Draft: this text is still under legal review and may change.
Ciranda Privacy Policy
Last updated: October 19, 2026 (draft)
This Policy explains what personal data Ciranda processes, why, who we share it with, how long we keep it and how you exercise your rights. It covers the app (iOS and Android), the web version of the app (in a browser, signed in) and the trip web page opened from a link.
1. The controller
Vértice Tecnologia Global LTDA, CNPJ 67.764.810/0001-95, Rio do Sul/SC, Brazil, is the controller of your personal data in Ciranda.
Privacy contact: support@awayproof.com (interim until Ciranda has its own domain). See section 11 on the data protection officer.
2. What data we process
| Category | What it is | From whom |
|---|---|---|
| Account | Email; the name you choose; language, theme and default currency; an internal account id; if you sign in with Apple or Google, the identifier they provide (and, for Apple, a token we keep encrypted only to revoke access when you delete your account). With Apple you can use a relay email instead of your own | Account holders |
| Trip content | Trip name and dates; cities, lodging (name and amount), legs and chosen transport mode; place ideas; votes; comments; the name you use in each trip; your role; the activity log ("Su changed the Paris dates") | Accounts and guests |
| Money records | Expenses (amount, currency, description, who paid, how it was split), settle-ups marked paid, computed balances | Accounts. Guests don't log expenses but can be included in a split (name and share) |
| Photos | The trip cover photo uploaded by an organizer, with location data (EXIF) removed on the device | Accounts (owner or editor) |
| Web guests | The name entered, votes, comments and suggested ideas; a random identifier kept in the browser for up to 90 days | Guests without an account |
| Email invites | The invitee's email, entered by the person inviting, until they accept or decline | Invitees (who may not have an account yet) |
| Reports and blocks | Who reported, what was reported (with a copy of the content), reason, optional text and outcome; whom you blocked | Accounts and guests |
| Usage events (statistics) | Actions in the app such as "trip created" or "expense logged", with date, platform, app version, language and internal ids for the trip, the member and the account. They contain no names, emails, text, comments or place names | Accounts and guests |
| Web session | A session cookie holding the sign-in refresh token, which page code can't read (HttpOnly) | Accounts signing in from a browser |
| Technical logs | IP address, date and time of access, and error records without content | Everyone |
| "Import itinerary" text | Text you paste to import a trip. Not stored by our servers (section 4.2) | Accounts |
We don't intentionally process sensitive data (health, religion, biometrics, etc.). We don't run face recognition on photos. We don't access your location, contacts, camera or full photo library: the cover photo is picked with the system's limited picker. We don't process payments or store card or bank details. We show no ads and sell no data.
3. Purposes and legal bases (LGPD art. 7)
| Purpose | Data | Legal basis |
|---|---|---|
| Create and maintain your account, sign you in, send the sign-in code | Account | Performance of a contract (art. 7 V) |
| Provide the service: build and show the trip to the group and link holders, compute splits and balances | Trip content, money records, photos | Performance of a contract (art. 7 V) |
| Let guests vote and comment on the web | Web guests | Performance of a contract (art. 7 V) |
| Send an email invite and link it when the person accepts | Invitee's email | Legitimate interest of the inviter and ours (art. 7 IX) |
| Keep the first name on expenses of someone who deleted their account, so the group knows whom to pay | Name on money records | Legitimate interest of the other members (art. 7 IX) |
| Import a pasted itinerary | "Import itinerary" text | Performance of a contract, at your request (art. 7 V). International transfer: section 5 |
| Moderation: review reports, remove content, suspend accounts, apply blocks and the word filter | Reports and blocks, reported content | Legitimate interest (art. 7 IX) and regular exercise of rights (art. 7 VI) |
| Security and abuse prevention: rate limits, attack detection | IP, identifiers, logs | Legitimate interest (art. 7 IX) |
| Keep access logs for the legal period | IP address, date and time, your account (or guest) id, and which part of the service was used, with its result | Legal obligation (art. 7 II; Marco Civil da Internet art. 15) |
| Usage statistics to improve the product | Usage events | Legitimate interest (art. 7 IX) |
| Answer requests, reports and support messages | Email and what you write to us | Performance of a contract and regular exercise of rights (art. 7 V and VI) |
| Transactional email: sign-in code, deletion confirmation, report outcome | Performance of a contract (art. 7 V). We send no marketing email |
We rely on consent for no processing today.
4. Who we share data with
We don't sell or rent personal data. We share only with:
4.1 Trip members and link holders
What you put in a trip is seen by the trip's members. Holders of the vote link see the itinerary, ideas, votes, comments and the cover photo, but not expenses or emails. Your email is shown only to whoever looks after the trip, in invites. Link previews (WhatsApp and others) show the trip's name, dates and number of cities, never the cover photo.
4.2 Processors (act on our behalf)
| Processor | Purpose | Where |
|---|---|---|
| Amazon Web Services (AWS) | Database hosting, sign-in (Amazon Cognito), email delivery (Amazon SES), photo files, servers and logs | São Paulo, Brazil (sa-east-1). The web page and photos go through the CloudFront delivery network, which may keep temporary copies (up to 1 hour) on servers near the viewer, including outside Brazil |
| Anthropic, PBC (Anthropic API) | Reading "Import itinerary" text with an AI model (Claude Haiku) and returning a draft trip. The service used by default | United States (section 5). Anthropic doesn't use the text to train models and deletes it within 30 days, except as described in section 6 |
| Amazon Bedrock (AWS) | Fallback, only when the Anthropic API fails. Reads the text with an AI model (Claude, by Anthropic, or Qwen) | AWS servers inside or outside Brazil (section 5). AWS doesn't store the text, use it to train models or share it with the model's maker |
| Expo (EAS Update) | Delivering app updates. The app checks Expo's servers and sends technical data (platform, app version) and the device's IP; no account or trip data | United States |
About "Import itinerary": the text you paste goes from our server in São Paulo to Anthropic (or, if Anthropic fails, to Amazon Bedrock) and comes back as a draft. We send only the pasted text: no name, email or account identifier, except whatever the text itself contains. We don't store the text on our servers or in our logs. Anthropic keeps the text and the result for up to 30 days and then deletes them (section 6); AWS doesn't keep them. The text stays only on your device, for retrying, until you clear it or for 24 hours. Logs keep only numbers (text length, time, cost) and an account code that doesn't directly identify you.
4.3 Other providers (independent controllers)
| Provider | What it receives | Note |
|---|---|---|
| Google Places and Geocoding (place search, when enabled) | From our server, when this search is enabled: the text you type or paste into place search and the chosen place's id. Never your name, email, IP or identifier. City search uses our own database (GeoNames) on our AWS servers, with no third party | Governed by the Google Privacy Policy. Don't type personal data into search |
| Google Maps (maps in the app and on the web) | Maps load directly from Google: in the app through the Google Maps SDK, on the web through the Google Maps JavaScript API. Google receives technical device or browser data (IP, model, OS or browser, version, an SDK identifier, crash data and, depending on configuration, map interactions) and the map area you view | Governed by the Google Privacy Policy |
| The device's platform geocoder (Apple on iOS; on Android, the system geocoding service, typically Google Play services) | When you drop a pin on the map in the app, the device sends that point's coordinates to the system service to suggest an address. It doesn't go through our servers. We don't access your location and don't ask for that permission | Governed by Apple's and Google's policies |
| Apple and Google (sign-in) | If you sign in with them, they confirm your identity and send us your name, email and an identifier | Governed by Apple's and Google's policies |
Exchange rates (Frankfurter, European Central Bank; ExchangeRate-API, open.er-api.com) | Currency codes only (e.g. EUR, BRL), once a day, from our server. No personal data | "Rates By Exchange Rate API" |
| Transitous | Start and end coordinates of legs, from our server, to estimate public transport time. None of your identifiers |
4.4 Authorities
When there's a court order or a request from a competent authority, as the law provides.
4.5 Corporate changes
If the company is sold or reorganized, data may pass to the successor, which is bound by this Policy.
5. International transfer
We store your data in Brazil (São Paulo). There are three cases where data may be processed outside Brazil:
- "Import itinerary". "When you use 'Import itinerary', only the pasted text is sent to Anthropic, PBC, a United States company that provides the Claude AI model, to turn it into a draft trip. The text is processed on Anthropic's servers in the United States, isn't used to train models and is deleted by Anthropic within 30 days (or kept longer only if it's flagged for breaking Anthropic's usage rules or the law requires it). If Anthropic is down, the text goes to Amazon Bedrock, Amazon Web Services' AI service, and may be processed for a few seconds on AWS servers outside Brazil, without being stored. Only the draft returns to the app, and nothing is saved without your review."
- App updates (Expo, US), Google maps (SDK in the app, Maps JavaScript API on the web), Google place search (when enabled) and the device's platform geocoder: technical data and IP (maps and geocoder), or search text with no identity (search). No account or trip data.
- Delivery-network cache (CloudFront): temporary copies of the web page and cover photos, for up to 1 hour, on servers near the person viewing the trip.
6. How long we keep data
| Data | Period |
|---|---|
| Account (email, name, preferences, sign-in) | While the account exists. Deleted immediately when you delete the account; the Apple token is revoked |
| Comments and votes | Until you delete them, leave the trip or delete your account. Comments removed by moderation disappear at once and are permanently deleted after 30 days, unless legally preserved |
| Cities, ideas, legs | While the trip exists. Deleted items can be restored for 7 days, then are permanently deleted. If you delete your account, they stay in the trip without your name |
| Money records | While the trip exists, because others' balances depend on them. If you delete your account, the amounts stay and your name is handled per decision C-16 |
| Cover photo | Until replaced or removed, the trip is deleted or the uploader deletes their account. Deleted at once; cached copies are gone within 24 hours |
| Deleted trip | Deleted at once with everything in it. Only a "trip deleted" notice with the deleter's first name remains, for 90 days (removed sooner if that person deletes their account) |
| Web guests | Until the guest deletes their data, the trip is deleted or the person looking after it removes them. The browser identifier expires after 90 days |
| Invite email | Until the person accepts or declines, or the trip is deleted |
| Trip activity log | 90 days |
| Reports | 6 months after the decision; then we delete the reporter, the text and the content copy, and keep only counts. Longer under a legal preservation order or request |
| Blocks | Until removed or either account is deleted |
| Usage events | 13 months. On account deletion, the account id is removed from events |
| Access logs (IP, date, time, account id, part of the service used) | 6 months (Marco Civil art. 15), then deleted. Only our administrators can read them |
| Technical error logs | 14 days |
| "Import itinerary" text | Not stored by our servers. On your device, up to 24 hours. At Anthropic: deleted within 30 days; up to 2 years if Anthropic's safety systems flag it as breaking its usage rules; longer if the law requires. At AWS (fallback): not stored |
| Backups | Deleted data is gone from backups within 7 days |
| Deletion request | We keep that a request happened and when it was completed, without email or identifier |
7. Your rights and how to exercise them
Under the LGPD (art. 18), you can ask for: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or excessive data; portability; information on whom we share with; and review of decisions made solely by automated means (Ciranda makes no such decisions about you). You can also object to processing based on legitimate interest.
How to ask:
- Delete your account: in the app, Profile → Delete account. It's immediate. Without the app: https://d1zofvbuugjkv2.cloudfront.net/excluir-conta, or write to the contact in section 1 from the account's email; we confirm the email is yours and delete within 15 days.
- Web guest: "Delete my data from this trip", on the name screen.
- Correct: your name and preferences can be changed in the app.
- Other requests (access, a copy of your data, portability, objection): write to the contact in section 1. We reply within 15 days.
- Someone pictured in a photo, or who doesn't use the app: can request removal through the same contact.
We may ask you to confirm your identity first. Requests are free. You can also complain to Brazil's data protection authority, the ANPD.
What remains after account deletion: money records others need to settle up (section 6), reports about you (6 months), access logs (6 months, by law) and backups (up to 7 days). We can't delete PDFs you've shared outside the app.
8. Children and teenagers
Ciranda is for people 18 or older. We don't knowingly collect data from minors. If we learn an account or guest is a minor, we delete the data. If you know of such a case, tell us through the contact in section 1.
9. Security
- Data encrypted in transit (HTTPS) and at rest in AWS services.
- Passwordless sign-in (email code, Apple or Google). In the app, tokens are kept in the device's secure storage. On the web, the refresh token sits in an
HttpOnlycookie out of reach of page code, and the access token only in the tab's memory. - Every server request checks that you're in the trip and what your role is. Guests receive no expenses or emails.
- Private photos, served through temporary links (1 hour). Creating a new trip link cuts old access within 1 hour.
- Rate limits against abuse. Third-party service keys stay on the server, never in the app.
- Admin access limited to the founders.
No system is fully secure. If a security incident may cause significant risk or harm, we'll notify you and the ANPD as the law requires.
10. Cookies and local storage
We use no advertising, tracking or analytics cookies. Usage statistics (section 2) are recorded by our server, without cookies.
| What | Where | Why | Duration |
|---|---|---|---|
Session cookie (HttpOnly, Secure, SameSite) holding the sign-in refresh token | Browser, Ciranda's domain only | Keep you signed in on the web version. Strictly necessary: sign-in doesn't work without it | Up to 30 days without use; ends when you sign out; if you tick "This is a shared computer", ends when the browser closes |
Guest identifier (localStorage) | Browser | Remember who voted or commented without an account | Up to 90 days |
| Sign-in tokens and a trip copy | The app's secure storage and storage | Sign-in and offline use in the app | Until sign-out or account deletion |
The web version keeps no trip data in the browser after you sign out. The Google map loaded on the page may use browser storage under Google's policy.
Because they're strictly necessary, we don't ask consent for these items.
11. Data protection officer (DPO) and contact
Contact for privacy and for the ANPD: support@awayproof.com (interim).
12. Changes to this Policy
We may update this Policy. For material changes (for example, a new provider receiving personal data, or a new purpose), we'll notify you in the app or by email before they take effect, and the date at the top will change.