Privacy Policy

A plain-language explanation of what Rotori asks from you, why, and for how long we keep it.

Last updated: July 26, 2026

1. Who we are

Rotori is a mobile app that helps you plan trips to Japan. This policy covers the Rotori app and the rotori.app marketing site. For questions: [email protected].

2. What we collect

Account information

You need an account to use Rotori. When you sign up we take:

Email sign-up: your email and password. We never store the password in plain text — it's securely hashed (bcrypt).
Sign in with Apple: Apple hands us an identity token on your behalf. If you chose "Hide My Email", we only see an Apple relay address ([email protected]) — never your real email.

In-app data

What you create while planning is sent to us so you can see it on your other devices:

City picks, dates, flight details (departure/arrival times, airline names)
Hotel names, addresses, check-in/check-out dates
Your activity list, reminders, pre-departure checklist
If you attach a ticket photo — that photo is stored with your plan only

Location data

Your location does not reach us. Rotori uses GPS locally on your device for "discovery badges" (like the one you earn when you arrive at Senso-ji Temple). This runs entirely on your device — your location isn't sent to our servers, logs, or any third party.

Photos and camera

If you want to capture a boarding pass, we ask for camera or photo library access. Selected photos stay only in your plan; they're not sent anywhere else.

3. How we use it

To show you your travel plan
To send you local reminders when a booking window opens (we'll ask permission first — you can decline)
To open your route in Google Maps — only coordinates go to Google Maps, not your identity or account info
To trigger your pre-departure checklist as your trip approaches

We never use your data for advertising. Rotori doesn't run an ad network.

4. Third parties

Supabase Inc. — account and data hosting (EU / US regions). Governed by Supabase's own privacy policy.
Apple Inc. — if you use Sign in with Apple, Apple's privacy policy also applies.
Open-Meteo — sends only city coordinates for weather forecasts (not who you are). Free open-source service, no account needed.
Google Maps — when you tap "open in maps", coordinates go to Google. The app never talks to Google in the background.

We don't use any service that profiles you for ads or tracks behavior: no Google Analytics, no Facebook Pixel, no Firebase Analytics, not even crash reporting. Rotori is a quiet app.

5. How long we keep it

Your data stays until you delete your account. When you tap "Delete Account" inside the app, everything is erased — your plans, hotels, tickets, reminders, checklist, and account record. This is irreversible.

The account deletion flow complies with Apple App Store Guideline 5.1.1(v): you can delete where you sign up, no email required.

6. Your rights (KVKK / GDPR)

If you're in Türkiye or the EU, you have these rights:

Ask what data we hold
Correct inaccurate data
Request deletion (do it instantly from inside the app)
Request data export — email [email protected] and we'll send JSON within 30 days
Object to processing

7. Children

Rotori is rated 4+, but we don't knowingly collect data from users under 13. If we discover an account belonging to a child under 13 without parental consent, we delete it immediately.

8. Changes

We may update this policy from time to time. For material changes, we'll ask you to re-consent inside the app. The "Last updated" date at the top always points to the current version.

9. Contact

Any questions: [email protected]