Privacy Policy

Effective October 15, 2026 · Applies to Travel Transit Manager at trips.moudle.net

Travel Transit Manager ("the app", "we") is a personal travel-organising web app operated at moudle.net. This policy explains what information the app collects, how it is used, where it is stored, who it is shared with and how you can delete it. It gives particular detail on information received from Google APIs.

1. Information we collect

From your Google account

We do not request access to Gmail, Google Drive, your contacts or any other Google service.

Information you give us

• Booking confirmation emails that you forward to your personal import address. We extract the trip details: passenger names, booking reference, departure and arrival points, dates and times, service numbers, seat, class, fare and payment method (card type and last four digits only).
• Settings and labels you create, such as notification preferences, trip tags and the email addresses of the people you want invited to calendar events.
• Travel provider account connection (optional). If you link your travel provider account so the app can find your bookings, the access token for that link is kept on the sync service you control and is used only to read your trips.

Information collected automatically

• Live status of your trips (departure and arrival times, delays and seat availability), taken from public schedule and status sources.
• Basic service logs (time of request, the feature used, any errors). We keep these for security and troubleshooting.

2. How we use information

We use your information only to provide the features you see in the app:

• showing your trips, history, receipts and seat maps;
• sending you trip notifications, such as booking confirmations, delays, schedule changes and seat alerts;
• keeping calendar events for your trips up to date, if you have connected Google Calendar;
• keeping the service secure, preventing abuse and fixing errors.

We do not use your information for advertising. We do not build marketing profiles and we do not sell your data.

3. Google user data

Specifically:

• Access. With the Calendar permission, the app only creates, updates and deletes the events it made for your trips. It does not read, copy, change or delete any other event in your calendar.
• Use. Google user data is used only to provide the sign-in and calendar features described above. It is never used to serve ads, including retargeting, personalised or interest-based ads.
• Transfer. Google user data is not sold. It is not shared with advertising platforms, data brokers or information resellers. It is transferred only where the feature needs it (see section 5), to comply with law, or as part of a merger, acquisition or sale of assets, and in that case only after we notify you.
• Human access. No person reads your Google user data unless you ask us to (for example, for support), it is needed for security purposes such as investigating abuse, or the law requires it.
• AI and machine learning. Google user data is not used to develop, improve or train any artificial intelligence or machine learning model, whether general or personal.
• Credit and lending. Google user data is never used to decide creditworthiness or for lending.

4. How we store and protect information

• Data is stored with Amazon Web Services (AWS) in the United States (us-east-1 region). It is encrypted in transit (HTTPS/TLS) and at rest.
• Your Google Calendar authorization token gets an extra layer of encryption with a key that is unique to your account. Only the calendar feature decrypts it, and only to update your trip events.
• Each account's data is kept separate. Every request is checked against the account that is signed in.
• Access to the production systems is limited to the operator and protected by multi-factor authentication.

5. How we share information

We share information only in these cases:

• People you invite. When you add guests to a tag's calendar invites, Google Calendar sends those people the event details for the matching trips. You choose who they are and whether booking details are included.
• Service providers that run the app for us under contract: Amazon Web Services (hosting, storage and sending email) and Google (sign-in and Calendar). They process data only to provide their service.
• Legal reasons: to comply with a valid legal request, or to protect the safety, rights or security of users or the service.

6. Retention and deletion

• Forwarded emails are deleted automatically within 7 days, once your trip details have been extracted.
• Trip records stay in your account until you delete them or close your account.
• Service logs are kept for up to 30 days.
• Disconnecting Google Calendar in the app's settings deletes the stored calendar token straight away. You can also remove the app's access at any time at myaccount.google.com/permissions. Once access is removed, the app can no longer change your calendar.
• Closing your account: email privacy@moudle.net from your account's email address. We will delete your account, trips, settings and tokens within 30 days. Encrypted backups expire within a further 35 days.

7. Your choices and rights

You can view and edit your trips and settings in the app, turn notifications off, disconnect Google Calendar, and ask for a copy of your data or for it to be deleted. Depending on where you live, you may have further rights under local law, such as the CCPA or GDPR. To use them, contact us at the address below and we will respond within 30 days.

8. Children

The app is not meant for children under 13 (or under 16 where local law sets a higher age). We do not knowingly collect their information.

9. Changes to this policy

If this policy changes, we will update the effective date above. If a change affects how Google user data is used, we will tell you in the app or by email, and ask for your consent before the change applies.

10. Contact

Travel Transit Manager, moudle.net
Email: privacy@moudle.net