DareFly Privacy Policy

Effective January 1, 2027

This policy explains what DareFly collects, why, who else sees it, how long we keep it, and what you can do about it. It is written to be read, not skimmed past. If anything is unclear, email privacy@darefly.app and a person will answer.

The short version

• We collect what you type into the app and how you use it. Nothing else.
• No location tracking, no contacts, no photos, no advertising identifiers, no third-party analytics or ad companies.
• Your taste and trip details go to one AI provider, Anthropic, to write your plan. Your name, email, phone number and passport details never do.
• Your data is stored in Canada. Deleting your account removes it, after a 30-day grace period, with two small exceptions explained below.
• We do not sell your data, and we do not share it for advertising.
• DareFly is for adults, 18 and over.

Who we are

DareFly is made by DareFly Inc., a company registered in Delaware, United States. We are the "controller" of your data under laws that use that word. Contact: privacy@darefly.app.

What we collect

1. Account. Your email address and a password. The password is stored only in scrambled (hashed) form by our sign-in provider; we never see it. A display name. If a friend invited you, their @username as your invite code.
2. Starting city. The city you pick from our list. We never read your phone's location.
3. Taste. The cards you swipe when you start, and every card you Dare, Ditch or Fly in Daydream, with the direction and how long you looked at it. From these we learn three taste weights: relaxation, adventure and educational. You can review, change or erase your recent swipes from Trips.
4. Profile answers (optional). Preferred continents, an age band (18 to 24, 25 to 34, 35 to 44, 45 to 54, 55 and over, or "rather not say"), how you like to get around, how long a flight you accept, food restrictions (vegetarian, vegan, halal, kosher, gluten-free, no street food) and accessibility needs (terrain and support). Each is a fixed choice, never free text. Food, accessibility, transport and flight answers are included when a plan is written for you, because meals, routes and pace depend on them.
5. Trips. Destination, dates, number of nights, number of travellers, budget and currency, stay style, trip purpose, and the plan itself. We keep a snapshot of your taste weights and preferences as they were when each plan was written.
6. Passport (optional). The issuing country and the expiry date, nothing else. It is used only to show the entry rules for your trip and the six-month validity warning. It stays on our own server, is never sent to the AI provider, and you can delete it any time from Profile.
7. @username and referrals. Your @username if you set one, who invited you, and the credits promised and paid for it.
8. Credits. Your balance and every credit earned or spent.
9. Usage and errors. Which screens and actions you use (for example "plan built" or "card saved") with the time. When something breaks, the screen and a shortened error text with any email addresses, web addresses and tokens removed. We never record what you type into search, any free text, or the values of your profile answers. The app also makes up a random install ID (not your phone's hardware identifier) to spot duplicate installs in referrals.
10. Plan cost records. For each plan, the model used, the number of words processed and the time taken. Never the request or the plan.
11. On your phone only. Your sign-in session, the last screen data shown, whether you have seen the gesture tips, your draft trip and your readiness checklist ticks. These clear when you sign out or delete your account.

What we do not collect

Your location, contacts, photos, camera, microphone or calendar. Advertising identifiers. We use no analytics, advertising or social-network software from other companies in the app, and we do not track you across other apps or websites. We send no marketing email. If that ever changes, it will be opt-in.

How we use it

To run the app, learn your taste, write your plans, show entry requirements, run the credits economy fairly (one person and one phone number earn each reward once), pay referrals, fix bugs and understand which parts of DareFly work. Not for advertising. No decision with a legal or similarly significant effect on you is made automatically; a plan is a suggestion you are free to ignore, and you can ask a person to review anything by emailing privacy@darefly.app.

Where the law asks for a legal basis: running the app and the credits economy is performance of our contract with you; fixing bugs, measuring what works and preventing abuse are our legitimate interests, balanced against yours; your optional profile answers and passport details are processed with your consent, which you withdraw by clearing or deleting them.

Who else sees it

Nobody else. We do not sell or rent your data, and we do not share it for cross-context advertising. We would disclose it only if the law required it, to protect someone's safety, or as part of a sale or merger of the company (in which case this policy would still apply), and we would tell you when allowed.

Where it lives and how it is protected

Our database, sign-in and photos run in Canada. Plan writing happens in the United States, email delivery in the United States, and this website is served from Cloudflare's network worldwide. For people in the European Economic Area, the United Kingdom and Switzerland, transfers rely on the European Commission's adequacy decision for Canada where it applies, on the EU-US Data Privacy Framework where a provider is certified under it, and otherwise on standard contractual clauses in our agreements with each provider.

Every row in our database is locked to the account that owns it. The AI provider's key never leaves our server. Passwords are hashed. Data travels encrypted. We keep periodic backups of the database, stored encrypted and under our own control; anything you delete leaves those backups within 60 days.

How long we keep it

For as long as your account exists, plus the deletion grace period.

Deleting your account. From Profile, tap Delete account. You are signed out everywhere and your account becomes invisible to other users. Thirty days later it is permanently deleted: your profile, swipes, taste weights, preferences, passport, trips and plans, credits, @username, saved places and usage records. If you sign in at any point in those 30 days, one tap keeps your account exactly as it was. If you can't sign in, use darefly.app/delete-account.

Two things remain after deletion: the one-way fingerprint of a verified phone number, so the number cannot earn the sign-up credits again, and the referral record with the account identifiers blanked, so the credits history still adds up. A released @username is held for seven days so nobody can take it the moment you let it go; the hold is then deleted.

Your choices

From Profile you can change your password, sign out this device, delete your passport, clear your preferences, and delete your account. From Trips you can revise or erase recent swipes.

We do not sell or share your personal information, so there is nothing to opt out of; this paragraph is the "Do Not Sell or Share My Personal Information" notice some laws require.

Your rights

Everyone, everywhere: ask what we hold about you, get a copy, correct it, delete it, or object to how we use it, by emailing privacy@darefly.app. We answer within 30 days and never charge for it. We will check it is really you, usually by replying to the email on your account.

Canada. You have the rights above under PIPEDA and provincial laws (including Quebec's Law 25, under which our privacy contact is the person in charge of protecting personal information). You can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

European Economic Area, United Kingdom, Switzerland. You also have the rights to restrict processing, to data portability, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office). Where the law requires a local representative, their details will appear here.

United States. Residents of states with privacy laws (including California, Colorado, Connecticut, Virginia, Texas, Oregon and others) have the rights above, and the right not to be discriminated against for using them. We do not sell or share personal information, we do not use sensitive information for anything beyond providing the service, and we do not profile you for decisions with legal effects. California residents may use an authorised agent by emailing from the account address or providing written permission.

Everywhere else (including Australia, Brazil, India, Japan, South Korea and Singapore): the rights above apply, and you can contact your national data-protection authority.

Age

DareFly is for people aged 18 and over. We do not knowingly keep data from anyone younger; if you believe we have, email privacy@darefly.app and we will delete it.

This website

darefly.app sets no cookies. Cloudflare serves the pages and counts visits without cookies or identifiers. The account-deletion page sends the email address you type, once, to our server to send you the link.

If something goes wrong

If a security breach puts your data at risk, we will tell you and the relevant authorities as quickly as the law requires, and no later than it requires.

Changes

We post changes here with a new effective date and tell you in the app when they matter. Keeping an account after a change takes effect means the new policy applies.

Contact

privacy@darefly.app · DareFly Inc., Delaware, United States