Vacaylo - CountryTracker Privacy Policy

Last updated: October 11, 2026

About this policy

This Privacy Policy explains how MuffinLine ("we", "us" or "our") collects, uses and protects information when you use Vacaylo - CountryTracker ("Vacaylo", the "app"), our app for logging the countries you have visited.

Vacaylo is built to work on your device first and to collect as little about you as possible. If anything here is unclear, contact us at pizzadyche@gmail.com.

The short version

Here is what matters most:

• Your travel log lives on your phone and syncs to your own Vacaylo account so it is backed up.
• There are no ads in Vacaylo. We never sell your data, and we do not use advertising or third-party tracking tools.
• Nothing you log is visible to other people until you choose a username to use Explore and friends. You can make your profile private at any time.
• Your notes, ratings, cities, airlines and exact trip dates are never shown to other people.
• You can export your trips and delete your data whenever you like.

Your account

When you first open Vacaylo, the app creates an anonymous account for you automatically. It is identified only by a random ID. We do not ask for your name, email address, phone number or a password. The sign-in token for this account is stored in secure storage on your device (Keychain on iOS, Keystore on Android).

You can optionally link Sign in with Apple (iPhone and iPad) or your Google account (Android) in Profile → Privacy, so you can keep your account, username and friends when you change phones. We do not ask Apple or Google for your name. With Apple, we receive a unique identifier for your Apple ID, and if Apple includes an email address (which may be a private relay address) when you sign in, our authentication provider stores it with your account. With Google, we receive a unique identifier for your Google account and your email address, which our authentication provider stores with your account. We do not use either to contact you or for marketing.

Information you add to the app

Vacaylo stores the information you choose to enter, which can include:

• Countries you mark as Visited, Lived, Transit or Want to go.
• Visits: the country, dates (to the day, month or year, or no date at all), a rating, notes, trip tags, and whether you added the visit yourself or from a suggestion.
• Cities you add to a visit, if you have Premium.
• Airlines you have flown with, if you have Premium (Airline Tracking). Like your trips and cities, they are stored on your device and synced to your account, and they are private to you: never shown on your public profile.
• Photos you attach to a visit (see "Photos" below).
• Settings such as your home country, how countries are counted, appearance and language.
• If you use Explore and friends: your username, an optional display name, and a flag or emoji badge.
• If you use Vacation Mode: the dates of your trip, how much you choose to share, and an optional destination and status message.
• Reports you send about other users or photos, including any details you write.

How your data is stored and synced

Everything you log is saved first in a database on your device, so Vacaylo works fully offline. When you are online, the app syncs your data to your account in our cloud database so it is backed up and available on your other devices.

Our cloud database, sign-in service and photo storage are provided by Supabase and hosted in the United States (Amazon Web Services, us-east-1 region). Data is encrypted in transit, and our provider encrypts stored data at rest. Database rules ensure that each account can read and change only its own private records.

Photos

You can attach photos from your photo library to a visit. Before saving a photo, Vacaylo makes its own copy, resized to at most 2048 pixels and re-encoded as a JPEG, together with a small thumbnail. This copy does not include the original's location or camera metadata.

Photos are uploaded to a private storage area inside your account. They are never available at a public web address. To display a photo, the app requests a temporary link that expires after one hour, and our servers only issue it to you or to people who are allowed to see your profile (see "What other people can see").

When you delete a photo, it is removed from your device and, once the deletion syncs, from our storage. If a photo has been reported, we keep it until the report has been reviewed.

What other people can see

Nothing you log is shared with other people until you choose a username, which you need for Explore and friends. Only other Vacaylo users who have also chosen a username can see profiles in Explore.

Profiles are public when you first choose a username, and you can change this at any time in Profile → Privacy. A public profile can be seen by other users in Explore. A private profile can be seen only by your accepted friends. In both cases, the people who can see your profile see:

• Your username, display name, badge and home country.
• Your country and continent counts, your map, and the list of countries you have visited, lived in or passed through.
• The photos attached to your visits, with the country and the month they were taken.

What is never shown to others

Your notes, ratings, trip tags, cities, airlines, exact visit dates and your Want to go list are never shown to other users, whatever your profile setting.

Vacation Mode, a Premium feature, is shared only with your accepted friends, and only when you turn on sharing. It is never shown in Explore. Friends see the dates of your trip (by day, never your exact location) and the level of detail you choose: a continent, a country or a destination you type, plus an optional status message. Friends stop seeing it shortly after the end date you set, or 30 days after it started if you set no end date. When you end Vacation Mode, the trip details are erased from our servers.

If you block someone, you and that person can no longer see each other in Explore, and any friendship or pending friend request between you is removed.

Permissions

Vacaylo only asks for a device permission when you use a feature that needs it, and works without it if you say no:

• Photo library: requested when you add photos to a visit. On iOS you can limit access to only the photos you select (limited library), and on Android the system photo picker lets you share only the photos you choose.
• Notifications: on both iOS and Android, requested only when you set an end date for Vacation Mode, so the app can schedule a reminder on your device. We do not send push notifications from our servers.
• Location: optional Premium features that detect a new country you arrive in, or suggest trips from your photo library, ask for permission only when you turn them on. Location is processed on your device to work out the country, and coordinates are not uploaded to our servers.

Purchases

Premium is an in-app purchase, either a one-time lifetime purchase or a 6-month auto-renewing subscription, processed by the store you buy through: Apple (App Store) or Google (Google Play). We never receive your payment card or billing details. We use RevenueCat, a service provider, to process purchase records and your app user ID (the same ID as your Vacaylo account), so that we can confirm your purchase and keep Premium in sync. We store whether your account has Premium, which product was purchased, when, and, for a subscription, when the current period ends.

How we use information

We use the information described above only to:

• Provide Vacaylo's features, including sync and backup, your stats and achievements, Explore, friends and Vacation Mode.
• Show your profile to the people your privacy setting allows.
• Keep the community safe: review reports, remove content that breaks our Community Rules, and limit abuse such as spam friend requests.
• Respond when you contact us for support.
• Keep the service secure and working, and comply with the law.

What we don't do

We take a simple approach:

• We do not show ads.
• We do not sell or rent your personal information, or share it for advertising.
• We do not include third-party advertising, analytics or tracking tools in the app, and we do not track you across other companies' apps or websites.

Service providers and disclosures

We share information only with service providers that help us run Vacaylo, and only for that purpose: Supabase (database, sign-in and photo storage), RevenueCat (purchase records and subscription status), Apple (Sign in with Apple and App Store purchases) and Google (Google Play purchases and Google account linking).

We may also disclose information if the law requires it, to protect the safety of our users or the public, or to enforce our terms. If Vacaylo is ever sold or merged with another company, your information may be transferred as part of that transaction, and this policy will continue to apply to it.

Reports and moderation

When you report a user or a photo, we store your report, the reason and any details you add, together with a copy of the reported username, display name and photo, so we can review it even if the content changes. The person you report is not told who reported them.

To limit abuse, we keep short-lived records of certain actions, such as friend requests and username changes, for up to about one month. A username you give up is held for 30 days before anyone else can claim it.

Launch waitlist (website)

This section applies only to the optional launch waitlist on our website (vacayloapp.com). It does not apply to the app.

• What we collect: the email address you enter, the language of the website, the date you signed up, and a one-way hashed version of your network (IP) address. We use the hash only to stop abuse and keep it for at most 2 days for rate limiting; we cannot turn it back into your address.
• Why: to email you launch news and your lifetime deal code, if you are among the first 135 people on the list.
• Where: your details are stored in our Supabase database.
• Emails: we send the waitlist emails through Loops (Loops, Inc.), our email provider, which stores your email address, the language of the website and whether you got a lifetime deal so it can send them. Your details at Loops are deleted together with the waitlist.
• What we don't do: we send no other marketing, and we never sell your email address.
• How long: we delete your waitlist details 90 days after launch, or earlier if you ask us at pizzadyche@gmail.com.
• Legal basis: your consent, which you give by submitting your email address. You can withdraw it at any time by contacting us.

How long we keep data

We keep your data for as long as you use Vacaylo. When you delete something, it immediately disappears from the app and from what others can see. On our servers, deleted items are first kept as deletion records so your other devices can remove them too, and are permanently erased within 1 year.

Our hosting provider keeps technical logs, such as IP addresses and request times, for a limited period for security and troubleshooting. Reports are kept for as long as needed to review them and to keep the community safe.

Your choices and rights

You are in control of your data:

• See and correct: everything you have logged is visible and editable in the app.
• Export: Profile → Data & sync lets you export your visits, country marks, trip tags, airlines and settings as a CSV or JSON file. Your photos stay in your own photo library.
• Choose who sees your profile: switch between public and private in Profile → Privacy.
• Delete your account and data: you can delete your account and data in the app, on both iOS and Android, at About & Help → Delete account. Deletion removes your account, travel data (including cities and airlines), photos, friends and Premium status. Photos under moderation stay until resolved. Records are erased within 1 year. Contact pizzadyche@gmail.com to request deletion.

Your rights under privacy laws

Depending on where you live, including the European Economic Area, the United Kingdom and some US states, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict how we use it. To make a request, contact us at pizzadyche@gmail.com. We will respond within the time required by law, and we will not treat you differently for using these rights. You may also complain to your local data protection authority.

Where these laws apply, we process your information to provide the service you asked for, based on our legitimate interests in keeping Vacaylo safe and secure, with your consent for device permissions, and where the law requires it.

International transfers

Your data is stored in the United States. If you use Vacaylo from another country, your information is transferred there. Where required, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, for these transfers.

Security

We protect your information with encrypted connections, sign-in tokens kept in secure storage on your device (Keychain on iOS, Keystore on Android), database rules that limit each account to its own data, private photo storage and short-lived photo links. No system is perfectly secure, but we work to protect your data and will act promptly if a problem occurs.

Children

Vacaylo is not directed at children under 13, or under the minimum age required in their country, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us at pizzadyche@gmail.com and we will delete it.

Changes to this policy

We may update this policy as Vacaylo changes. We will change the date at the top when we do, and if the changes are significant, we will let you know in the app before they take effect.

Contact us

If you have questions about this policy or your data, contact MuffinLine at pizzadyche@gmail.com.