Privacy Policy

This policy covers the Departy app for iPhone and any messages you send us about it. Personal information means information about an identifiable person. Departy is built so that we don't collect it: your trips are stored in Apple's iCloud, not on servers we run.

Departy has no servers of its own, and no ads, tracking or analytics code. Trips are saved in Apple's iCloud. A trip is stored in the iCloud of the person who created it (the trip owner) and shared only with the people they let in. Mark Jim Group can't see it. Apple's privacy policy covers how iCloud stores it.

Departy also keeps a copy of your trips on your iPhone so they work offline. It's protected by iOS file protection and erased when you sign out. Your appearance, currency and sign-in details are saved in the app's settings on your iPhone.

Notifications: to tell you about new trip updates and requests to join. You can turn them off in iOS Settings at any time. Departy doesn't ask for your location, camera, photos, contacts or microphone.

Passport, NEXUS and other travel document details are saved in your own iCloud in encrypted fields that can't be read on Apple's servers. They're shared with the trip's owner and organizers only if you turn sharing on. Turning it off stops new access right away, and the copy on an organizer's iPhone is deleted the next time their app syncs. Nothing can take back what someone already wrote down or screenshotted.

Departy only sends data to these places:

• iCloud (Apple): your trips, shared with the people on them.
• Departy's public iCloud database (Apple): while a trip owner has a join code turned on, the code, the trip's name and the trip's private link, for up to 24 hours. Anyone with the code can see the trip's name and ask to join. Only the owner can let them in. Posting an update or asking to join also saves a small record with a scrambled trip key and the kind of alert, so iCloud can send notifications. It never holds the trip's name, what was posted or who posted it.
• Apple Maps: what you type when searching for a city. The list of airports is built into the app.
• Frankfurter (frankfurter.dev): once a day, currency codes to get the European Central Bank's exchange rates. Like any website, it can see your internet address.
• App Store (Apple): the one-time purchase to plan trips. Apple handles the payment, and Departy never sees your payment details.
• Wherever you send an exported PDF. It includes the route, bookings and the names of the people on the trip, never travel documents, phone numbers or emails.

Departy has no analytics of its own, but Apple gives every developer some information about their app:

• App Store Connect: downloads, purchases and, only if you chose to share analytics with app developers in iOS Settings, crash reports and how often the app is used.
• iCloud: logs of requests to Departy's iCloud database. Each entry shows the time, an anonymous ID that only works inside Departy, the device type and iOS version, the kind of request, the ID of the trip it touched (not its name) and any error. They never include what's in your trips.

We use this only to find and fix problems and to understand how Departy is doing.

The first time you sign in, Apple gives Departy your name and email, or a private relay email if you choose to hide yours. They stay on your iPhone and are added to your traveler details, so the people on your trips can see them. You can change or remove them.

We don't receive your trips, travel documents or contact details, so we can't use or disclose them. We never sell personal information or share it for advertising.

Departy relies on these service providers: Apple (iCloud, Sign in with Apple, Apple Maps, push notifications and the App Store) and Frankfurter (exchange rates). Records in Departy's public iCloud database may be disclosed if required by a valid court order, warrant or other legal demand. If Mark Jim Group is sold or merged, this policy continues to apply to Departy.

Departy uses no cookies, advertising identifiers or tracking. It doesn't follow you across other apps or websites.

Departy uses reasonable safeguards, including:

• Travel document fields encrypted by iCloud.
• Trip data on your iPhone protected by iOS file protection and erased when you sign out.
• Network traffic sent over HTTPS.
• Join codes that switch off by themselves after 24 hours.
• Notification records that use a scrambled trip key instead of the trip's name.
• Exported PDFs deleted from your iPhone once the share sheet closes.

No method of sending or storing data is completely secure, so we can't guarantee absolute security.

• Trips: until the owner deletes the trip or their account.
• Your travel documents: until you delete them or your account.
• Offline copy on your iPhone: until you sign out or delete the app.
• Join codes: up to 24 hours, or until the owner turns the code off.
• Notification records: kept in Departy's public iCloud database. They hold no names or content.
• Usage logs and crash reports: kept by Apple for a limited time.
• Purchase record: kept by Apple with your Apple Account.

iCloud data is stored on Apple's servers, which may be outside your country.

Apple and Frankfurter have their own privacy policies, and we aren't responsible for their practices. Please read them to understand how they handle your information.

Departy isn't directed at children under 13, and we don't knowingly collect information from them. A trip owner can add a child to a trip as a guest. That information stays in the owner's iCloud, and the owner can remove it at any time.

You can see and change your traveler details, your travel documents and anything you added to a trip in the app. In Settings, Delete my account erases the trips you own (for everyone on them), takes you off trips you joined, and erases your travel documents. Expenses and payments you were part of stay in other people's trips so their totals still add up. To also remove Departy from your Apple Account, open Settings on your iPhone, tap your name, then Sign in with Apple.

For any other request about your information, contact us (see section 15). We reply within 30 days at no cost.

You can withdraw consent at any time: turn off travel document sharing, leave a trip, turn off notifications in iOS Settings, or delete your account. Trip owners can turn off a join code at any time. Withdrawing consent stops the related feature but doesn't affect the rest of the app.

We don't operate servers that store Departy user data. If a breach involving personal information we control creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the people affected as soon as feasible, as PIPEDA requires. We keep a record of every breach for 24 months. Where the GDPR applies, we notify the supervisory authority within 72 hours.

Mark Jim Group is based in Ontario, Canada. This policy follows the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law. Where Quebec's private-sector privacy law (as amended by Law 25) or the Personal Information Protection Acts of Alberta or British Columbia give you more protection, that protection applies. If you're in the EEA or UK, you have rights under the GDPR. We don't sell or share personal information as defined by the CCPA and CPRA.

When this policy changes, we update the Last updated date and show the new version in the app and online. If a change would use information in a new way, we will ask for your consent first.

Email our Privacy Officer at hello@markjim.com, or use the support link on Departy's App Store page.

You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376), your provincial privacy commissioner, or, in the EEA or UK, your national data protection authority. You don't need to contact us first.