Privacy Policy

1. Who we are

“Alba” (“we”, “us”, “our”) provides the Alba mobile application and the website at withalba.app (together, the “Service”). For any privacy question, request, or complaint, contact us at travel@withalba.app.

The legal entity operating Alba and its registered address are identified at travel@withalba.app. Where this policy refers to the “data controller”, it means that entity.

2. The short version

• Local-first.Your trips, packing lists, profile, the people you pack for, and your saved travel documents are stored on your device. Your travel documents are encrypted at rest with a key held in your device’s secure hardware (Keychain / Keystore).
• We don’t sell your data. We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising.
• Document scanning happens on your device.Reading the text on a passport, ID, or driver’s license is done with on-device text recognition. That document text is not sent to us or to any third party.
• The “scan to pack” camera feature may use AI. If AI matching is enabled, cropped photos of the items you lay out are sent to an AI provider (Google or OpenAI) to identify them. See Section 8.
• Health and travel info is informational. Destination health guidance is sourced from public bodies (CDC, WHO, World Bank). It is not medical advice and we are not responsible for it. See Section 9.

3. Information we collect

3.1 Account information

You create an account by signing in with Google or Apple. We receive from those providers, and store via our authentication provider (Supabase), your name, email address, and profile picture (where available). With Apple, you may choose to hide your email, in which case we receive a relay address. We do not receive your Google or Apple password.

3.2 Profile and preferences

Information you add about yourself: display name, avatar, home town and country, preferred currency, language, units and date format, regional settings, notification preferences, and a count of countries visited.

3.3 People you pack for

You can add the people you travel with — including family members and children — with their name, relationship to you, date of birth, and avatar. You are responsible for the people you add; see Section 10on children’s information.

3.4 Travel documents (sensitive information)

If you choose to add or scan a travel document, Alba stores the fields needed to track its validity. These can include the document or passport or license number, holder name, issuing country, nationality, date of birth, sex, expiry date, and an image of the document. This is sensitive information and we handle it with particular care:

• Document records are encrypted on your device(AES) before being written to storage. The encryption key is generated on your device and kept in the device’s secure hardware (Keychain / Keystore), available only when the device is unlocked.
• Reading a saved document’s number or date of birth requires Face ID / Touch ID (or your device passcode). Until then, sensitive fields are masked.
• Document text is read using on-device recognition (the machine-readable zone of a passport, or the barcode of a North-American license). This recognition is not performed on our servers and the recognised text is not transmitted to us or any third party.
• Document images stay in the app’s private storage on your device and are not automatically uploaded. Where cloud backup or sharing is offered, only the encrypted document payload (ciphertext) is designed to be stored on our servers — our database does not see the plaintext.

3.5 Photos and camera

The “scan to pack” feature takes a photo of the items you lay out. Each item is segmented into a separate cutout image on your device. These cutouts are used to tick items off your list and may be stored as “packed” proof. If AI matching is enabled, cutouts are sent to an AI provider as described in Section 8.

3.6 Trip and packing data

The trips you create — destination, dates, checklists, sections, notes, readiness, packing templates, and, if you share a trip, the collaborators and invitations involved.

3.7 Destination, not device location

Alba does nottrack your GPS or device location. When we mention “location” we mean the destination you type into the place search. We send that place name or its coordinates to mapping, weather, and image providers to show you results (see Section 7).

3.8 Technical data

To operate and secure the Service, our infrastructure providers process basic technical data such as IP address, device/app type, and timestamps (for example, when your app authenticates). The marketing website at withalba.app is a static site and does not set advertising cookies.

3.9 Analytics (future)

Alba does not currently include any third-party analytics or tracking SDK. We may, in the future, introduce privacy-respecting product analytics (for example, PostHog) to understand how features are used and to improve the app. If we do, we will update this policy first and, where required, ask for your consent. We will not use analytics to sell your data or for cross-context behavioural advertising.

4. How we use information

• To provide the Service — build your checklists, track readiness, and pack with the camera.
• To authenticate you and keep your account secure.
• To sync and back up your data across your devices and, where you choose, share trips with others.
• To show destination weather, place results, imagery, currency rates, and health guidance.
• To send the notifications you enable (trip reminders, packing nudges, weather alerts, collaborator activity).
• To diagnose problems, prevent abuse, and comply with legal obligations.

5. Legal bases (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR:

• Contract — to provide the Service you ask for (your account, trips, and packing features).
• Consent — for camera and notification access, for sending document or item images to AI providers, and for any future analytics. You can withdraw consent at any time in your device settings or by not using the feature.
• Legitimate interests — to secure the Service, prevent abuse, and improve our product, balanced against your rights.
• Legal obligation — where we must retain or disclose information by law.

Travel-document fields (which may include nationality) and any data about children are treated as sensitive. Where required, we process them only with your explicit consent, which you give by choosing to add or scan a document or to add a person — and which you can withdraw by deleting that record.

6. When we share information

We share personal information only in these situations:

• Service providers (sub-processors) who run parts of the Service on our behalf — see the list in Section 7.
• People you choose to share with. If you share a trip or invite a collaborator, the trip details, packing items, and your display name and avatar are visible to those people. Inviting someone by email shares that email with our backend so we can deliver the invitation.
• Legal and safety reasons — to comply with law, enforce our terms, or protect the rights and safety of users and the public.
• Business transfers — if Alba is involved in a merger, acquisition, or asset sale, your information may transfer as part of that transaction, subject to this policy.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

7. Service providers we use

We use the following third parties to operate the Service. Each receives only the data needed for its function. Their own privacy terms govern their handling of that data.

Alba also links to third-party eSIM partners (such as Airalo, Holafly, Saily, Nomad). These are outbound links; Alba is not affiliated with them and sends them no personal information. Once you follow a link, that partner’s privacy policy applies.

8. AI image processing (scan to pack)

Alba’s “scan to pack” feature can use AI to recognise which item each photo cutout is. When AI matching is enabled in your build of the app:

• Each cropped item image is sent to an AI provider (Google Gemini by default, or OpenAI) along with the labels on your packing list, so it can return the most likely match.
• This means photos of your personal belongings may leave your device and be processed by that provider, subject to its terms.
• You always review and can correct or discard any match before items are packed.
• If AI matching is not enabled, no images are sent — Alba falls back to on-device matching, and the scanner shows a “DEMO” badge rather than “AI”.

On-device document scanning (passport MRZ, license barcode) is separate and never sent to an AI provider.

9. Health, weather, and travel information disclaimer

Alba may show destination health guidance — such as vaccination, water, and medication notes, and travel health notices. This information is sourced from public third parties, including the U.S. Centers for Disease Control and Prevention (CDC), the World Health Organization (WHO), and the World Bank.

• Alba is independent and not affiliated with, endorsed by, or sponsored by the CDC, WHO, the World Bank, or any government body.
• This guidance is general information, not medical advice, and may be incomplete or out of date.
• We are not responsible or liable for the accuracy, completeness, or your use of this third-party information. Always confirm requirements with the official sources and a qualified travel clinic or doctor before you travel.

Weather, place, currency, and imagery information is likewise provided by third parties for convenience and may be inaccurate. The same applies to AI item matching, which can make mistakes.

10. Children’s information

The Service is intended for adults and is not directed to children under 13 (or the equivalent minimum age in your country). We do not knowingly let children create accounts or collect their information directly.

Alba does let an adult add family members — including their own children — to pack for them, which may include a child’s name, date of birth, and travel document details. If you add a child’s information, you confirm you are their parent or legal guardian (or are otherwise authorised) and that you consent to that information being processed as described here. This information stays under the same local-first, encrypted, on-device protections as your own. You can delete it at any time. If you believe a child has provided us information without authorisation, contact travel@withalba.app and we will delete it.

11. Retention and deletion

Data stored on your device remains until you delete it or uninstall the app. Signing out wipes Alba’s local data from the device. Any data backed up to our servers is retained while your account is active and deleted within a reasonable period after you delete your account, except where we must keep it to meet a legal obligation. To delete your account and associated data, email travel@withalba.app.

12. Your rights

12.1 Everyone

You can view and edit most of your information directly in the app, and you can delete your trips, people, documents, and account. For any request you can’t complete in-app, email travel@withalba.app.

12.2 EEA / UK (GDPR)

You have the right to access, correct, delete, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent. You may also lodge a complaint with your local data protection authority.

12.3 California (CCPA / CPRA)

California residents have the right to know what personal information we collect and how we use and disclose it, the right to access and delete it, the right to correct inaccurate information, and the right to limit the use of sensitive personal information. We do not sell or share (for cross-context behavioural advertising) your personal information, so there is no need to opt out of a sale — but you will never be discriminated against for exercising your rights. Travel-document details are treated as “sensitive personal information” and are used only to provide the feature you asked for.

12.4 Other regions

Residents of other regions (for example, other U.S. states, Canada, Brazil, or Australia) may have similar rights under their local laws. We honour applicable requests — just contact us.

13. International transfers

Our service providers may process data in countries other than yours, including the United States. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism.

14. Security

We use technical and organisational measures to protect your information, including on-device AES encryption of travel documents with keys held in secure hardware, biometric gating of sensitive fields, encrypted transport (TLS), and access controls (row-level security) on any backed-up data. No method of storage or transmission is perfectly secure, but we work to protect your information and to limit what leaves your device.

15. Notifications

If you allow notifications, we send the reminders and alerts you enable. You can turn these off at any time in the app or in your device settings.

16. Changes to this policy

We may update this policy as the Service evolves. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Continued use of the Service after a change means you accept the updated policy.

17. Contact

Questions, requests, or complaints about privacy: travel@withalba.app.