Privacy policy

We are the data controller for personal data collected through ohana.place and the ʻOhana app.

Your account. Your email address, name, and password (stored only as a secure hash) or passkey, to create your account and let you sign in, including by one-time sign-in link. Legal basis: contract (GDPR art. 6(1)(b)). Your sign-in sessions, including the IP address and browser or device type of each session, to keep your account secure and let you see and end sessions. Legal basis: legitimate interest in security (art. 6(1)(f)). The email that carries your sign-in code names the time, device and approximate place (city and country, looked up from the IP address with DB-IP Lite) of the request, so you can spot a request that was not yours. We do not store the IP address for this. Your profile photo, home country, home airport and cover colour are optional and personalise your Passport and your suggestions. Legal basis: contract.

Your travel profile (the Moment and your Passport). Your answers to the Moment questions: who you travel with, age range, pace, budget, dates, how long a flight you are happy with, moods, interests, and your own words where you answer in free text or by voice. We use AI (section 4) to turn your free-text answers into preferences such as places you love and things you want to avoid. The countries you have visited, lived in or want to visit, the year of each visit you record, and the regions you mark as visited, such as Alaska or Scotland. Purpose: building your traveller profile and personalised suggestions. Legal basis: contract. If you start the Moment before creating an account, your answers are kept on an anonymous session linked to a cookie on your device. If you then create an account, they are linked to it. We also turn your profile, the places you save and the places you mark “not for me” into a numeric summary of your taste, made with Mistral AI in the EU (section 4), so suggestions can match places by what they are like. It is deleted with your profile.

Travel needs (special category data). Mobility or accessibility needs and dietary requirements (for example a wheelchair, a severe allergy) can reveal information about your health. We only store them if you give explicit consent (GDPR art. 9(2)(a)) when you enter them, and we record when and to which version of the consent text you agreed. The same applies when the Moment recognises a health or mobility reason in one of your free-text answers (for example, that your health is what stops you travelling somewhere): without your consent we keep neither that reason nor the answer it came from. We ask you not to write other health details in free-text answers. We use travel needs only to make suggestions that fit you. They are never shared with other people, including people you plan a trip with, and are not shown to Hoku when Hoku helps a trip collaborator. You can withdraw consent at any time in Passport > Tune your interests > Travel needs; the information is then deleted.

Lists, trips and plans. Places you save, lists and notes you write, trips and itineraries you create, and your reactions to places, including how you rate places you have been to. Your rating is private to you. Once at least five travellers have rated the same place, we show that place's totals (how many said worth it, okay or not worth it) on the place, never who. We also record which places you view and interact with, to improve suggestions. When we suggest a trip and you give it a thumbs up or down, we store that rating with your account, together with a short snapshot of what the trip was like (its moods, themes and place tags, its country and month) and, if you pick one, your reason for a thumbs-down (too far, wrong time of year, not my kind of place, or been there), so your suggestions can learn from it. A suggestion rating is private to you, only your own suggestions use it, and you can take it back at any time. Legal basis: contract.

Booking emails you forward (optional). If you ask for one, you get a private address on trips.ohana.place. When you forward a booking confirmation (a flight, train, bus, ferry, hotel or car hire) to it, we read the dates, times, places, operator, booking number and booking reference from it, first from the booking data many airlines and hotels put in their emails and otherwise with our AI system (section 4), and add them to your trip. A booking is added on its own only when the email comes from your account's email address and fits exactly one of your trips; anything else waits in your Library for you to place or dismiss. We do not keep the email or its attachments: we keep a receipt (who sent it, the subject and when) for 30 days, and the bookings we read from it. Lettermint, which receives the email for us (section 5), deletes it after 28 days. Bookings you have not added to a trip are deleted after 30 days. If you take a new address, mail to the old one is no longer read. Legal basis: contract.

Places you add yourself. When you add a place we don't have to a list, we keep its name as you typed it and the part of the map you were looking at, and look it up in open map data: first in a copy of Overture Maps on our own servers, then, if it is not there, with OpenStreetMap's Nominatim service (see section 5). If we find it, we keep its location and address from that data with your list. We also count how many travellers added each place we don't have, to decide which places to add to ʻOhana; that count never shows who added a place or what they typed. Only you see your own places. Legal basis: contract.

Journal. Entries you write, photos you add, moods and linked places. If you choose to add your current location to an entry, your device shares your position with us once for that entry; we use it to show nearby places, the weather and the place name, and store it with the entry. We never track your location in the background. Photos are re-encoded on your device before upload, which removes hidden metadata such as GPS tags. Legal basis: contract.

Hoku, your AI travel companion. When you chat with Hoku, your messages and the relevant parts of your travel profile (such as pace, moods, your Moment answers, saved places and, only with your consent, travel needs and your own words from the Moment's story questions and what you said about the people you travel with) are sent to our AI system to produce an answer. Conversations are not stored: they live only on your screen and disappear when you reload. We keep only a technical record that a conversation happened and how many messages it had. Hoku may offer to remember a preference you mention, such as something you want to avoid. Your travel profile changes only when you tap to add it, and you can change or delete it in your Passport. Legal basis: contract.

What Hoku remembers. If you have an account, Hoku keeps short notes from your own messages so it does not have to ask again, for example that you prefer small hotels or are planning Japan in spring. After each message our AI system (section 4) writes at most three notes, from your message only, never from Hoku's replies. Once a day the notes are tidied: notes that say the same thing are merged, a note that a newer one contradicts is marked as no longer true and kept with its date, and a short summary is written for Hoku to read before a chat. A note about your health is kept only with your travel needs consent, is never put in the summary, and is deleted when you withdraw that consent. Other special category data (such as religion or politics) is never kept. You can see, keep and delete each note, delete them all, or switch memory off in Passport > Tune your interests > What Hoku remembers. Notes are included when you download your data and are deleted with your account. Legal basis: contract; for health notes, your explicit consent (art. 9(2)(a)).

Payments. When you buy a trip plan or the Aloha Pass, you buy it from Paddle (Paddle.com Market Ltd, United Kingdom), our reseller and merchant of record. Paddle handles the payment, invoicing, taxes and refunds, and processes your payment details and billing information as an independent controller under its own privacy policy. You enter your payment details with Paddle; we never receive your card number. We receive from Paddle what we need to give you what you bought: your email, the product, the amount, the payment status and Paddle's identifiers for the order and any subscription. Legal basis: contract, and legal obligation for bookkeeping (art. 6(1)(c)). To prevent payment fraud we flag unusual purchase patterns on accounts. Legal basis: legitimate interest in preventing fraud (art. 6(1)(f)).

Ambassador links. If you arrive through an ʻOhana ambassador's link, we count the click for that ambassador. We store nothing on your device for this and do not record who you are.

Emails. Service emails (sign-in links, password reset, trip invitations, itineraries you send yourself) are part of the service. News and updates only if you tick the box to receive them. Legal basis: consent (art. 6(1)(a)). You can withdraw at any time via the link in every email or in Passport > Settings & account > Privacy. We keep a record of each time you turn them on or off and the wording you agreed to, until your account is deleted.

Waitlist and newsletter. If you joined the waitlist before launch: your email, browser language, optional first name, optional answers (where you live, dream destinations, who you travel with) and a one-way hash of your IP address for abuse prevention. The newsletter in the site footer keeps your email, browser language and the same hash. Unsubscribing deletes it. Legal basis: consent, and legitimate interest for abuse prevention.

Measuring use, without cookies. We measure how the site and app are used with our own software, in our own database. It sets no cookies and stores nothing on your device. To tell visits apart we make a short code from your IP address, browser and the site, mixed with a secret that changes every day and is deleted after two days. We never store your IP address, so tomorrow you are a new visitor and we cannot follow you from one day to the next. We record which pages and places you open, links you follow out of the site, which site sent you, campaign tags in the link, your device type, browser and operating system, and the country and city your IP address points to. If you are signed in, this is linked to your account so we can see how the product is used and improve it (for an ambassador, to the ambassador profile). We send no name or email. Discover search terms are stored as typed, because searches that find nothing show us which places to add. We do not measure you if your browser sends Global Privacy Control, and we filter out bots. Raw events are kept for 13 months, then deleted; only totals that cannot be traced to you are kept after that. Raw events linked to your account are deleted when you delete your account. Legal basis: legitimate interest in running and improving the service (art. 6(1)(f)). IP geolocation by DB-IP, licensed under CC BY 4.0.

Analytics before 30 September 2026, and error monitoring. Until 30 September 2026 we used OpenPanel, self-hosted on our own servers, to count page views and feature use; for signed-in travellers that use was linked to their account id, with no name or email. We have switched it off. The events it had collected have been deleted; no copy is kept. No advertising trackers, ever. We use GlitchTip, self-hosted on our own servers, to catch errors. It is configured not to collect personal data, and we strip URLs and identifiers before errors are stored. Legal basis: legitimate interest in running and improving the service (art. 6(1)(f)).

• Trip collaborators you invite by email see the itinerary, suggestions and votes, and your name. They never see your travel needs.
• Links you choose to make: you can make a public link to a postcard, a trip plan, a trip recap, a mood reel, your year in travel or a country stamp. Anyone who has the link can open that one page, without an account. It shows what you chose to share (for a postcard: the photo you picked, your message, your first name and the place; for a plan: its title, your first name, the places on it day by day with a photo and a line about each, and how many nights it is, but not your dates, and not any stop you added by hand, such as a flight; for a trip recap: up to three places you rated worth it with their photos, the trip's place, length and counts, your first name, and, only if you switch it on, a line showing how your journal moods moved, never your journal text; for a reel: your first name, the trip's name and the moments you pick one by one, each as a photo, a place name and a mood, never your journal words, dates or coordinates; for a year in travel: the year, and only the counts and names you tick in the dialog, namely your number of trips, nights away and countries stamped that year, up to five places you hearted that year, and your first name; for a country stamp: the country, the year on the stamp, whether your journal confirms it, and your first name only if you tick it) and nothing else from your account. A year link never includes your travel needs, your home country, dates finer than the year, or your journal. A plan link is a snapshot of the plan when you made it, and a year link is frozen when you make it; you can turn all your year links off from Share my year in your Passport. A stamp link is frozen when you make it; you can turn all your stamp links off from Share on any stamp in your Passport. A signed-in visitor can copy the places of a plan link into their own library, as a new plan of their own; nothing else is copied (not your dates, notes, prices, stops you added by hand or your name), and turning the link off later does not take back a copy already made. The link is a long random address that cannot be guessed, and we store only a one-way hash of it. You can turn every link for a trip off from that trip at any time, and it stops working (an image already loaded by someone's browser or a link preview can linger for a few minutes). Links also stop when you delete the trip or your account. The page sets no cookies. Whoever you send a link to can pass it on, so share it as you would a photo.
• Emailing a postcard: each recipient gets their own email with a link to their own copy of the card, from hello@ohana.place, with your address as the reply address. If you type a recipient's name and country, they are printed on the address lines of that person's card and kept with its link until the link is turned off. We use their email address only to send the card and do not store it.
• When a link brings someone to ʻOhana: if a visitor opens ʻOhana from your link and then creates an account, we record that they came from your link so we can credit you. Only ʻOhana staff can see this. The visitor is not told who sent it, and you are not told who joined.
• There are no public traveller profiles.

All AI features (Hoku, turning your Moment answers into preferences and a summary of your taste, reading booking emails you forward, place descriptions) run on Mistral AI models hosted in the EU (France). We do not send your data to AI providers outside the EU.

AI is used to personalise suggestions. It does not make decisions with legal or similarly significant effects on you.

We use a small number of processors under data processing agreements (GDPR art. 28). They may only process your data on our instructions.

To name the town a journal entry was written in, our servers send its location to Geoapify, rounded to about a kilometre, since only the town or city is needed. The weather at a location comes from our own weather server, which runs Open-Meteo's open-source software on our servers at Hetzner in Finland, so those coordinates never leave our servers.

Others who may receive data. Paddle receives what it needs to sell you a plan (section 2). Professional advisers, such as our accountant, may see what a specific task needs, under a duty of confidentiality. We disclose data to authorities only when the law requires it.

Routes and opening hours. To work out walking and driving times and the climb between the stops of a trip day, our servers send the coordinates of those stops to Geoapify (KEPTAGO LTD, Cyprus), through its EU endpoint, api-eu.geoapify.com, so the processing stays in the EU/EEA. Geoapify receives no place names and nothing about your account. Opening hours come from GuideDanmark and OpenStreetMap, and we keep them with each place; collecting them sends only details of the place, never anything about you. For a stop with no hours kept, our servers read OpenStreetMap data on our own Overpass server.

Fact checks. Before we show a place, our servers look it up with Linkup (Linkup Technologies SAS, France) to check its name, address and other public facts against the web. Linkup receives only details of the place, never anything about you or your account. Linkup may process these searches in the EU, the US, Canada or Asia-Pacific.

Places you add yourself. When a place you added is not in our copy of Overture Maps, our servers send its name as you typed it and the part of the map you were looking at to Nominatim, run by the OpenStreetMap Foundation in the United Kingdom, to find it. Nominatim receives nothing about you or your account; it sees our server's address, not yours.

Maps. Map tiles are loaded by your browser directly from OpenFreeMap, run by Hyperknot Software Kft. in Hungary, which may serve them through Cloudflare. Like any service your browser loads content from, it receives your IP address and the part of the map you are looking at, but nothing else about you; OpenFreeMap says it does not log IP addresses. Place photos are taken by ʻOhana ambassadors and served by ʻOhana, or come from the sources we import places from: Wikimedia Commons and GuideDanmark. Your browser loads those imported photos directly from that source's servers, and the photos on the welcome page directly from Unsplash. Each of them receives your IP address, your browser's standard request details and our site's address (not the page you are on), but nothing else about you. A few country pictures are illustrations created with AI, and are labelled as such.

Your data is stored in our own database on servers in the EU (Finland), with encrypted backups in France. Our internal alerting provider (Slack) is in the US and receives no personal data about travellers. Linkup may process place searches outside the EU, but receives no personal data about you. Nominatim, in the United Kingdom, receives only the name and map area of a place you added yourself. Paddle, in the United Kingdom, receives your payment details directly as an independent controller; the UK is covered by an EU adequacy decision. If any other transfer outside the EU/EEA is ever needed, it will be under EU-approved safeguards such as standard contractual clauses or the EU-US Data Privacy Framework. We protect your data with encryption in transit (HTTPS) and for backups, access limited to the people who need it, and limits on wrong sign-in attempts.

Deleting your account: Passport > Settings & account > Privacy > Delete account. You are signed out at once and your account is hidden. After 14 days we permanently delete your account, profile, travel needs, Moment answers, lists, place ratings, suggestion ratings, what Hoku remembers, journal and photos, forwarded bookings, and your sessions. Trips you created and bookings you paid for are kept only as anonymous records, without your notes, descriptions, booking references or flight numbers, because of bookkeeping rules and because trip collaborators may still use the plan.

We only use cookies and device storage that the service needs. No advertising or cross-site tracking cookies. The full list is in our cookie policy.

You can at any time:

• access your data and export it (in Passport > Settings & account > Privacy, or write to us for anything not in the export)
• correct it (most of it directly in your Passport)
• delete it (section 7)
• restrict or object to processing based on legitimate interest
• withdraw consent (marketing emails, travel needs) without affecting processing before withdrawal
• port it to another service

Write to privacy@ohana.place; we reply within one month. If a request is complex, we can take up to two more months, and we tell you within the first month if we do. You can also complain to the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk), though we would appreciate the chance to fix things first.

ʻOhana is for people aged 13 and over. When you create an account you confirm you are at least 13, and we keep a record of when you confirmed it. If we learn that a child under 13 has created an account, we delete it.

If you are an ʻOhana ambassador, we also process: your public profile (name, bio, photo, places and guides you share); place lists you upload (processed with our AI and Google Places to match them to real places); for each file you upload, a record of its name, type and size, a fingerprint of its contents, the rights statement you confirmed and when, to show that the places, texts and photos were shared with the right to share them (legal basis: legitimate interest; the record is deleted when your ambassador account is deleted); photos you add to your places, which are shown publicly with your name as the credit and are re-encoded on your device before upload, which removes hidden metadata such as GPS tags; your payout details (IBAN or account number, stored encrypted and visible only to our finance staff); your tax information (CPR or tax ID stored encrypted, VAT number); and your earnings and payouts. Legal bases: contract, and legal obligation for tax and bookkeeping. Payout and tax records are kept 5 years after the end of the financial year. Before inviting new ambassadors we may look at public social-media profiles; we use only publicly available information and delete it if you are not interested. Legal basis: legitimate interest.

We do not sell, rent or trade personal data. Not anonymised, not aggregated, not to anyone. This is a founding commitment of ʻOhana: subscriptions are our only revenue.

If this policy changes, we update this page. For changes that materially affect you, we tell you by email before they take effect. Previous version: 30 July 2026 (pre-launch waitlist).