Privacy Policy

Effective 26 October 2026

The short version

We collect what Onz needs to plan trips with friends: your account, your trips and, when you allow it, your location.
Your trips are shared only with the people you invite to them.
Live location is sent only while you choose to share it, goes only to your tripmates and is never stored.
We don't sell your data, and we don't use it for advertising or tracking across other apps.
You can delete your account and data at any time from Account → Delete account.

1. Who we are

Onz ("we", "us") is an iOS app for planning trips together, made by Moses Yek, an independent developer based in Malaysia. If you have any question about this policy or your data, email support@onztrip.com.

2. What we collect

Information you give us

Account: your email address, and your name and profile photo if you add them. If you sign in with Google or Apple, we receive your name and email from that service (Apple may give us a private relay address instead).
Trip content: trips, days, places, times, notes, links, votes, ratings, bookmarks and trip cover photos you add.
Reports: details you send when you report a person or content.
Support messages you email to us.

Information collected when you use Onz

Location (only with your permission): used on the device to show you on the map, find nearby places, help you check in and estimate arrival at your next stop. While a trip day is live, Onz may keep using your location in the background for these features. If you turn on location sharing, your current position is sent to the members of that trip while you have the trip open. Shared positions are passed through in real time and are not saved on our servers.
Presence: while you have a trip open, its members can see that you are viewing it.
Purchases: when you buy credits, Apple processes the payment. We receive the transaction details (product, date, transaction ID) to add credits to your account, but never your card details.
Referrals: if you join through a friend's referral, we record who referred you, and your name may be shown to that friend.
Usage and diagnostics: which screens and features are used, crash and error reports, device model and OS version, and app version. This is linked to your account so we can fix problems and improve Onz.
Notifications: a push notification token if you allow notifications, used for trip reminders and Live Activities.

Onz does not access your contacts, camera roll (except photos you pick or a recap image you choose to save) or microphone.

3. How we use it

To run Onz: create your account, save and sync trips, let invited friends join and edit them, and show who is viewing.
To send trip reminders and show Live Activities on your Lock Screen.
To process credit purchases and referral rewards.
To keep Onz safe: prevent abuse, enforce limits, and review reports.
To understand usage, fix bugs and improve features.
To reply when you contact us.

Our legal bases (where they apply) are providing the service you asked for, our legitimate interest in keeping Onz secure and working well, and your consent for location and notifications, which you can withdraw in iOS Settings at any time.

4. Who can see your information

People in your trips see your name, profile photo, the content you add to that trip, whether you are viewing it, and your live location if you share it. Organizers also see your name and photo when you request to join.
Service providers who process data for us under their own privacy and security terms:

Provider	What for
Supabase	Database, sign-in, file storage and server functions that hold your account and trips
PostHog	Product analytics and crash/error reports
Google	Google Sign-In (if you use it) and place search (search text and approximate map area)
Apple	Sign in with Apple, maps, in-app purchases, push notifications

We may also share information if required by law, to protect the safety of users or others, or as part of a sale or transfer of Onz (in which case this policy would continue to apply). We do not sell or rent your personal information.

5. Where your data is stored

Your account and trips are stored by Supabase in Singapore. Analytics and crash reports are processed by PostHog in the United States, and Google and Apple process data in their own data centres around the world. This may mean your data leaves your country; we rely on these providers' security measures and contractual protections for those transfers.

6. How long we keep it

Your account and trips are kept while your account is active.
When you delete your account, your profile, photos, votes, credits and referral records are deleted. Trips you organized are deleted; places you added to other people's trips may be removed or left without your name.
Analytics data is kept for up to 12 months. Purchase records may be kept longer where tax or accounting rules require.
Backups are overwritten within about 30 days.

7. Your choices and rights

Edit your name and photo in Account.
Delete your account in the app: Account → Delete account.
Location, notifications and Live Activities: turn them on or off in iOS Settings → Onz. Location sharing with tripmates can be turned off inside the trip.
Access, correct or get a copy of your data, or object to how we use it, by emailing us. Depending on where you live (for example under Malaysia's PDPA, the EU/UK GDPR or California law) you may have additional rights, including complaining to your local data protection authority. We will reply within 30 days.

8. Children

Onz is not meant for children under 13, and we don't knowingly collect data from them. If you believe a child has created an account, email us and we'll delete it.

9. Security

Data is encrypted in transit, and access to trips is restricted to their members at the database level. No system is perfectly secure, so please use a strong password and tell us if you notice anything suspicious.

10. Changes to this policy

If we make important changes, we'll update the date above and let you know in the app before they take effect.

11. Contact

Moses Yek, Malaysia · support@onztrip.com