Privacy policy

Updated November 7, 2026.

Your chat and imagined trip are processed on your device. Apple Maps receives destination searches when you open Explore. Firebase receives crash diagnostics and a fixed set of app-usage events, without your conversation or travel details. There are no accounts, ads or cross-app tracking.

Your conversation and postcard

PencilTrip saves your current conversation and trip profile in local app storage: destination, departure city, party counts, activity preferences, pace, dates and budget. Its sketch is rendered on your iPhone. On supported devices, Apple's Foundation Models framework interprets travel details using the on-device Apple Intelligence model. Guided mode uses local interview rules when the model is unavailable. The app does not send your conversation to an external travel-AI service or a custom backend.

Apple Maps and travel websites

Opening Explore sends the destination or place query to Apple Maps to find hotels, airports and activities. PencilTrip does not request your device's current location or send your chat, party details or budget with these searches. Selecting a map or airline link opens that provider's website or service, which processes your request under its own privacy practices. Airline directory entries are bundled from Wikidata's public-domain structured data. Results do not confirm availability, routes or prices. See Apple's privacy policy.

Sharing

The share sheet sends a postcard only to the destination you deliberately choose. Shared images can reveal the scene, destination and party shown on the postcard. The receiving app or service then handles that content under its own practices.

Crash reports

PencilTrip uses Firebase Crashlytics for crash reports and bounded nonfatal diagnostic codes. Reports may include a random installation identifier, device model, operating-system and app versions, crash time, stack traces, and names of recent fixed app events. They do not include chat text, destinations, names, dates, budgets, party descriptions, activity preferences or drawing content. Google states that Crashlytics retains crash traces and associated identifiers for 90 days before beginning deletion from live and backup systems. Firebase privacy information.

Basic usage analytics

Firebase Analytics receives only this fixed app-event catalog, without free-form parameters:

• app_opened
• interview_started
• interview_turn_completed
• trip_detail_added
• sketch_updated
• intelligence_fallback
• places_requested
• places_loaded
• places_failed
• places_opened
• postcard_shared
• trip_reset

Firebase also collects automatic app-session and first-open events, installation identifiers and device/app metadata. An approximate region may be derived from the network connection; no Location Services permission is used. Advertising identifiers (IDFA and IDFV), ad storage, ad personalization, user-ID assignment, automatic screen reporting and cross-app tracking are disabled. The app does not sell data or include advertising. It does not send chat text, destinations, departure cities, dates, budgets, party composition, preferences, names, email addresses, precise location, raw error messages or drawing content to Firebase.

App Store privacy data types

The app's collection includes coarse location derived from the network, device/installation identifiers, product interaction, other usage data, crash data and other diagnostic data. These support app functionality and analytics and are not used for tracking. No account identity is requested, but installation identifiers can associate events from the same installation. This is not a “Data Not Collected” app.

Storage, deletion and backups

Use New postcard to erase the app's saved trip and conversation. Deleting the app removes its local app storage. Device backups may retain app data until those backups are replaced; manage backups using Apple's device settings. Local deletion does not recall a postcard you shared, remove a provider's records or delete telemetry already sent to Firebase. Reports and events already submitted follow Google's retention and deletion practices. The app currently has no in-app switch for crash reporting or basic analytics.

Children

PencilTrip is a general travel-planning prototype intended for adults, not a children's service. The app can describe children traveling in a party, but does not need their names or identifying information. Please avoid entering sensitive personal details.

Support and privacy questions

Contact us at support@nshortn.com. If you email us, we receive your email address and whatever you choose to include so we can respond. Do not send passwords, payment details or sensitive travel documents.

This support website

These pages are served by Cloudflare, which processes standard request information such as IP addresses and user agents to deliver and protect the website. See Cloudflare's privacy policy. These pages use a reviewed first-party analytics script and Cloudflare Web Analytics. Our script counts page views and fixed App Store or download click categories using known page groups, without query strings, fragment identifiers, app content or arbitrary link destinations. It uses no cookies, browser storage, advertising identifiers or persistent visitor IDs, and respects Global Privacy Control and Do Not Track. The server derives a site-specific daily visitor estimate from a daily changing hash of network information; raw IP addresses and user agents are not stored in analytics records, and estimates are not linked across days, websites or app installations. Cloudflare separately measures page views, referring sites, country, browser/device categories and page-load performance. Website analytics is separate from the app's Firebase data. The website does not show ads. See the website privacy notice and Cloudflare Web Analytics documentation.

Policy changes

We update this policy and its date when the app's data practices change.