1.Who we are
Saferni is a travel-planning service operated by Saferni and more Travel and Tourism L.L.C S.O.C (Dubai trade licence No. 1653103), based in Dubai, United Arab Emirates, at Office 607, Opal Tower, Marasi Drive, Business Bay. We are the controller of the personal data described here.
This policy covers the Saferni website (saferni.ae) and the Saferni mobile app for iPhone and Android. Where something applies to only one of them, it says so; the app section below covers what the phone itself adds.
Privacy questions, and any request to access, correct, export or delete your data: info@saferni.ae.
2.Our approach
Saferni is built so that verified data — not a language model — decides facts. That architecture also shapes this policy: we hold the trip inputs and account details needed to plan and save your trips, and little else. We do not sell personal data, and we do not use your content to train AI models.
Advertising pays for the free tier. On our public pages, and inside the website's planner for visitors who are signed out or on the free plan, we show ads served by Google. The mobile app shows no third-party ads. Paid plans are quieter by design: the Explorer plan sees a single ad on a finished plan and none while it is being written, and the Voyager plan sees no third-party advertising at all — on a Voyager account the advertising code is never loaded into your browser in the first place. The Advertising section below explains exactly what advertising means for your data and how to control it.
3.What we collect — account and identity
- Your email address, required to sign in. Sign-in is by an 8-digit code emailed to you, or by Sign in with Google — in which case we receive the name, email and profile picture in Google’s ID token, never your Google password.
- Profile details you choose to fill in: display name, avatar image, home city, passport country, and default planning preferences.
- Standing travel preferences: interests, dietary needs (which may include halal, vegetarian or vegan choices), pace, mobility needs such as step-free or limited walking, usual party size, an avoid list, and free-text notes.
- Travel documents: the type (passport, residence, visa), issuing country, an optional label, and an expiry date. We do not collect or store document numbers, scans or photographs.
- Dietary and mobility preferences can reveal religion, belief or health. We collect them only because you enter them, only to shape your plans, and you can clear them at any time from the account page.
4.What we collect — trip content
- Trip inputs: origin, destination, month, days, travellers, style, budget tier and your free-text notes.
- The generated plan and its sections, your manual edits, natural-language revision instructions, and saved version history.
- Expenses and participants: the names you add for travel companions, amounts, categories, dates and who paid.
- Imported bookings: the confirmation text you paste, and what is extracted from it — title, provider, confirmation code, times, location and details such as seat or room.
- Disruption records — which day was re-planned and why — and your feedback ratings and comments.
5.What we collect — trip conversations
If you join an open trip you can message its group and, once the group is set, message another member one-to-one. We store the text of what you write, when, and in which thread, and any photo or voice message you choose to send. A voice message is recorded only while you hold the record button, runs to at most two minutes, is stored privately, and can be played only by the people in that conversation. Voice messages are never transcribed and never sent to an AI provider. Other members see your first name and profile picture and nothing else about you; your email and account identifier never reach another traveller.
Every message passes an automated check on the way in. Phone numbers, email addresses, payment details, and links to other apps or sites are held for a person on our team to read before anyone else sees them. This is how we keep money and contact inside the platform, where we can help if a trip goes wrong. Threats and slurs are held the same way.
Members of the same trip, and friends, can open each other's profile: first name, photo, home city if you chose to add one, the month you joined Saferni, your friend and follower counts, and the open trips you hosted, went on or are about to go on — the same trips anyone can see on Explore. Nobody else can open it, and it never shows your email, phone number, surname or a privately planned trip.
You can follow another traveller (one-way, no approval) and send or accept friend requests. Friends can see each other's profiles without sharing a trip. Blocking someone removes any follow or friendship between you and hides you from each other.
You can report a message or a member and block a member. A block hides that person's messages from you and stops either of you opening a one-to-one thread. Our team can pause a person's ability to write in trip conversations after a report.
6.What we collect — technical and operational data
- A device key in your browser’s local storage, used to attribute and later claim plans created before sign-in was required.
- A hashed IP address: we hash it with SHA-256 and store only a truncated hash, for rate limiting and abuse prevention. We do not store your IP address in the clear.
- Usage counters — plans generated per day and week, your credit wallet and an append-only credit ledger, subscription tier and status, and any administrative limits or grants applied to your account.
- Service logs — provider, latency, token cost, success or failure and the related trip id — which record what a call cost, not what it said.
- Notification records and your notification preferences.
- Advertising counters: how many times an ad slot or a partner placement was shown, clicked or dismissed, and — if you choose to watch a rewarded ad — that a reward was granted and when. These are stored against your account so we can apply the daily and monthly caps and keep the credit ledger honest.
- Product analytics from Microsoft Clarity — which pages you view, how far you scroll, where you click and tap, and a replay of that interaction, so we can see where the interface confuses people. Clarity’s masking is on, so the text on the page — your itinerary, your notes, anything you type — is hidden from the recording; what we get is the shape of the page and where you went on it. It is never loaded on the staff console.
- Web analytics from Google Analytics — which pages you visit, in what order, roughly where in the world you are, and which site or search sent you, so we can see what people come here for and what they never find. It measures pages, not people: we send Google no name, email address or account identifier with it, and it is never loaded on the staff console.
- We collect no payment card details and no passport or ID numbers, we do not store your device's precise location, and we never receive biometric data. We ourselves do not build advertising profiles or track you across other websites; where Google's advertising cookies do so, the Advertising section sets out what they are and how to turn them off.
7.What the mobile app adds
The Saferni app asks your phone for a permission only when you use the feature that needs it, and you can refuse or withdraw any of them in your phone's settings — the rest of the app keeps working.
- Location. Used to show what is near you, to tell you when to leave for your next stop, and — only if you turn on live trip guidance — to notice when you arrive at a stop on your plan. Background location is asked for only after you have used that feature in the foreground, and only for the days of a trip. When the app asks for nearby places it sends a position rounded to about 110 metres, which answers that one request and is not stored. When you arrive at a stop we record which stop it was and when, never the coordinates. We keep no history of where you have been, we never show your location to other travellers — including members of a trip you have joined — and we never use it for advertising.
- Microphone. Used only while you hold the record button to send a voice message in a trip conversation. See the trip conversations section for who can hear it and how long it is kept.
- Camera and photos. Used only to take or choose a photo or video you decide to upload — a profile picture, a post or story, a photo in a conversation, or a trip you are hosting. The app reads only the items you pick. Before any photo or video is stored, our servers remove the location and camera details a phone writes into the file.
- Face ID, Touch ID and fingerprint unlock. If you turn on biometric unlock, your phone's operating system checks your face or fingerprint and tells the app only whether it matched. Your biometric data never leaves your phone and we never receive it.
- Push notifications. Delivered through Google's Firebase Cloud Messaging, which hands notifications for iPhones to Apple's push service. For each phone we store a push token, the platform, operating-system version, app version, language, time zone, and your notification and quiet-hours settings. A notification's text — for example that a plan is ready, a departure reminder or a flight change — passes through Firebase and Apple to reach you. You can turn notifications off in the app or in your phone's settings.
- Purchases in the app. Memberships and credit packs bought in the app are sold and charged by Apple (App Store) or Google (Google Play) under their own terms and privacy policies. We never see your card or payment details; the store tells us the transaction identifier, which product you bought, when it renews or expires, and which store it came from, so we can switch your plan on. Manage or cancel a subscription, and ask for a refund, in your App Store or Google Play account.
- The app does not read your contacts or calendar, does not use your device's advertising identifier, and shows no third-party advertising.
8.Why we use it
We use the data above to:
- Generate, stream, save and sync your trip plans, and personalise them from your profile without re-asking.
- Determine your visa status for a destination from your passport or travel documents.
- Sign you in and keep your account secure.
- Run split expenses, booking import and disruption re-planning.
- Send in-app and, if you enable them, email notifications.
- Enforce credits and daily and weekly limits, and prevent abuse of the free service.
- Keep the service reliable, diagnose faults, control cost, and improve the product through aggregated, non-identifying analytics.
- Show advertising on the free tier and on our public pages, decide which plan tier should see advertising at all, count what was shown, and apply the caps on rewarded ads — see the Advertising section.
- Meet legal, tax and accounting obligations.
13.Advertising
Advertising is how the free tier pays for itself. This section says plainly where ads appear, who serves them, what they can see, and how to stop them.
Where ads appear. On our public pages — the itinerary library and individual itinerary pages — and, for visitors who are signed out or on the free Wanderer plan, on the trip planner and inside a generated plan. Ads never appear on the home page, the pricing page, the sign-in pages, your account page, your saved trips, the administrative area, these legal pages, or in the planning assistant chat.
What each plan sees. Wanderer and signed-out visitors see ads served by Google. Explorer sees a single ad beneath a finished plan and none at all while a plan is being written. Voyager sees no third-party advertising: on a Voyager account the Google advertising script is never requested, so no advertising cookie is set and no data reaches Google at all. Nobody sees advertising for the first seven days after a purchase.
Who serves them. Google, through the AdSense programme. When an ad loads, Google receives your IP address, user-agent and device characteristics, the page you are on, and its own cookies if you have them. Google may use these to select ads and to measure them, as described at policies.google.com/technologies/ads. We never send Google your email address, your account identifier, your travel documents, your notes or your itinerary content.
No sensitive-category targeting. Some of what you tell us — dietary needs that may reveal religion or belief, mobility needs that may reveal health — is exactly the kind of data that must never drive an ad. It does not. Nothing from your profile, preferences, travel documents or trip notes is passed to any advertising system, and we do not create or sell audience segments.
Your choices in the EU, UK and Switzerland. Before any ad loads we show a Google-certified consent notice. You choose whether to allow personalised advertising, and you can reopen that choice at any time from the link in the notice. Declining does not restrict any part of Saferni — you will simply see non-personalised ads instead.
Everyone's choices, everywhere. You can turn off ad personalisation for your Google account at myadcenter.google.com, block or clear advertising cookies in your browser, or remove ads from Saferni entirely by upgrading to Voyager. Using an ad blocker is fine; we will not ask you to disable it, and nothing in the product stops working if you do.
Rewarded ads. If you are on the free plan and have run out of credits, we may offer you the choice of watching a short ad in exchange for one extra quick plan. It is always optional, always presented alongside the option to upgrade instead, and never a condition of using the credits your plan already includes. Rewards are capped, are only usable inside Saferni, and are never money or anything convertible to money. We record that a reward was granted so we can apply the cap.
Partner placements. On paid plans we may instead show a small number of hand-picked suggestions — a hotel, an experience, a local atelier — chosen by us for the destination you are planning, and marked as a partner placement. These are static entries written by our team, not an ad network: they set no cookies, run no third-party code, and receive nothing about you. Where we earn a commission we say so on the card. You can dismiss any placement and it will not return.
We are paid by advertisers for showing ads and by partners for referrals. We are not paid to say a place is good: what appears in your itinerary is chosen by the same verified-data pipeline whether or not anyone pays us, and no advertiser or partner can buy a place into your plan.
15.How long we keep it
- Account, profile, preferences and travel documents — while your account is open.
- Trips, sections, expenses, bookings, versions and notifications — until you delete the trip or your account. Deleting a trip cascades to its sections, participants, expenses, bookings, disruption records and notifications.
- Trip conversations — each message, with any photo or voice message in it, is kept until 90 days after it was written or 30 days after the trip's last day, whichever is later, and then deleted. A message that has been reported, or removed by a moderator, is kept for 365 days as a safety record. Expired messages are copied to a private archive, which only our safety team can open, and that copy is deleted one year later.
- Stories — 24 hours, then deleted with their photos or videos; a reported story is kept for 365 days as a safety record.
- Live trip guidance — which stops you reached, and when, for 90 days; a trip's live status for 30 days after the trip ends.
- Phones registered for notifications — until the phone is removed from your account or you delete your account. The log of notifications sent is kept for 7 days.
- Legacy anonymous trips — retained while they may still be claimed, then removed or de-identified.
- Hashed-IP rate-limit counters — short-lived, kept only for the abuse window.
- Service logs — 14 days in detail (up to 30 days for some), then only daily totals that identify no one. The credit ledger and payment records — for as long as tax and accounting law requires, which can be after your account is deleted; they record what was bought and when, not your card.
- Shared plan cache cores — up to 30 days, and they hold no personal data.
- Advertising and partner-placement counters — up to 24 months in aggregate for reporting; the per-user records behind the rewarded-ad caps are kept only as long as the cap window requires. Cookies set by Google have their own lifetimes, set by Google.
- Deleting your account deletes, at once, your profile, preferences, travel documents, trips, the messages you wrote, your posts and stories, every photo, video and voice message you uploaded, your profile picture and your registered phones. Four things outlast it: payment and credit records, kept for tax and accounting; a message that was reported or removed, kept without your name, until its 365 days are up; an open trip you hosted, which stays for the travellers who joined it, without your photo; and copies in our backups and the conversation archive are deleted on their own schedules, below.
- Backups — our database is backed up nightly and each backup is kept for up to nine months; backups of uploaded files are kept for 30 days. Backups are encrypted, held privately on Oracle Cloud, and used only to recover from a failure, so deleted data can remain in them until they expire.
16.Your rights
Wherever you live, you can:
- See and edit your profile, preferences and travel documents on the account page.
- View, edit, copy out and delete any trip from within the app.
- Delete your account, which removes the personal data associated with it.
- Turn notifications off in your notification preferences.
- Change or withdraw an advertising consent choice at any time, turn off ad personalisation at myadcenter.google.com, or remove third-party advertising entirely by upgrading to Voyager — see the Advertising section.
- Depending on your country — including under the UAE Personal Data Protection Law, and under GDPR or UK GDPR if you are in the EU or UK — you may also have rights to access, correct, erase, restrict or object to processing, to data portability, to withdraw consent, and to complain to your data protection authority. Write to info@saferni.ae and we will respond within 30 days. We may ask you to verify your identity first.
17.Payments
We never see or store card numbers. In the app, memberships and credit packs are bought through Apple's App Store or Google Play, which charge you and send us only a confirmation of what was bought — see the mobile app section. On the website, card payments, when they are open, are taken by Stripe on its own payment page; until then, a membership or credit pack can be arranged with us directly and is activated by our team.
18.Security
- All traffic is encrypted in transit, and data is encrypted at rest by our infrastructure providers.
- Row-level security is enabled on every user-owned table, so one account cannot read another’s rows.
- Privileged service-role keys exist only in server-side code and never reach the browser; server routes re-check trip ownership on every write.
- IP addresses are hashed, never stored in the clear.
- Administrative access is role-based, restricted to named staff, and every administrative change is written to an audit log.
- No online service can promise absolute security. We minimise what we hold, and if a breach affects your personal data we will notify you and the relevant authority as the law requires.
19.International processing
Your account and trip data are stored on servers in India (Oracle Cloud, Hyderabad region), and uploaded media at Cloudflare. Our other providers process data in several countries, including the United States and the European Union. Where a transfer leaves your country we rely on the safeguards available to us — typically the provider’s standard contractual clauses or an equivalent mechanism — and share only what the provider needs.
20.Children
Saferni is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, write to info@saferni.ae and we will delete it.
21.Automated decision-making
Trip plans are produced with AI assistance, but no decision in the service has a legal or similarly significant effect on you. Visa and safety information is not a determination — see the Terms of Service.
22.Changes to this policy
We may update this policy as the service evolves. We will change the “last updated” date and, for material changes, give notice in the app or by email before they take effect.
23.Contact
Saferni and more Travel and Tourism L.L.C S.O.C (Saferni) · Dubai trade licence No. 1653103 · Office 607, Opal Tower, Marasi Drive, Business Bay, Dubai, United Arab Emirates.
Questions about privacy? Reach us at info@saferni.ae, by telephone on +971 4 884 1158 or +971 52 288 5649, or through the account page inside the app.