Privacy
What we collect, and what we don't
TREYN holds your travel history. That is about as personal as a dataset gets, so this page is written to be read rather than to be defensible.
Last updated 22 October 2026 · TREYN
The short version
- Your archive is private by default. Nothing is shared until you choose to share it.
- We never sell your data, and we never use it to build advertising profiles.
- We never use your travel data or mailbox contents to train AI models.
- We count trips across everyone, in totals that never name anyone, to improve TREYN. Those totals stay inside the team.
- You can export everything and delete everything, on any plan, at any time.
Who is responsible
TREYN is run by Nurten Yıldız, an individual developer in Türkiye. She is responsible for the personal data described on this page: the data controller (veri sorumlusu) under Türkiye's data protection law, KVKK, and the controller under the GDPR. "We" on this page means TREYN. Write to privacy@treyn.app about anything here.
What we hold
Your account
An email address, a display name if you set one, your language and time zone, and an import address we generate for you. That address is random and can be replaced at any time from the app.
If you ask for early access
The name and email address you give, whether you want updates, and any social handles you add as a creator. We keep them to send your beta invitation, and, only if you ticked the box, news about TREYN. Ask us and we delete them; once the app is public, the list is deleted.
Your trip archive data
Journeys, legs, stays, operators, service numbers, classes, seats, dates and places - whatever was in the emails and documents you sent us, as you confirmed it, and anything you typed in yourself. We call this your trip archive data. It is processed to keep your archive and show it back to you, and, in totals that name no one, for the counting described below. Each field also carries where it came from and how confident we were, which is what lets the app show you exactly which values still need checking.
Booking references are stored under a keyed digest rather than in the clear, so they can be matched against each other without being readable in the database.
Documents you send
The original file or email you forwarded. Raw originals are deleted 30 days after you confirm the draft unless you tell us to keep them. The structured record we extracted stays in your archive until you delete it.
Technical logs
Request logs with personal fields reduced, kept for 30 days for debugging and abuse investigation. Financial records are kept for the period the law requires.
Gmail, in plain terms
If you connect Gmail, Google asks you to grant the gmail.readonly scope.
Here is the part most apps leave out:
That scope grants read access to your entire mailbox. We search only for travel confirmations, but our search narrows what we look at - it does not narrow what Google granted. There is no permission that says "only travel emails". Anyone who implies otherwise is describing something that does not exist.
What we actually do with it:
- We query for messages matching known travel senders and subjects.
- We read only the messages that query returns.
- We keep the extracted travel record, and the message body only for as long as the import needs it.
- We do not read, index or retain the rest of your mailbox.
- We do not use any of it for advertising, profiling, or training AI models.
TREYN's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke our access at any time from the app or from your Google account permissions page.
Who else touches your data
We use third parties to run the service. Each one only receives what its job requires:
| Who | What for | What they see |
|---|---|---|
| Anthropic, our AI partner | Reading booking documents | The document text you sent for extraction |
| Our email provider | Receiving forwarded mail | Messages you forward to your import address |
| Our hosting and database provider | Running the service | Encrypted storage of everything above |
| AeroDataBox | Filling in a flight from its number, and looking up an aircraft | The flight number and date, or the aircraft's registration. Nothing about you |
| App marketplaces | Subscriptions and wallet passes | Purchase records. They never see your travel data |
Reading a booking sends the text of that email or document to Anthropic, the company that makes the Claude model. The app asks for your permission before the first one is read; until you give it, bookings you forward are kept, unread. You can withdraw it in the app at any time. Anthropic is not permitted to train on your content.
Counting, without naming you
We count trip archive data across all accounts to see how TREYN is used and where to improve it: for example, which cities and hotels come up most often in a year, which routes people take by air, rail, road and sea, and which classes they travel in.
- The totals stay inside the TREYN team. They are not sold, published, or used for advertising.
- They never show a name, an email address, a booking reference or an import address.
- A figure that fewer than 10 travellers contribute to is left out, so that no one can be picked out of it.
- Delete a record, or your account, and it is gone from every count made after.
The same holds when you type a flight number and TREYN fills in the rest: it uses your own earlier flights on that number, or the route and usual times that the bookings of at least two other travellers agree on. It never shows who flew, and never uses the records of anyone who objected. If neither knows the flight, AeroDataBox is asked, with only the number and the date.
We do this on the basis of our legitimate interest in running and improving the service. You can object at any time by writing to privacy@treyn.app, and we will leave your records out.
Where your data lives
TREYN operates from Türkiye and serves users in the EU and elsewhere, so data is transferred internationally. We rely on the transfer mechanisms required under KVKK and, for EU users, the GDPR. Choosing a cloud region does not by itself satisfy those obligations, and we do not pretend it does.
Your rights
- Export. Everything you have confirmed, as one JSON file, from the app. On any plan, including the free one.
- Correct. Any field, at any time. Your correction is never silently overwritten by a later sync - a conflict is shown to you.
- Delete. A single record, or your whole account. Account deletion removes your records, files, connection grants, shares and card.
- Object and restrict. Write to us and we will act on it.
Deleting your account is not the same as cancelling your subscription. Subscriptions are managed by the app marketplace you bought them from and must be cancelled there. We show you how to do both, and we will not use one to quietly extend the other.
What we will never do
- Sell your data, or share it with data brokers.
- Turn your archive into an advertising profile.
- Ask for your password to a booking site. You sign in on the provider's own screen.
- Publish anything from your archive without you choosing to.
- Lock your records behind a payment. If you stop paying, your archive stays readable and exportable.
Children
TREYN is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
If this policy changes in a way that affects how your data is used, we will tell you in the app before the change takes effect - not by quietly editing this page.
Contact
Privacy questions and data requests: privacy@treyn.app. We answer within 3 business days, usually much sooner.
Where place names come from
Towns and cities: GeoNames, licensed CC BY 4.0. Airports: OurAirports, public domain. Railway stations, bus stations and ferry ports: Wikidata, CC0. All three are used inside TREYN to put your records on the map; nothing about you is sent to any of them.