Privacy

Last updated 29 September 2026

Voolo is a map of travellers. That only works if people can trust what it knows about them, so this page is written to be read rather than to be defended.

The short version

• Voolo asks for coarse location, roughly neighbourhood level, and never your exact position.
• Other travellers see the area you are in, not where you are standing.
• Voolo does not continuously track your movements or sell personal information. Trip places and service lookup records are explained below.
• You can request account deletion in the app or on our account-deletion page. Shared records are minimized as explained below.

What we collect

Things you give us

• Your account and profile. Sign-in details supplied through email and password, Google or Apple authentication, an optional phone number supplied for profile verification, an account identifier, a display name, gender and a confirmation that you are 18 or over. Your photo, bio, interests, languages and other profile preferences are optional.
• Things you contribute. The trips you plan or join, messages, notes and photos you share, and expense amounts, shares and settlements you log. Other participants can see the records you share with them.
• Things you report. If you report somebody, we keep what you sent us so we can act on it.

If you asked to be told about the launch

The form on this website stores your email address and the country the request came from, and nothing else. The country is what decides which region we open next. We write to you once, when Voolo reaches you, and you can have the address deleted at any time by asking at hello@voolo.in.

Things your phone gives us

• Coarse location, only while the app is open, and only after you allow it. Voolo requests reduced accuracy from the operating system, so it does not receive your precise position even if you wanted to give it.
• Device and connection information: model, operating system and app versions, IP addresses, installation or app-instance identifiers, and push-notification tokens. These support sign-in, security, configuration, notifications, diagnostics and usage measurement. A notification token registered to your account is linked to that account.
• Usage and diagnostic information: app interactions, crash reports and technical performance information collected by Firebase and Google Maps as described below. Analytics can derive approximate geography from connection information.

Things we deliberately do not collect

• Your precise location, at any time.
• A continuous history of your movements. We do keep the places you add to trips and account-linked place-lookup records used for service quotas and abuse prevention.
• Your contacts, your photo library beyond a photo you pick, or your calendar.
• Card or bank details. Voolo never holds money, so it never needs them.
• Identity documents. A phone-verification badge indicates phone verification, not identity or background verification.

What other travellers can see

Your display name, your photo, your verification badge, the approximate area you are in, and a rounded time since you were last active. Your phone number and email address are never shown to another traveller. You can restrict who sees you, or take yourself off the map entirely, in Settings.

Why we hold any of it

• To run the thing you asked for: showing you nearby travellers, carrying your messages, keeping a trip plan in sync.
• To keep people safe: acting on reports, blocking abuse, enforcing the age requirement.
• To keep the app working: diagnosing crashes and errors.
• To tell you things you asked to be told, such as when Voolo opens in your country.

Where the law asks for a legal basis, it is your consent for location and for email updates, the performance of our agreement with you for the rest of the service, and our legitimate interest in keeping the community safe for moderation.

Who else sees it

Google Firebase and Google Cloud provide sign-in, hosting, storage, messaging, configuration, diagnostics and other infrastructure. Google Maps and Places provide maps and place search. These services receive the information needed for the features and their SDKs; Google Analytics has additional uses explained below. Authorities may receive information where a valid legal process requires it. We do not sell personal information or run ads in Voolo.

If you open paid-plan options or make or restore a purchase, RevenueCat and the purchasing store process your Voolo account identifier, purchase records, subscription status and the device or connection information needed to complete and validate purchases. RevenueCat helps us keep access consistent across your devices and provides purchase analytics, such as subscription revenue, renewals and cancellations. We do not send it your profile text, messages or location. Voolo does not receive your full payment-card details. Purchase records may be retained by these providers for billing, fraud prevention and legal obligations.

If you use phone verification, Firebase sends the number to Google. Google stores it and uses it to prevent spam and abuse across its services, not only Voolo. See Firebase's phone-authentication explanation.

Where it is kept, and for how long

Voolo runs on infrastructure in several countries, so your information may be processed outside the one you are in, with appropriate safeguards in place. We keep your account for as long as it exists. Accepted new requests hide your profile immediately and have a 7-day cancellation window. Requests from older app versions retain their stated 90-day window. Signing in alone does not cancel deletion. Once cleanup starts, cancellation closes. We remove your account, personal profile/contact fields, media, private conversations and your trip messages. Authored notes are removed where recorded; hosted trips become private read-only archives with personal descriptions removed. Other members’ content and shared financial amounts remain with anonymous references so their balances still work. Older expense descriptions are minimized because those records did not identify the author. A minimal account identifier and deletion timestamps prevent old sessions from restoring an account. Reports you filed may remain for safety investigation for up to 90 days after cleanup and are not public. Cleanup usually finishes within 24 hours after the window; service failures are retried. See account deletion for the full process.

Website analytics and your choices

Google Analytics on this website is optional and off until you choose “Allow analytics”. With your consent, it receives visits to our public information pages and a successful new launch-list sign-up event. We do not send your email, phone number, form text, invite codes, URL query parameters or fragments. Trip invite pages and unknown routes do not load Analytics. Automatic form, link, scroll and site-search measurement is disabled.

Google receives connection and device information and uses first-party cookies to distinguish browsers and sessions. These records are not necessarily anonymous. Analytics cookies expire after at most 180 days; we remember your consent choice for 180 days in this browser. A successful sign-up uses a one-time boolean cookie for up to two minutes, only with consent. No advertising consent is granted, and we do not enable Google Signals or user-provided data.

Use “Analytics preferences” in the footer to decline or withdraw consent at any time. Withdrawal stops future collection and removes this site's Analytics cookies; it does not erase data already received by Google. We respect Global Privacy Control and Do Not Track. Declining has no effect on the launch-list form or app. The Google account-sharing and retention settings described below also apply to website Analytics.

Diagnostics and Analytics

Firebase Crashlytics receives crash reports and technical diagnostics. Firebase Analytics receives app interaction events, app-instance identifiers, device information and approximate geography derived from connection information. These records are not necessarily anonymous: identifiers can distinguish an installation or device. Voolo does not set a custom account ID in Analytics or Crashlytics, or deliberately attach your messages or profile text to events.

Diagnostics is on by default in production and can be turned off in Settings. Turning it off stops future Firebase Analytics and Crashlytics collection and deletes unsent crash reports. It does not disable services needed to run the app, or Google Maps telemetry. Voolo disables Analytics advertising-ID collection and ad-personalisation signals; Google Signals is off and Voolo's Analytics property is not linked to Google Ads.

Our Analytics account enables sharing with Google for its products and services. Google can use that Analytics data to understand trends and improve its products, including Google Ads tools, and acts as an independent controller for that use. Aggregated modelling and business insights, technical-support access and account recommendations are also enabled. These uses go beyond supplying analytics solely on Voolo's behalf. SeeGoogle's data-sharing explanationand Google's privacy policy.

Voolo's Analytics retention settings are two months for event data and fourteen months for user-level data, with the user retention period reset by new activity. These settings do not determine every Google service's retention period or retention of aggregated reports. Turning Diagnostics off or deleting a Voolo account does not automatically erase all data already held by Google. We do not currently run a separate per-user purge of vendor telemetry. Contact us about access or deletion requests using the address below.

Maps and searching for places

Google Maps collects its own SDK identifiers, connection and device information, map interactions, and crash and performance information to provide and improve the map service. This is separate from the Firebase Diagnostics switch. The app requests approximate location; presence sharing uses a rounded neighbourhood cell rather than your exact position.

Place searches pass through Voolo's Firebase service, which can receive your sign-in context. It sends Google Places the search text, a random search-session identifier and approximate search area. It does not forward your Voolo account ID or name to Places. Selecting a place sends its place identifier; committing a place to Voolo also creates an account-linked lookup record with the selected place and time for quotas and abuse prevention. This is not a continuous location history. Google processes Maps and Places data under its applicable service terms and privacy policy.

What you can ask for

A copy of what we hold, a correction, a deletion, or an objection to a particular use. Account deletion is in the app under Settings. If you cannot use the app, follow ouraccount-deletion request process. For anything else, write to hello@voolo.in and we will reply within 30 days.

Age

Voolo is for adults. You must be 18 or over to hold an account. If we learn that an account belongs to somebody younger, we close it and delete what is attached to it.

Changes

If this page changes in a way that matters, we will say so in the app before the change takes effect, rather than quietly changing the date at the top.

Contact

hello@voolo.in for anything on this page, andsafety@voolo.in if somebody is at risk.