Privacy Policy

Last updated October 12, 2026 · Effective October 12, 2026

This policy explains what information Odyssia collects, why, who can see it, how long we keep it, and the choices you have. We are Kyu Mok Kim, operating as Odyssia ("we", "us"), based in Ontario, Canada. This policy covers the Odyssia mobile app and this website.

In short: we collect what you give us to run your account and your trips, and what's needed to keep the service secure. We don't sell your information, we don't show ads, we don't use analytics or tracking tools, and we never access your device's location or contacts.

1. What we collect
2. What we don't collect
3. How we use it
4. Who can see what
5. Service providers
6. How long we keep it
7. Deleting your account
8. Your rights and choices
9. Security
10. Children
11. Where your information is processed
12. Canadian privacy law
13. Changes to this policy
14. Contact us

1. What we collect

Your account

• Email address. To create your account, log you in, and send account emails (confirming your email address and resetting your password).
• Password. Handled by our authentication provider (Supabase Auth), which stores only a one-way hash of it. Nobody at Odyssia can read your password.
• Username and display name. Your username is required; your display name is optional. A copy of the username and display name you signed up with is also kept with your login record.
• Bio, if you write one.
• Account records kept by our authentication provider, such as when you signed up and last logged in.

At sign-up you confirm you're at least 13 by ticking a box. We don't ask for your date of birth, and we don't store your answer: you can't create an account without ticking it.

The app doesn't let you upload a profile photo. Your avatar is drawn from the first letter of your username.

Your trips

• Trip details: title, destination, description, dates, and whether the trip is public or private and whether collaborators may edit it.
• Days and stops: day names; each stop's day, order, duration, how you'll travel to the next stop, and your notes.
• Places. When you add a place from Google search, we store only Google's place ID for it. The place's name, address and position are fetched from Google each time the trip is shown, not stored by us. A stop can also have your own label, your own area note (for example "Shibuya"), and your own map pin, which is the point you tapped on the map.
• Destination. The trip's destination is text you type in your own words.

Travel times and distances between stops are worked out when you look at a trip and aren't stored.

What you do with others

• Comments and replies you post, and when you edited them.
• Likes, follows and saved trips.
• Collaboration: invitations you send or receive, whether they were accepted or declined, and the trips you collaborate on.
• Reports and blocks. When you report a comment, trip or profile, we keep the reason you chose, any details you add, and what was reported. We keep the list of people you've blocked.
• In-app notifications (for example "maria liked your trip"), whether you've read them, and your notification settings.

Security and service records

• Failed login attempts. When a login with a username fails, we record the username that was typed, the IP address it came from, and the time, to slow down password guessing. Wrong passwords entered while deleting an account are recorded the same way. An hourly cleanup deletes every record before it's 24 hours old. Records for a username are also deleted when that username logs in successfully, and when the account is deleted.
• Server logs. Our providers keep standard technical logs of requests to their services, such as IP address, time, device and app information, and errors. They use these logs to run and secure their services and keep them for a limited time.

Push notifications (optional)

Push is off until you turn it on, in the app or in Settings → Notifications. When it's on for a phone, we store:

• That phone's push token: an identifier from Expo that lets us send notifications to that app on that phone, plus whether it's Android or iPhone, when it was added and when the app was last opened on it. It isn't an advertising ID, and it can't be used to track you elsewhere.
• A short record of pushes sent (who got one, its type and trip), to limit how many you get. It's kept for 2 hours.
• Delivery receipts from Expo (an ID per push), to find phones that no longer exist. They're kept for up to a day.

Pushes follow the same settings as your in-app notifications, never come from people you've blocked or who blocked you, and are limited: at most one like notification per trip every 15 minutes, one new-follower notification every 15 minutes, and 10 an hour in all (invitations aren't limited). The title of a private trip is only shown to someone who can see that trip. What appears on your lock screen also depends on your phone's settings.

On your device

The app stores your login session on your device so you stay logged in. Logging out removes it. It also remembers whether you turned push on, and that phone's push token.

2. What we don't collect

• We never access your device's location. Map pins are only points you choose by tapping the map. Place search uses the part of the map you're looking at, not where you are.
• We don't access your contacts, photos, camera or microphone.
• We don't use advertising IDs, show ads, or sell or rent your information.
• We don't use analytics, crash-reporting or tracking tools in the app, and this website has none either: no cookies, no tracking scripts, no third-party fonts or embeds.
• We don't store Google's place names, addresses or coordinates, only Google place IDs. Your labels, area notes, pins and destination are always your own words and taps, never filled in from Google.

3. How we use it

• To provide Odyssia: your account, your trips, sharing, collaboration, comments, follows, saves, and notifications in the app and, if you turn them on, as push notifications.
• To keep it safe: limiting login attempts, enforcing blocks, reviewing reports, and removing content or accounts that break our Terms or Community Guidelines.
• To contact you about your account: account emails, and replies when you write to us.
• To meet legal obligations.

We don't use your information for advertising or profiling.

4. Who can see what

If you block someone, neither of you can see the other's profile, trips or comments, and you can't follow, comment on or interact with each other. They aren't told that you blocked them, and people aren't told who reported them.

Anything public can be seen, copied or shared by anyone, and may stay in their screenshots or memory after you delete it. Make a trip private if you don't want it public.

We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or reorganization of our business (in which case this policy keeps applying to it).

5. Service providers

We use these providers to run Odyssia. They process information on our behalf:

• Supabase: our database, authentication and server functions. Your account and content are stored with Supabase in the United States (West US region, in Oregon).
• Google Maps Platform: maps, place search and place details, and travel times. The app sends Google what's needed for each request: the text you type in a search, the area of the map you're looking at, the place IDs of your stops, and travel modes and times. When you fix a stop whose place Google no longer has, the search starts from that stop's label and the trip's destination. Google receives your device's IP address and the app's identifiers. Google's use of this is covered by the Google Privacy Policy.
• Expo: our push notification service, used only if you turn push on. It receives your phone's push token and each notification, and passes them to Google's Firebase Cloud Messaging (Android) or Apple's Push Notification service (iPhone) for delivery.
• Resend: sends our account emails (such as confirmation and password reset), so it receives your email address and the email's content.
• Cloudflare (Cloudflare Pages): hosts this website, and sees standard request information such as IP addresses.

Push notifications are optional. If you turn them on, they're delivered through Expo's push service and then Google's Firebase Cloud Messaging (Android) or, on iPhone, Apple's Push Notification service. These receive your phone's push token and the notification itself (for example "maria liked your trip Tokyo", and which screen to open).

6. How long we keep it

• Your account and content: until you delete them or your account.
• Things you delete (a trip, a comment, a like, a follow) are removed from our database right away.
• Notifications are kept until the thing they're about is deleted, or your account is.
• Failed login records: less than 24 hours, as described above.
• Reports are kept while the comment, trip or account they're about exists, so we can deal with repeated abuse and legal requests. Once it's deleted (by its owner, by us, or with the account), the report is kept for 12 months and then deleted. Reports you sent are deleted with your account.
• Backups: no backups are kept at present, so information you delete isn't held in a backup.
• Push tokens: until you turn push off on that phone, log out on it, or delete your account; also when Expo tells us the phone no longer exists, or after 90 days without opening the app on it. Records of pushes sent: 2 hours. Delivery receipts: up to a day.
• Provider logs are kept by our providers for a limited time, as their own policies describe.

7. Deleting your account

You can delete your account at any time in the app: Profile → Settings → Delete account. If you can't use the app, you can ask us by email. See Delete your account for the steps and exactly what's deleted and what's kept. What's deleted is removed from our systems and isn't retained in backups, because we don't keep backups of user data.

8. Your rights and choices

• Access: you can see most of your information in the app. To get a copy of everything we hold about you, email privacy@getodyssia.com.
• Correction: you can edit your profile, trips and comments in the app, or ask us to correct something.
• Deletion: delete content or your whole account in the app, or ask us.
• Withdrawing consent: you can make trips private, turn push or notification types off, block people, or delete your account. Some information is needed to provide the service, so withdrawing consent to it means deleting your account.
• Complaints: contact us first. You can also complain to your privacy regulator (see below).

We answer requests within 30 days, and may need to confirm you own the account first.

9. Security

Information is encrypted in transit (HTTPS). Database access rules make sure each person can only read and change what they're allowed to. Passwords are stored only as hashes, by our authentication provider. Our service keys are kept on our servers and are never in the app. No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm to you, we'll notify you and report it as the law requires.

10. Children

Odyssia is for people 13 and older. You must confirm you're at least 13 to create an account. If you believe a child under 13 has an account, contact privacy@getodyssia.com and we'll delete it.

11. Where your information is processed

We're based in Canada, but your information is stored outside it: our database (Supabase) is in the United States (West US region, in Oregon). Our other providers (Google, Expo, Resend and Cloudflare (Cloudflare Pages); Apple too for push on iPhone) may process it in the United States and other countries. If you're in Canada, expect your information to be transferred across borders. The laws of those countries may differ from Canada's, and authorities there may be able to access the information. We choose providers that protect the information they handle for us.

12. Canadian privacy law

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). We collect only what we need for the purposes above, use it only for them, and let you access and correct it. Kyu Mok Kim is responsible for our privacy practices and can be reached at privacy@getodyssia.com. If you're not satisfied with how we handle a concern, you can contact the Office of the Privacy Commissioner of Canada.

13. Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll let you know before it takes effect, for example by email.

14. Contact us

Privacy questions and requests: privacy@getodyssia.com
Anything else: support@getodyssia.com
Kyu Mok Kim, operating as Odyssia, Ontario, Canada