Privacy Policy
Rumo is built so that we never see your trips. The app has no analytics, no advertising, and no tracking of any kind, and everything works without an account. Three optional features — email forwarding, flight alerts, and live flight tracking — use an optional account and are described in their own section below. This page explains where your data lives and the few cases where the app talks to the internet at all.
Where your data lives
Everything you enter in Rumo — trips, bookings, notes, costs — is stored on your device. If you are signed in to iCloud, Apple's CloudKit framework mirrors it to your private iCloud database so it syncs between your own devices. That database belongs to your Apple account: we have no server that stores your trips and no way to read them.
What leaves your device
Four optional features make network requests. Each works without any account and sends no personal identifiers:
- Flight lookup and live status. When you search for a flight, the flight number (or airport pair) and date are sent to our lookup service, which forwards them to the AeroDataBox flight-data provider and returns the schedule. Flights on your timeline are also checked this way automatically around departure — from 12 hours before until shortly after landing — to show their live status. Nothing about you travels with these requests. Like almost all web services, ours keeps standard technical logs (such as IP address) briefly for abuse prevention.
- Train search. When you search for trains, the two stations and the date are sent to the national railway's data service for that country — SBB in Switzerland, Deutsche Bahn in Germany, SNCF in France, NS in the Netherlands — directly or through our lookup service, and the day's trains come back. Nothing about you travels with the request.
- Exchange rates. Daily currency rates are fetched from the free Frankfurter service (European Central Bank data). The request contains no personal data.
- Weather. Forecasts for upcoming trips come from Apple WeatherKit; Apple receives the coordinates of the trip's locations to return the forecast. See Apple's privacy policy.
Searching for hotels, restaurants and stations uses Apple Maps on-device frameworks, which send your search text to Apple under Apple's privacy terms. Reading bookings out of confirmation emails, screenshots and boarding passes you paste or share into Rumo happens entirely on your device — the text recognition, the barcode reading, and the optional second pass by Apple's on-device model on devices that support it — and none of it is ever uploaded anywhere. Everything else — timelines, time zones, airports, currencies — is built into the app and works entirely offline.
The optional Rumo account and email forwarding
You can use every part of Rumo without an account. Signing in — with Sign in with Apple only — unlocks the optional Rumo Pro features: a personal forwarding address, flight notifications, and live flight tracking. Forward a booking confirmation email to your address, and the bookings found in it are waiting for your review next time you open the app. For that to work, our server briefly handles the emails you choose to forward. Here is exactly what happens:
- What the account stores. The anonymous identifier Apple issues for your sign-in, your random forwarding address, hashed sign-in sessions, and — so we can notify you — your device's push token. Signing in also asks Apple for your first name, which is used only to greet you in the app: it stays on your device and in your private iCloud (along with a profile photo if you choose one) and is never sent to our server. We do not ask for your email address, and your trips and bookings are never on our server.
- What happens to a forwarded email. Its text — and any attached ticket or itinerary documents (such as an airline's e-ticket PDF) — is analyzed by Claude, an AI model from Anthropic, to find the bookings in it. Anthropic processes it as our service provider and does not use it to train models. The found bookings are suggestions only — you review every field in the app before anything is saved.
- How long we keep it. A forwarded email is deleted from our server when you review it in the app, and automatically after 30 days either way. Nothing about it is kept afterwards.
- Flight alerts. To tell you about a delay, a gate change or a cancellation while the app is closed, our server has to know which flights to watch. When flight alerts are on, the app sends only the public identity of your upcoming flights: the flight number, the departure date, and the two airport codes. Nothing else about the booking — no hotels, no costs, no confirmation codes, no notes — leaves your device. The Lock Screen's live flight card (a Live Activity) is updated with this same flight data and nothing more. A watched flight is removed from our server after it lands, and you can turn alerts off for a single flight or altogether at any time.
- Live flight tracking. While one of your flights is in the air, its page can show where the aircraft is. To answer that, the app sends our server the flight number and nothing else — not the booking, not your location. Our server asks Flightradar24, our live-flight-data provider, and passes the position back; it is not stored anywhere on our side, and the app keeps it only in a short-lived cache that is cleared as the flight ends. The map only appears while the flight is airborne.
- If you subscribe to Rumo Pro. Payments are handled entirely by Apple — we never see your card or Apple account details. Our server stores only your subscription status (which plan, and whether it is active) so the paid features stay unlocked, linked to your account. Apple tells our server when the subscription renews, lapses, or is refunded.
- Deleting the account. Settings → Delete Account removes everything above from our server immediately and revokes the Sign in with Apple connection. Your trips and bookings are unaffected — they were never there.
Permissions the app may ask for
- Notifications — only to show reminders you set on your own bookings. Reminders are scheduled locally on your device.
- Calendar — only if you choose to add bookings to your calendar. Rumo writes to its own "Rumo" calendar and never reads or touches your other calendars' events.
Backups you export
The app can export your database as a file. That file is created on your device and goes only where you send it — it is never uploaded to us.
Deleting your data
Delete a trip or booking in the app and it's gone, including from your iCloud sync. Deleting the app removes all local data; iCloud data can be managed in iOS Settings under your Apple ID → iCloud. If you created a Rumo account, Settings → Delete Account removes it and everything it stored, as described above.
Children
Rumo does not collect personal information from anyone, including children.
Changes to this policy
If a future version of Rumo adds features that change how data is handled, this policy will be updated before those features ship, and the effective date above will change.
Contact
Questions about privacy? Email privacy@getrumo.io.