Privacy Policy

1 Who we are

Desti ("Desti," "we," "us," or "our") is a social travel application operated by Desti LLC, a New York limited liability company. This Privacy Policy explains what information we collect when you use the Desti mobile app and our website at thedesti.app (together, the "Service"), how we use it, who we share it with, and the choices and rights you have.

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2 Information we collect

2.1 Information you provide

When you create an account and use Desti, we collect:

• Account & sign-in information. You sign in using Sign in with Apple or Google. We receive your name and email address from that provider, and we create an account for you. We do not use or store passwords.
• Profile information. Your username, display name, first and last name, profile photo, bio, home city and state, travel interests, and any social media handles (for example Instagram, TikTok, or X) you choose to add.
• Your travel content. The cities you rank and your head-to-head comparisons, your Elo ratings, sentiment (liked / fine / disliked), visit dates, trip type and budget, highlights, pros and cons, favorite spots, photos you upload, and photo captions or labels.
• Wishlists & saved inspiration. Destinations you save, your notes, and any Instagram or TikTok post links you attach to a city or wishlist item. When you add such a link, we fetch a public preview (thumbnail, caption, and author handle) for that post.
• Social connections & activity. The accounts you follow, your follow requests, your likes, friends you tag, and your notification preferences.
• Safety actions. The users you block, and the reports you submit about content or users (including the reason you select and any note you add). We keep reports so we can review them and enforce our Terms.
• Communications. If you email us, we keep your message and contact details to respond and for our records.

2.2 Information collected automatically

• Usage & analytics data. We use a third-party analytics provider to understand how the app is used, such as which screens you view and actions you take (opening Explore, tapping a recommendation, bookmarking or ranking a city). These events are associated with a pseudonymous identifier linked to your account.
• Diagnostics & crash data. We collect technical error and crash information (such as stack traces of software errors) to find and fix bugs.
• Technical & approximate-location data. Like most apps, our analytics and infrastructure providers may automatically receive technical information such as your IP address, device type, and operating-system version. An IP address can be used to estimate a general, city- or region-level location. This is not precise GPS location — see section 2.4.
• Push notification token. If you enable notifications, we store a push token so we can deliver the alerts you've asked for (for example, when someone follows you or likes your ranking).

2.3 Information from third parties

When you sign in with Apple or Google, that provider shares limited profile information with us (your name and email address) so we can create and secure your account. Your use of those sign-in services is also governed by Apple's and Google's own privacy policies.

2.4 What we do not collect

To be clear about the boundaries of our data collection:

• No device GPS location. Desti does not collect your device's precise or approximate GPS location, in the foreground or the background. Maps in the app display the locations of cities (reference data), not your position, and your "home city" is text you type yourself. (Analytics may infer an approximate region from your IP address, as noted above.)
• No camera access. Desti does not capture photos or video with your camera. You add photos by selecting existing images from your photo library.
• No contacts or phone numbers. We do not access your device contacts and we do not collect phone numbers.
• No payment information. Desti is currently free and does not collect payment or financial information.
• No special-category data sought. We do not ask for sensitive information such as government IDs, health, or precise biometric data.

3 How we use your information

We use the information described above to:

• Provide and operate the Service — create your account, store your rankings, wishlists, photos, and social connections, and display your profile.
• Power personalized recommendations by comparing your rankings with community and friend rankings to surface destinations matched to your taste.
• Send the notifications and communications you've enabled, and respond to your support requests.
• Keep the Service safe — including automated moderation of uploaded images, username screening, review of the reports you submit, enforcement of user blocks, and measures to prevent spam, bots, and abuse.
• Understand usage and improve, debug, and develop new features.
• Comply with legal obligations and enforce our Terms of Service.

4 How we share your information

We do not sell your personal information for money, and we do not share it with third-party advertising networks for their own use. If that ever changes, we will update this policy and give you any choice or opt-out the law requires. We share information only in these limited ways:

• With other users, according to your settings. Desti is a social app. Your profile, rankings, and wishlists are visible to others as described in section 6. You control much of this through your privacy settings.
• With service providers ("processors"). We share information with the providers that help us run the Service (described in section 5), who process it on our behalf and under our instructions.
• For legal reasons. We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Desti, our users, or the public.
• In a business transfer. If Desti LLC is involved in a merger, acquisition, financing, or sale of assets, your information (including personal data) may be transferred as part of that transaction. We will notify you of any change in ownership or any material change in how your personal information is used.

5 Service providers & third parties

We rely on a small set of trusted third-party providers to operate the Service. They process data only as needed to perform their function for us and under our instructions, and each operates under its own privacy terms. They fall into these categories:

• Cloud hosting, database, and file storage
• Sign-in (the Apple or Google account you choose to sign in with)
• Analytics and crash diagnostics
• Push-notification delivery and app updates
• Automated content moderation
• Maps and place search
• AI summarization of public community reviews (to generate the "what travelers say" summaries shown on city pages)

Some features also send a request to an outside service to fetch public information on your behalf, such as retrieving the preview of an Instagram or TikTok post you save, or looking up a place when you search. We store your authentication tokens in your device's encrypted secure storage (Apple Keychain or Android Keystore).

6 Public content & your privacy choices

Desti is a social product, so some information is visible to other people by design:

• By default, your profile, your city rankings, and your wishlists are viewable by other users of the Service.
• Photos you upload (your profile picture and trip photos) are stored so they can be displayed in the app and are accessible via their image links. Please do not upload photos you wish to keep strictly private.
• You can set your profile to private, which lets you approve followers and limits who can see your content. You can also choose whether to share your travel "inspiration" posts with your followers.

You control what you share: you can edit or remove your content, change your privacy settings, manage your notification preferences, and unfollow accounts at any time.

7 Data retention

We keep your personal information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal information within a reasonable period (generally within 90 days), except where we need to retain certain information to comply with legal obligations, resolve disputes, prevent abuse, or enforce our agreements. Residual copies may persist in routine backups for a limited time before they are overwritten. Aggregated or de-identified data that can no longer be linked to you may be retained.

8 Your rights & choices

Regardless of where you live, you can:

• Access & review much of your information directly in the app.
• Correct or update your profile and content at any time.
• Delete your content and your account. To delete your account and associated personal data, open Settings → Delete account in the app, or email us at info@thedesti.app and we will process your request.
• Control notifications through the app's notification settings and your device settings.
• Manage permissions (such as photo-library and notification access) in your device's system settings.

To make a privacy request, email info@thedesti.app. We may need to verify your identity before acting on certain requests, and we will not discriminate against you for exercising your rights.

9 California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended, gives you certain rights regarding your personal information:

• The right to know what personal information we collect, use, and disclose.
• The right to delete personal information we have collected from you.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information, and to limit the use of sensitive personal information.
• The right to non-discrimination for exercising your rights.

In the categories used by the CCPA, we collect identifiers (such as name and email), internet and app activity (usage analytics), and user-generated content. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. If our practices change, we will update this notice and provide the opt-out the CCPA requires. We do not knowingly sell or share the personal information of consumers under 16. To exercise your rights, email info@thedesti.app.

10 European & UK privacy rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, Desti LLC is the controller of your personal data. We process your data on the following legal bases:

• Performance of a contract — to provide the Service you sign up for.
• Legitimate interests — to secure, analyze, and improve the Service and prevent abuse, balanced against your rights.
• Consent — for optional permissions such as push notifications and photo-library access (and, in the future, contacts). You can withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, the right to data portability, and the right to lodge a complaint with your local supervisory authority. To exercise these rights, email info@thedesti.app.

11 International data transfers

Desti is operated from the United States, and our service providers may process data in the United States and other countries. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in countries whose data protection laws may differ from those of your country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

12 Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact info@thedesti.app and we will take steps to delete it. Some jurisdictions set a higher age of digital consent; where that applies, we rely on the appropriate legal basis or parental consent as required.

13 Security

We take reasonable technical and organizational measures to protect your information, including encryption of data in transit, storing authentication tokens in your device's encrypted secure storage, access controls on our backend, and automated content moderation. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your sign-in method and device secure.

14 Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the "Last updated" date above and, where appropriate, provide additional notice (for example, in the app). Your continued use of the Service after an update means you accept the revised policy.

15 Contact us

If you have questions, requests, or concerns about this Privacy Policy or your personal information, contact us at:

Desti LLC
New York, USA
Email: info@thedesti.app