Privacy Policy

1. Who we are

Zmew is an iOS trip planning app developed and operated by Zmew Team ("we", "us", "the developer"). This Privacy Policy applies to the Zmew iOS app and to this website.

For privacy questions or data requests, contact us at support@zmew.app.

2. What stays on your device

By default, all of the following information is stored locally on your iPhone or iPad and never leaves it:

• Your trips, activities, flights, hotels, and travelers
• Packing lists, items, and templates
• Budget entries and currency preferences
• PDF documents and other files you attach to a trip
• Cover photos you select for trips
• App preferences (theme, notifications, default currency, etc.)
• Your AI provider API key, if you choose to enter one (stored in iOS Keychain)

This data is backed up only as part of your standard iOS device backup (iCloud Backup or local backup), per the settings you control in iOS Settings.

3. Data that leaves your device — only when you opt in

3.1 AI Trip Assistant (Pro feature)

The AI Trip Assistant supports three providers: on-device Apple Intelligence, Google Gemini (bring your own key), and OpenAI (bring your own key).

On-device Apple Foundation Models (Apple Intelligence) process all requests entirely on your device using Apple's on-device inference stack. No data is sent to any external server for AI processing — not to Apple, and not to us.

Google Gemini and OpenAI require you to provide your own API key from a personal account you hold with that provider. When you send a message, your device sends the request directly to that provider's API servers. Zmew does not relay, intercept, log, or store any part of this exchange — because we do not operate a server.

What Zmew includes in AI requests: to give the assistant context about your trip, Zmew includes the trip's day structure and existing activity names in the prompt sent to the AI. No other personal information (traveler names, budget figures, attached documents, cover photos, or location data) is included automatically.

Your responsibility: anything you type directly in the chat input is sent to the AI provider as-is. You are solely responsible for the content of your messages to Gemini or OpenAI. Your use of those providers is governed by your individual agreement with them:

• Google Gemini privacy policy
• OpenAI privacy policy

You can revoke AI access at any time by removing your API key in Zmew Settings or switching to on-device Apple Intelligence.

3.2 iCloud Backup (optional)

Zmew data is included in your standard iOS device backup. If you have iCloud Backup enabled in iOS Settings, your Zmew data will be backed up to your iCloud account, encrypted by Apple. We have no access to your iCloud Backup.

3.3 Trip Sharing via CloudKit

When you share a trip with travel companions, shared trip data is processed by Apple's CloudKit infrastructure under your existing Apple ID. Only the trips you explicitly choose to share are synced through CloudKit. The data is governed by Apple's Privacy Policy. We have no access to data flowing through CloudKit.

3.4 Trip cover photos

When you search for a cover photo for your trip, Zmew queries a third-party image search API. Your search query (the text you type) is sent to that service. No trip data, personal information, or account details are included in the request. The selected image is downloaded and cached on your device.

3.5 Subscriptions and purchases

Zmew Pro subscriptions are processed entirely by Apple via the App Store. We receive only the entitlement state (whether your Apple ID currently holds a valid Pro subscription), not your name, payment method, billing address, or App Store account details. Apple's handling of purchase data is governed by their Privacy Policy.

4. What we do not do

• No analytics. Zmew does not include any third-party analytics SDK (Firebase Analytics, Mixpanel, Amplitude, etc.).
• No crash reporting. Zmew does not include any third-party crash reporting SDK (Sentry, Crashlytics, etc.).
• No advertising. Zmew has no ads and does not integrate with any ad networks.
• No tracking. Zmew does not track you across apps or websites and does not use the iOS App Tracking Transparency framework because there is nothing to track.
• No user accounts. Zmew has no sign-up, no login, and no profile on any server we operate.

If we ever introduce diagnostic logging, crash reporting, or any other form of data collection in a future version, we will update this Privacy Policy and disclose the change in the app before any data leaves your device.

5. Data retention

Because Zmew does not collect or store your data on any server, we have nothing to retain. Data on your device is retained for as long as you keep the app installed; deleting the app removes all local data (with the standard iOS exception of any iCloud Backup you have enabled, which is governed by your Apple ID settings).

6. Your rights

Because Zmew does not collect personal data on our servers, the typical "data subject" rights (access, rectification, erasure, portability) are something you exercise directly on your device:

• Access / portability — your data is on your device. You can export trips as ICS calendar files, KML files (Pro), or PDF (Pro).
• Erasure — delete a trip, an item, or the entire app.
• Rectification — edit any field in the app at any time.

For data held by third parties you've chosen to use (Google, OpenAI, Apple), exercise your rights through their respective platforms.

7. Children's privacy

Zmew is not directed at children under 13 (or the equivalent minimum age in your jurisdiction) and we do not knowingly collect data from children. As described above, we do not knowingly collect data from any user; if a child uses Zmew, the same local-first model applies.

8. International users

Because Zmew does not transmit personal data to any server we operate, there is no cross-border data transfer originated by us. When you use the AI Assistant, iCloud features, or trip sharing, your data is processed by the respective third party (Google, OpenAI, Apple) in the regions they operate, as described in their privacy policies.

9. Security

Local data is protected by the standard iOS security model (Data Protection, Secure Enclave for keys, sandboxing). Your AI provider API key is stored in the iOS Keychain. Network requests to AI providers and to Unsplash use HTTPS with certificate validation enforced by iOS. Because Zmew does not operate a server, there is no server-side database or credential store that could be breached.

10. Changes to this policy

If we change this Privacy Policy in a way that affects what data leaves your device or how it is handled, we will:

• Update the "Last updated" date at the top of this page.
• Disclose the change in an in-app notice on the next launch following the change.
• For material changes, require you to acknowledge the change before continuing to use affected features.

Minor clarifications and corrections that do not change what data is collected or how it is used will not trigger an in-app notice.

11. Contact

Questions, concerns, or data requests: support@zmew.app.