Privacy policy
Your trips are yours.
This policy explains what My Travel World collects, why, who helps us run the service and how you can access, correct or delete your data. It applies to everyone, and it covers the rights given by the EU and UK General Data Protection Regulation (GDPR) and Brazil's Lei Geral de Proteção de Dados (LGPD, Lei nº 13.709/2018).
Last updated: October 29, 2026
In short
- We only collect what the globe needs: your sign-in email, a display name and the trips you add.
- Your globe is private until you make it public. You can make it private again at any time.
- No ads, no analytics trackers, no selling or renting your data.
- Payments go through Stripe. We never see your card details.
- You can delete your account yourself in the app at any time, and ask us for a copy of your data.
1. Who is responsible
My Travel World (mytravelworld.io) is an independent project run by Marcelo Zardo, who is the data controller (controlador under the LGPD). For any privacy question or request, write to privacy@mytravelworld.io. This address is also our channel for the data protection officer role (encarregado).
2. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Account: email address, password (stored only by Amazon Cognito, never by us) and an internal account ID. | To let you sign in and keep your globe safe. | Performance of our service to you (GDPR art. 6(1)(b); LGPD art. 7, V). |
| Profile: display name, profile address (for example @marina), whether your globe is public or private. | To show your globe and, if you choose, share it. | Performance of our service (same as above). |
| Trips: trip names, dates and the airports of each flight. From them we calculate countries, distance, levels and milestones. | To draw your routes and track your progress. | Performance of our service (same as above). |
| Public profile and Live World: when you switch them on, your display name, profile address, trips and milestones become visible to others. | Because you asked us to share them. | Your choice, which you can withdraw at any time (GDPR art. 6(1)(a); LGPD art. 7, I). |
| Donations: supporter status, the date you became a supporter and a Stripe payment reference. Stripe receives your payment details directly. | To unlock supporter perks and keep payment records. | Performance of our service and legal obligations for financial records (GDPR art. 6(1)(b) and (c); LGPD art. 7, II and V). |
| Supporter vehicle: vehicle type, model, color and whether it appears in the Live World. | To show your plane or boat the way you chose. | Performance of our service. |
| Technical logs: IP address, browser details and request information recorded by our servers. | To keep the service secure, prevent abuse and fix errors. | Legitimate interest in running a secure service (GDPR art. 6(1)(f); LGPD art. 7, IX). |
We don't ask for, and you shouldn't add, sensitive information such as health, religion or political opinions. We don't read your email, bookings or airline accounts: you add every trip yourself.
3. What other people can see
- Private globe (default): only you can see your trips.
- Public globe: anyone with your link can see your display name, profile address, trips, countries and milestones. Public profiles ask search engines not to list them. Anyone who sees your page could still save or share what they see, so only publish what you're comfortable sharing.
- Live World (supporters): your vehicle appears only if you choose to show it. It shows your display name when your globe is public, or "Anonymous traveler" when it's private. Vehicle routes are random and never reveal your real location or trips.
- Story images: images you download or share are created in your browser and go wherever you send them.
4. Who helps us run the service
We don't sell or rent personal data, and we don't share it for advertising. We use these providers, who process data only on our instructions:
- Amazon Web Services (United States): hosting, database, sign-in (Amazon Cognito) and server logs.
- Stripe (United States and Ireland): donation payments. Stripe handles your payment details under its own privacy policy.
We may also disclose data when the law requires it, for example in response to a valid court order.
5. International transfers
Our servers are in the United States. When your data is transferred from the European Economic Area, the UK or Brazil, we rely on our providers' safeguards: the EU-U.S. Data Privacy Framework and its UK extension, and standard contractual clauses (GDPR art. 45 and 46; LGPD art. 33).
6. How long we keep it
- Account, profile, trips and vehicle: while your account exists. Trips you remove are deleted right away.
- When you delete your account, your profile, trips, vehicle and sign-in account are erased right away. Copies in our backups expire within 35 days.
- Payment records: as long as tax and accounting laws require, even after the account is deleted.
- Server logs: 14 days.
7. Cookies and browser storage
My Travel World doesn't use advertising or analytics cookies, so there is nothing to accept. We use your browser's storage only for things you need: your sign-in session (cleared when you close the tab), whether you've already seen the Live World introduction and your vehicle preview. The sign-in page (Amazon Cognito) and the checkout page (Stripe) may set their own essential cookies. Fonts are served from our own site, not from third parties.
8. Your rights
Wherever you live, you can ask us to:
- confirm whether we process your data and give you a copy of it, in a portable format;
- correct data that's wrong or incomplete;
- delete your account and data, or anonymize or block data that's unnecessary;
- restrict or object to processing based on legitimate interest;
- tell you who we share data with;
- withdraw your consent, for example by making your globe private or hiding your vehicle.
Many of these you can do yourself in the app: edit your name and profile address, remove trips, switch your globe to private, and delete your whole account under Share → Delete my account. For anything else, email privacy@mytravelworld.io from the address you sign in with. We reply within 15 days and in any case within the deadlines the GDPR and LGPD set.
You can also complain to a data protection authority: in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD); in the EU, the authority of the country where you live; in the UK, the Information Commissioner's Office.
9. Security
All traffic is encrypted with HTTPS. Sign-in uses Amazon Cognito with a secure authorization flow, and only your account can read or change your private trips. If a breach could put you at risk, we'll let you and the competent authorities know as the law requires.
10. Children
My Travel World isn't meant for children under 16. If you're younger, ask a parent or guardian before creating an account. If you believe a child gave us data without that permission, contact us and we'll delete it.
11. Changes to this policy
If we change how we use your data, we'll update this page and the date at the top. For important changes we'll also tell you in the app before they apply.