reason, email privacy@explorust.com from the address on your account and we’ll delete it for you within 30 days.

You can revoke Explorust’s access to your Google account at any time from myaccount.google.com/permissions, or from your Explorust account settings. Revoking at Google does not delete trips already imported — use the account settings page to delete those.

Data in transit is encrypted with TLS. Database storage is encrypted at rest. Google refresh tokens are stored encrypted in our database, readable only by the Explorust server. We run regular dependency and infrastructure scans.

No system is perfect. If you spot a vulnerability, email privacy@explorust.com — we’ll respond within 72 hours.

Explorust is not directed to children under 13. If you believe a child has given us personal information, email privacy@explorust.com and we’ll delete it.

We’ll update this page when something material changes and update the “Effective” date above. For significant changes we’ll email you.

Kyle Francis
privacy@explorust.com