Privacy policy

What we keep

Your account: e-mail address, password (stored only as a hash, by our authentication provider), name, language and home currency.

What you put in Meili: trips, places and dates, notes, photos, voice notes, tickets, booking confirmations and insurance documents, expenses, packing lists, to-dos, souvenirs, saved phrases and your translation history.

Positions: the place where you check in, only when you tap the button (with your phone's permission), and the position and time recorded in the photos you add, read on your device so they land on the map. Meili never follows you in the background. The photo files we store are re-encoded and don't keep their metadata; the position is kept next to them.

On a shared journal: the comments, voice comments and likes you leave, with your name, and the journals you follow.

If you turn on notifications in the phone app: an identifier of your phone to send them to.

Small technical records: how many AI requests you made today (daily limits), which notification e-mails were sent (no duplicates), and counters against abuse.

What it's for

Running the service you asked for — this is the legal basis (the contract between us): showing your trips to you and the travellers you invite, placing your photos on the map, reading your documents, sending the e-mails you need (sign-in, confirmation, password) and the notifications you can turn off.

Keeping Meili safe and affordable (legitimate interest): the captcha at sign-in, daily limits and anti-abuse counters.

Who else sees it

The travellers of a trip see that trip. A shared journal is visible to anyone who has its link — you choose what it shows (places, notes, photos, voice notes); it never shows your tickets, documents, stays, budget or the other travellers.

When you follow a shared journal, its travellers see your name and since when you follow it, and can remove you from its followers. Your comments and likes there show your name to them too.

Service providers that run Meili for us, bound by data-processing agreements:

• Supabase — database, accounts and file storage (servers in the European Union, Ireland).
• Vercel — hosting of the site and of the app's content (servers in the European Union, Dublin; some requests go through its global network).
• Anthropic (Claude) — reads the documents you ask it to read (tickets, booking confirmations, insurance policies, receipts you scan — a receipt isn't kept by Meili; at most the first 8 pages), the text you translate and the itineraries you paste. Anthropic doesn't use them to train its models and keeps them only for a limited time under its commercial terms. They may be processed in the United States, under the European Commission's standard contractual clauses.
• Resend — sends our e-mails.
• Cloudflare (Turnstile) — the security check at sign-in, which looks at technical signals from your browser.
• Google (Firebase Cloud Messaging) — delivers the notifications you turn on in the phone app: it gets an identifier of your phone and each notification's text.

The map: your device downloads the map from OpenFreeMap, which sees its IP address like any website. Place search and naming go through our server to OpenStreetMap's Nominatim, without anything that identifies you.

Audience of shared journals

When someone opens a shared journal, we count the visit and the places seen, so that travellers can see how many people read their journal. The visitor is a random number kept in their browser and renewed every day: no account, no IP address and no cookie are used for it, and travellers never see who a visitor is.

Cookies and storage on your device

Only what Meili needs to work: the session cookie that keeps you signed in, your language, your time zone (to show times in it) and, on a computer, whether the sidebar is folded. Your device also keeps a few preferences (what's folded, what you've already read on a journal, the converter's direction) and, for offline use, a copy of your current trip. No advertising or analytics cookies.

How long

As long as you keep your account. Notification e-mail records and anti-abuse counters are short-lived. When you delete your account, everything is deleted at once; copies can remain in database backups for at most 30 days before they're overwritten.

Deleting your account

In Meili: Account › Delete my account (in the app or on the site, once signed in). Everything that's only yours is deleted for good — trips, photos, voice notes, documents, comments… A trip you share with other travellers isn't deleted: it goes to one of them, with what you added to it.

Your rights

You can see and correct your data in Meili, delete it (above), download a copy in a reusable format (Account › Download my data: a zip with data.json and your files), object to a processing or ask to restrict it, by writing to the address at the top of this page. You can also complain to your data protection authority — in France, the CNIL (cnil.fr).

Meili isn't meant for children under 15.

If this policy changes in a way that matters, we'll tell you in the app or by e-mail before it applies.