Privacy policy
Last updated: 12 November 2026
Tecum is an app for planning trips, alone or with the people you travel with. This policy explains which personal data Tecum processes, why, for how long, and the rights you have.
Tecum collects only what it needs to work. It shows no advertising, sells no data and doesn't track you across other apps or websites.
Who is responsible
The controller of your personal data is Marco Galetta, Via Sempione 3, Paderno Dugnano, Italy. You can reach us at support@tecumapp.com.
What we process and why
Your account
- Your email address.
- If you sign in with a password: a protected form of it, kept by Firebase Authentication. Nobody at Tecum can see your password.
- If you continue with Google: the identifier of your Google account, your email address, and the name and profile photo Google shares.
- When you created your account and when you last signed in.
Why: to create your account, keep it secure, let you sign in on your devices, and send verification and password-reset emails. Legal basis: our contract with you (Article 6(1)(b) GDPR).
Your trips
What you add to Tecum, and what others add to trips they share with you: trips with their dates and destinations, itinerary items and times, places, notes, links, lists, proposals and votes, expenses and how they're split, and documents you choose to share with a trip.
Why: to show this content to you and to the members of each trip, according to their role, and to keep it in sync between your devices and available offline. Legal basis: our contract with you.
People you travel with
Members of a trip see each other's name, but never each other's email address. Tecum also keeps a list of the people you've shared trips with, so you can invite them again.
If you delete your account, the other members of trips you shared keep what you added, such as places or expenses you paid, and still see your name next to it, greyed out.
Legal basis: our contract with you. After you delete your account, our legitimate interest, and the other members', in keeping shared trips and their expenses complete.
Your device
The token that delivers notifications to your device, the platform (iOS or Android), the app version, your language and your time zone.
Why: to send the notifications you turn on, show Tecum in your language and show times in local time. Legal basis: our contract with you. Notifications also need your permission on the device, which you can withdraw at any time in its settings.
Crash reports
When the app crashes: the device model, the operating system and app versions, what the app was doing, and a random identifier of the installation. Crash reports aren't linked to your account.
Why: to find and fix bugs. Legal basis: our legitimate interest in a working, secure app (Article 6(1)(f) GDPR).
Security and server logs
When the app talks to our servers, they record the time, the request and your IP address. To protect our servers from abuse, the app also confirms through Apple App Attest or Google Play Integrity that it's a genuine copy of Tecum.
Why: security, preventing abuse and fixing problems. Legal basis: our legitimate interest.
Messages to support
If you email us: your email address and what you write.
Why: to answer you. Legal basis: our legitimate interest, or our contract with you when the message is about your account.
What stays on your phone
Downloaded maps, offline copies of your trips, and tickets you import stay on your device. Tickets and other documents leave it only if you share them with a trip.
Maps, places and partners
Some services receive data directly from your device, or through our servers:
- Maps: map tiles come from OpenFreeMap's servers, which receive your IP address and the areas you view or download, but nothing about your account. Map styles come from our own website.
- Place photos and descriptions load from Wikipedia and Wikimedia Commons, which receive your IP address.
- Place search and routes go through our servers, which send Geoapify only the search text or the coordinates, never who you are.
- Bookings: partner sites, for example for hotels or activities, open in a browser inside Tecum, and their privacy policies cover what you give them. Their links can carry an affiliate code that credits Tecum for the booking; the code doesn't identify you.
- Google sign-in also falls under Google's privacy policy.
Who processes data for us
Google provides the services Tecum runs on (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, Firebase Cloud Messaging, Crashlytics, App Check and Firebase Hosting) and processes data on our behalf under its data processing terms. Your trips and our servers are hosted in the European Union, in Belgium. Some of these services, such as sign-in and notifications, may also process data outside the European Economic Area; those transfers rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on its standard contractual clauses.
Our email provider handles the messages you send to support. We don't sell or rent personal data, and we share it with no one else unless the law requires it.
How long we keep it
- Account and trips: while your account exists. Deleting your account removes it, its data and the trips only you are part of from our database right away.
- Your name in trips you shared: as long as those trips exist.
- Server logs: 30 days.
- Crash reports: 90 days.
- Support emails: as long as needed to help you, and no longer than 12 months.
- On your phone: until you remove the data or uninstall the app.
Your rights
Under the GDPR you can ask to access, correct or delete your data, receive a copy in a portable format, restrict or object to its processing, and withdraw any consent you gave. You can delete your account in the app or as described on Delete your account; for anything else, email support@tecumapp.com. We answer within one month.
You can also complain to the data protection authority of the EU country where you live or work, or where you think an infringement took place. In Italy, that's the Garante per la protezione dei dati personali.
Children
Tecum isn't meant for children under 16, and they shouldn't create an account.
Security
Data is encrypted on its way between the app and our servers, and when stored on Google's servers. Access to our systems is limited to the people who run Tecum.
Changes to this policy
When we change this policy, we update this page and its date. If a change affects how we use your data, we'll tell you in the app before it applies.