Kiatan
Open Kiatan
Home Features How it works Pricing FAQ Open Kiatan
Legal

Privacy policy

What we collect, why, and the control you have over it.

Last updated 6 November 2026

This policy explains what information Kiatan collects, why, who it is shared with and the choices you have. Kiatan is run from New Zealand and we follow the New Zealand Privacy Act 2020. If you are in the EU or UK, we also aim to meet the GDPR.

The short version

  • Your trips are yours. We use them only to run Kiatan for you and the people you share them with.
  • We don't sell your data and we don't show ads.
  • Travel documents you add are encrypted on your device before they are stored.
  • You can export everything or delete your account at any time from Settings.

What we collect

When you use Kiatan as a guest

Your trips are stored only on your device. We receive a random device ID, the app version, the platform (for example "web") and the fact that you're a guest, so we can count active devices and fix problems. We don't receive your trips.

When you create an account

  • Account details: your email address, name and profile photo if you sign in with Google, and an optional username (handle).
  • Trip content: trips, stops, flights, stays, activities, packing lists, budgets, reminders and notes you create, so they can sync between your devices and with people you share them with.
  • Documents: files you add to a trip. They are encrypted with AES-256 on your device. If you use cloud storage for documents, we store the encrypted file.
  • Sharing: who you invited to a trip, their role (owner, editor or viewer) and invite codes.
  • Device and usage information: device ID, app version, platform, notification token (if you allow notifications), sync times and error reports.

Community trips

If you publish a trip to Community, its title, description, region, itinerary and your handle are visible to other Kiatan users. Documents, costs you mark private and the people on your trip are never published.

Why we use it

  • To provide Kiatan: syncing, sharing, reminders, flight status, weather and exports.
  • To keep Kiatan secure, prevent abuse and fix bugs.
  • To contact you about your account, security or important changes. We don't send marketing email without your permission.
  • When paid plans launch: to process payments and manage your plan.

Who we share it with

We share only what each service needs to do its job:

  • Google Firebase: sign-in and push notifications.
  • Oracle Cloud Infrastructure: hosts our servers, database and encrypted document storage.
  • Cloudflare: delivers the website and protects it from attacks.
  • Open-Meteo: weather forecasts. It receives the place names or coordinates of your stops, not who you are.
  • Photon / OpenStreetMap: place search and the map on each stop. It receives what you type in a place field and the addresses of the places shown on a map, not who you are.
  • OpenFreeMap: map images. It receives which part of the map you're looking at.
  • Wikipedia and Wikimedia Commons: destination photos. They receive the names of the places in your trips, not who you are.
  • AviationStack: flight status. It receives flight numbers and dates.
  • Exchange-rate services (Frankfurter, ExchangeRate-API): currency rates. No personal data.
  • Paddle (when paid plans launch): Paddle is the reseller of our paid plans and handles payments, tax and invoices. Your card details go to Paddle, never to us.
  • People you share a trip with see that trip's content.
  • Authorities, only when the law requires it.

Some of these providers process data outside New Zealand. We choose providers that protect data to standards comparable to the Privacy Act.

How long we keep it

  • Your account and trips: until you delete them or your account.
  • Guest device records: up to 12 months after the device was last seen.
  • Server logs and error reports: up to 90 days.
  • Payment records: as long as tax law requires (7 years in New Zealand).

Your choices and rights

  • Access and export: Settings → Backup and restore saves a full copy of your data.
  • Correct: edit anything in the app, or ask us.
  • Delete: Settings → Delete account permanently removes your account, your trips on our servers and your cloud documents. Trips you own are removed for the people you shared them with too.
  • Notifications: turn them off in Settings or your device settings.
  • Complain: contact us first. In New Zealand you can also contact the Office of the Privacy Commissioner (privacy.org.nz).

Security

Connections are encrypted (HTTPS). Documents are encrypted with AES-256 before they are stored, and you can lock the app with a PIN. Access to our servers is restricted to the people who run Kiatan. No system is perfectly secure; if a breach puts your information at risk, we'll tell you and the Privacy Commissioner as the law requires.

Children

Kiatan isn't meant for children under 13, and we don't knowingly collect their information.

Changes

If we make important changes, we'll update the date above and tell you in the app before they take effect.

Contact

Questions or requests: [email protected].