Your data
Privacy policy
Updated October 18, 2026. Applies to Bora Aí on iPhone, Android and the web.
Summary
Bora Aí is local first. Trips, days, stops, and passport visits are saved on your device. When you use the app without signing in, your trips stay on that device. If you sign in and synchronization is available, trip data is also sent to Cloudflare so your account and invited members can access it.
The app contacts other services for place photos, searches, maps and routes, authentication, synchronization, and technical events. Those cases are explained below.
The AI assistant is optional and runs in the cloud: it sends data only after you sign in and accept the notice in the app. Itinerary PDFs are created on your device.
If you allow it, your position appears on maps. Versions with Automatic visits also let you authorize precise background location to recognize today’s itinerary stops while the app is not in use. This feature starts off and explains its use before requesting system permissions. Position samples are processed on your device; we do not send a history of your movements. The candidate stop and dwell timestamps are stored locally. A confirmed visit records the itinerary place and date in your passport and, when signed in, syncs with your account and Apple Watch. You can undo the visit, turn the feature off in Profile, or revoke location permission in device settings.
Data stored on your device
- Trips, destinations, local dates and time zones, days and stops, including place names and coordinates.
- Pending edits waiting to synchronize.
- Passport visits, including visit dates, personal notes, and saved photos.
- Photo credits, including author, license, and source address.
On iPhone and Android, this is stored in the app's SQLite database. On the web, it is stored in the browser's IndexedDB for the domain where you open the app. Removing the app or site data deletes that local copy. If you signed in, delete your account too to remove server data.
Services contacted by the app
| Service | When | What it receives |
|---|---|---|
| Wikidata and Wikimedia Commons | When looking up a place photo. | The searched place name, an app identifier, and your IP address as part of the network request. Images are downloaded from Wikimedia. |
| Apple Maps (MapKit) on iOS | When searching for a place, calculating a route, or opening navigation. | The search text and the origin and destination coordinates, processed under Apple's privacy policy. |
| Cloudflare | When you sign in, share a trip, or synchronize a signed-in account. | Account identifiers, the name and profile photo provided by Google or chosen by you, authentication tokens, and the trip and membership data needed for synchronization. Trip members can see your name and photo. Photos you choose are kept in Cloudflare public storage, and anyone with the image address can view them. |
| adsbdb | When you look up a flight by its number. | The flight number and your IP address as part of the network request. |
| Uber | When you tap Request Uber. | The stop name and coordinates, as the ride destination. From there, Uber's privacy policy applies. |
| Technical events (expo-observe) | Only in published versions configured to collect them; disabled in development. | Technical events with the operation name, outcome, duration in milliseconds, navigation performance, and app errors. Sensitive route parameters are filtered. |
| Google Maps on Android; Google Maps 3D on iOS and Android, when available | When opening a Google map or Explore in 3D. | The displayed region and coordinates are used to request the map. The SDK may send Google your IP address, device and SDK metadata, a pseudonymous identifier, crash diagnostics and map interactions. See Google’s privacy policy and the SDK disclosures for iOS and Android. |
| Flight schedules (Cloudflare / ANAC SIROS) | When looking up scheduled times by flight number and date. | The Cloudflare server receives the flight number, date, airline, departure and arrival airports, and request IP address. It fetches and caches ANAC’s public schedule by date; it does not send your account or itinerary to ANAC. The adsbdb route lookup remains separate. This is not live tracking. |
| ElevenLabs | When you use the AI assistant by voice, after you accept. | Your spoken request (up to 60 seconds) and its language, for transcription. With spoken replies on, the reply text, to create the voice. Everything passes through Bora Aí's server on Cloudflare first. |
| Cloudflare Workers AI and OpenRouter | When using the assistant, after acceptance. | Request, itinerary context and account memory described below. Open models on Cloudflare; Claude or DeepSeek through OpenRouter as a fallback. |
| RevenueCat | On iPhone and Android, when you view plans, subscribe or restore Pro, and when the server checks whether an account has Pro. | Your account identifier (or an anonymous RevenueCat identifier when signed out) and purchase data from the App Store or Google Play. |
Technical events in detail
Event types include sync, places.search, route.calculate, media.save, passport.save, and gallery.render, with a result (success, offline, conflict, or failure) and duration. Telemetry also measures navigation and records errors. The event code is designed not to send search text, coordinates, titles, notes, email addresses, tokens, or media addresses. It filters identifiers from navigation routes such as id, tripId, invite, token, code, query, and email.
Accounts and synchronization
Signing in is optional. When configured in your version, authentication uses Apple or Google with Cloudflare. Google may provide your profile photo. Apple does not provide one; you can choose a photo in the app. The iPhone stores the session in Keychain through SecureStore; Android uses encrypted SecureStore storage with keys protected by Android Keystore; the web stores it in browser localStorage. Each account has separate local data. When you sign in, trips created as a guest on this device move to that account and can synchronize. The guest copy is removed only after the account copy is saved locally. Account trips may synchronize with Cloudflare, including edits made by members you invited. Check the trip's sharing settings before sending an invite link.
API integrations
Keys are optional, expire after 30 days and can be revoked in Profile → Integrations. We store the key’s SHA-256 hash, permissions and usage metadata. Anyone given the key can access trips you own within the selected read, edit and delete permissions. Audit records contain account, key, operation, result and request identifiers, without itinerary content or the secret key. A connected assistant receives the data it requests through the API; check that service’s policy and do not share a GPT configured with your personal key.
Cloud AI assistant
The assistant requires an account and acceptance in the app for that account on this device. Without acceptance, nothing is sent to the models. To turn it off, use More AI options → Turn off cloud AI. It is for people aged 18 or older. Spoken replies are AI-generated voices.
Requests pass through Bora Aí’s Cloudflare server. ElevenLabs transcribes audio with Scribe v2 and generates spoken replies when enabled. Planning uses open models on Cloudflare Workers AI, such as Gemma. When needed, it uses Claude (Anthropic) or DeepSeek through OpenRouter, restricted to providers that declare no retention of requests and replies. Typed requests skip transcription.
The model context includes city and date; stops with names, times, duration, transport, categories, ratings, opening hours, distance from the previous stop and excerpts of notes; day availability and journey times, including flights; summaries of other days; found options; saved preferences and transport choices; recent conversations and relevant earlier requests from the same account. Coordinates, photos, booking codes, email and passport are not sent to the model. Transcription may also receive city and stop names to help recognize speech.
Proposed changes require your confirmation in the app. Suggested places are checked through search services. Recorded audio and spoken replies stay on the device during the request and are deleted afterwards. The server does not store these audio files.
Request and reply history, preferences and transport choices may be saved on the device and synchronized with your account to resume conversations. The server selects earlier requests and preferences from your own account as context for new replies. Turning off AI stops new requests; it does not delete saved history. Deleting your account removes its server data.
To enforce limits, the server stores account usage and request identifiers. Operational logs contain operation, model, outcome, duration, release and request identifier, without audio, request text or itinerary content. Each provider handles received content under its own policy, linked below.
With your location permission, place searches may use your approximate position to find nearby places. It goes to place search services, not the AI model.
During early access, Free and Pro have the same configured features and limits. Any future separation will be explained in the app.
PDF export
The PDF is created on your device from the saved itinerary and may include notes, addresses, flights, lodging and confirmation codes. No server is involved. On iPhone and Android, the file goes only to the app or person you choose; on the web, it opens your browser's print dialog.
Calendar
When you choose More > Device calendar, the app sends the stop’s name, notes, address, start and end to the device calendar editor, when available. You confirm saving; Bora Aí does not read your events. Google Calendar receives these details when opening its web editor. With .ics export, the file goes to the app you choose. There is no automatic calendar synchronization.
Trip reminders
Reminders are optional and scheduled on this device using your trip dates. You can turn them off in Profile or iOS Settings.
Passport sharing
Your passport stays private until you create a link. The shared snapshot, stored in Cloudflare, contains totals and visited cities, with approximate city-center pins. Your name is included only if you choose. Dates, notes, photos, stops and itineraries are excluded.
Anyone with the link can open the card in the app or on the web and forward the link. The link stays the same and updates itself when your passport changes. You can disable it through the same sharing button; deleting your account also removes it. This prevents new access through the link, but does not erase copies already saved by others.
What we do not do
- We do not sell or rent your data.
- We do not show ads or include cross-app advertising trackers.
- We do not require a contact to use the app locally.
- We do not use your trips, notes, or photos to train models.
Retention
Local trip data stays on your device until you delete it. Account data stays on the server until you delete your account or the data concerned. We cannot set retention periods for Apple, Wikimedia, Cloudflare, ElevenLabs, OpenRouter, Anthropic, or RevenueCat; each has its own policy.
Children
The app is not directed at children and does not ask for age, name, or contact information to use it locally.
Your rights
You can access, correct, and delete local data in the app or by clearing its storage. For an account, use the account deletion control. For help or a privacy rights request, email luisfelipesena@icloud.com.
Changes
Changes to this policy appear here with a new date. We publish changes that expand data sent from your device before they take effect.
Other privacy policies
Contact
Privacy questions: luisfelipesena@icloud.com. I reply in Portuguese or English.