← Back

Privacy Policy

Last Updated: November 2026

At Champord, we are committed to protecting your privacy and being transparent about how we handle your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information.

1. Information we collect

We collect information you provide directly and data generated through your use of our Services:

Personal Information

• Account data: name, email address, password (encrypted)
• Sign-in providers: if you use Sign in with Apple or Google Sign-In, we receive your name and email address (or Apple's relay email) from that provider — we never receive your password
• Profile information: age range, citizenship, travel preferences
• Payment data: processed by the Apple App Store (iOS), Google Play (Android) or Paddle (purchases on champord.com). We never collect or store your card details — only the receipt and subscription status needed to entitle your account
• Communications: messages you send us, and reports you send with the Report option, including the reported content

Travel Data

• Trip details: destinations, dates, budget, companions
• Companions, pets and equipment: names and details you save for the people and animals travelling with you
• Preferences: interests, travel style and other choices you make in the app
• Health-related information: food allergies, diets, medical conditions and accessibility needs you choose to add for yourself or your companions. This is special-category data, because it can reveal your health or beliefs. We process it only with your explicit consent, which the app asks for before you first save it, and only to tailor your recommendations, for example restaurants and accessible routes. It is never used for advertising. You can withdraw consent at any time by removing this information in the app; we then stop using it and delete it from your profile. Add information about other people only with their permission
• AI interactions: chat history for trip assistance
• Dictation: when you dictate a chat message, the speech recognition built into your phone or browser (for example Apple's on iPhone and in Safari, Google's on Android and in Chrome) turns your speech into text, under that provider's own terms. On champord.com the recording is also uploaded to our servers and transcribed, so that the places in your trip are recognised; in the app this happens only when your device cannot recognise speech. Recordings are deleted within 30 days of transcription
• Voice recordings: when you plan a trip by voice, the audio is uploaded to our servers, transcribed, and used only to build that trip. Recordings are deleted within 30 days of transcription; the resulting text is kept with your trip
• Photos: profile pictures and trip cover images you choose to upload
• Calendar data: only if you turn on calendar sync. We write your trip events to the calendar you pick, and read that calendar's existing events solely to avoid creating duplicates. We never read or store the content of your other appointments

Shared Expenses

• Expense records: titles, amounts, currencies, categories, dates, and who paid
• Balances and settlements between you and the people in a project
• People you add to a project by name, and email addresses you enter to invite someone to Champord. We use an invitation email address only to send that invitation

Automatically Collected

• Device information: model, OS version, unique identifiers
• Usage data: features used, interaction patterns
• Push notification token: a device token used to deliver trip and account notifications, only if you grant notification permission
• Crash reports (mobile app only): the error, stack trace, device model and OS version, via Firebase Crashlytics
• Country of sign-up: when you create an account, your IP address is looked up with ip-api.com to estimate your country, and we keep only the country

Location: the app and champord.com ask for your device's location only when you use a feature that needs it, such as "Near me" on the map or sharing your location with a chat message, and only while you are using it, never in the background. You can say no and pick a point on the map instead. Your coordinates are sent to our servers with that request and used only to find places near you in Champord's own place catalogue. They are not passed to Google, to the AI providers or to anyone else: the AI assistant receives only the places found and how far away they are. We do not store or log your location. When you tap a point on the map in the app, your phone's built-in geocoding service (Apple's on iPhone, Google's on Android) is asked to name it. Places you choose to save on your map are kept with your account.

Usage and ad measurement (mobile app only): Google Analytics for Firebase records that the app was installed and opened, and these steps: account created (with the sign-in method), onboarding completed, first trip plan generated, and purchases and free trials (product, price and currency). With each event it records an app instance identifier, device model, OS version, app version and approximate country. If you are in the EEA, the UK or Switzerland, nothing is recorded until you allow it; elsewhere it is on unless you turn it off. You can turn it on or off at any time in Account → Your data → Usage and ad measurement.

Advertising identifiers: we use them only to measure which of our own ad campaigns bring people to Champord, never to show you ads from others, and we do not sell your data. On iPhone, Champord asks for Apple's App Tracking Transparency permission only after your first trip plan, and only if measurement is on; Apple's advertising identifier (IDFA) is used only if you allow it. After you sign in on iPhone, Google's on-device conversion measurement may use your email address to match an ad you saw; the matching happens on your device and your email address does not leave it. On Android, Google Analytics may use the Android advertising ID for the same purpose; you can reset or delete it in your device settings.

Ad measurement on champord.com: the website loads Google Ads tags through Google Tag Manager and, when we advertise on Facebook or Instagram, the Meta Pixel. When you create an account or complete a purchase on champord.com, they report it to Google Ads and Meta, with the amount, currency and a transaction number for a purchase, never your name or email address. While allowed, they set Google Ads and Meta cookies that link your visit to the ad that brought you. If you are in the EEA, the UK or Switzerland, they stay off until you accept; elsewhere they are on unless you decline. While they are off they set no cookies and use no identifiers. You can accept or decline at any time with Cookie settings at the bottom of every page on champord.com.

Usage analytics on champord.com: while you allow it, the website uses PostHog to record how it is used, so we can find what is confusing or broken: the pages you open, the buttons and links you tap, and recordings of your visit (session replay) showing how you moved through the pages. Everything you type into fields, and the messages you write in the chat, is hidden in these recordings and never leaves your browser in them; your email address is hidden too. Once you are signed in, your visit is linked to your Champord account number, never your name or email address. PostHog keeps this data in the EU (Frankfurt) and sets no cookies. If you are in the EEA, the UK or Switzerland, it stays off until you accept; elsewhere it is on unless you decline. Recordings of your visit start only after you accept on the cookie banner, wherever you are. You can accept or decline at any time with Cookie settings at the bottom of every page on champord.com.

Meta Conversions API: while ad measurement is allowed, our servers also tell Meta when you create an account or complete a purchase, so Meta can match it to the ad you saw. They send your email address and account number in hashed (SHA-256) form, never in plain text, together with the Meta cookie values, your IP address and your browser or app version. They never send health-related information or details of your trips.

Where you came from: on your first visit, champord.com remembers in your browser, for 90 days, the campaign tags in the link you followed (utm parameters), the site that sent you and the page you landed on, and, while ad measurement is allowed, the ad click identifiers in that link (gclid, gbraid, wbraid, fbclid). The app reads once, on first launch, where its install came from: on iPhone, an Apple Ads attribution token from Apple's AdServices, which needs no tracking permission and contains no advertising identifier, and which our servers send to Apple to learn whether an Apple Ads campaign led to the install; on Android, the Google Play install referrer, which names the link or campaign that led to the install. When you create an account or sign in, this is stored with your account, so we learn which of our campaigns and channels bring people to Champord. In the EEA, the UK and Switzerland, ad click identifiers are kept and passed to ad networks only if you allowed ad measurement.

2. How we use your information

We use your information to

Provide Services

• Generate personalized travel itineraries
• Process payments and manage subscriptions
• Provide AI-powered trip assistance
• Manage your account and preferences

Improve Our Services

• Analyze usage patterns to enhance features
• Measure how the app is used and which of our ad campaigns bring new users, with Google Analytics for Firebase
• Measure which of our ad campaigns bring sign-ups and purchases on champord.com, with Google Ads and Meta
• See how champord.com is used, with page views, taps and session recordings in PostHog, to find and fix what is confusing or broken
• Learn which of our campaigns and channels bring new users, from the link, the referring site or the store campaign that brought you, including Apple Ads attribution and the Google Play install referrer
• Improve AI-powered recommendations using anonymized usage patterns
• Use anonymized structural patterns from approved trips (such as itinerary pacing, activity categories, and budget allocation) to improve recommendations for other users
• Fix bugs and optimize performance
• Develop new features based on user needs

Legal Bases (GDPR)

• Contract performance: trip generation, account management, payment processing
• Legitimate interest: crash reporting, AI improvement, fraud prevention, handling content reports, service optimization, learning which campaigns and channels bring new users (campaign tags, referring site, Apple Ads attribution and the Google Play install referrer)
• Consent: marketing communications, and usage and ad measurement in the EEA, the UK and Switzerland
• Explicit consent (GDPR Article 9): health-related information such as allergies, diets, medical conditions and accessibility needs
• Legal obligation: tax records, law enforcement requests

Communicate With You

• Send service-related notifications
• Respond to your inquiries and support requests
• Send marketing communications (with your consent)

Legal and Security

• Comply with legal obligations
• Detect and prevent fraud or abuse
• Enforce our Terms and Conditions

3. Data sharing and disclosure

We do not sell your personal information. We may share data with:

Service Providers

• Apple App Store and Google Play: in-app payment processing and receipt validation
• Paddle (paddle.com): payment processing for purchases made on champord.com, acting as merchant of record. Paddle processes your name, email address and payment details under its own privacy policy
• Cloudflare: network delivery and protection of champord.com, and cookieless visit statistics (pages viewed, browser, country) that do not identify you
• Microsoft Azure: AI processing with Azure OpenAI, including voice transcription, and storage of photos and files in Azure Blob Storage
• Anthropic and Google (Gemini): AI processing of your chat messages, trip requests and travel preferences to write replies and itineraries
• Apple and Google: Sign in with Apple and Google Sign-In, when you choose them, and the speech recognition built into your phone or browser when you dictate a chat message
• Google Maps Platform: place details and locations used in your itineraries
• Duffel, LiteAPI and Travelpayouts: flight and accommodation availability and prices for the trips you plan, using your search details such as destinations and dates
• ip-api.com: an estimate of your country from your IP address when you create an account
• Resend: delivery of account and trip emails, which requires your email address and the content of those emails
• Google Firebase (Crashlytics, Cloud Messaging, Google Analytics for Firebase): crash reports from the mobile app, push-notification delivery, and usage and ad measurement. While measurement is on, Google links app events to our Google Ads account to report which of our ads led to an install, sign-up or purchase
• Google Ads and Google Tag Manager: on champord.com, measurement of which of our ads led to a sign-up or purchase, with the cookies and choices described in Information we collect and in our Cookie Policy
• Meta Platforms (Meta Pixel and Conversions API): measurement of which of our Facebook and Instagram ads led to a sign-up or purchase, only while ad measurement is allowed, with your email address and account number hashed as described in Information we collect
• PostHog (posthog.com): on champord.com, usage analytics and session recordings, only while you allow them, stored in the EU, with what you type and your chat messages hidden, as described in Information we collect
• Apple Ads: our servers send the app's attribution token to Apple to learn whether an Apple Ads campaign led to the install
• OpenStreetMap: the map data shown in the app and on champord.com. Our servers look up place names and boundaries with OpenStreetMap's Nominatim service, sending only the place name or the coordinates of a point on the map, never your identity
• Contabo: hosting of our servers and databases on EU-based servers

Other People in Your Projects

• When you add someone to an expense project or a trip, the expenses, amounts, balances and your display name are visible to the other members of that project. Only share a project with people you intend to see that information

Third-Party Integrations

• When you connect external services (with your consent)
• Travel service providers (only necessary booking information)
• Partners you open from the app, such as booking, insurance, eSIM, transfer and luggage storage sites, receive what you enter on their own site. A partner link may carry a referral code that identifies Champord, not you

Legal Requirements

• When required by law or legal process
• To protect our rights or safety
• In response to valid government requests

Business Transfers

• In connection with mergers, acquisitions, or asset sales
• With appropriate confidentiality protections

4. Data retention

We retain your information for as long as necessary to:

• Maintain your active account
• Provide requested services
• Comply with legal obligations
• Resolve disputes and enforce agreements

Retention Periods

• Active account data: until account deletion
• Trip history: 3 years after trip completion
• Voice recordings: deleted within 30 days of transcription
• Expense and settlement records: until the project is deleted, or 3 years after its last activity
• Payment records: 7 years (legal requirement)
• Crash reports: 90 days
• Usage and ad measurement events: up to 14 months
• Where you came from (campaign, referring site, store attribution): until account deletion
• IP address and browser or app version kept for the Meta Conversions API: 90 days

After account deletion

• Personal data is deleted within 30 days
• Expense records shared with other people may remain visible to them, with your name replaced by a removed-member placeholder, because they form part of those people's own records
• Anonymized, aggregated data that can no longer identify you may be kept to improve the Services
• Backup copies are purged within 90 days

5. Your privacy rights

Under GDPR, CCPA, and other privacy laws, you have rights including:

Access: Download a copy of your personal data in the app under Account → Download my data Correction: Update inaccurate information Deletion: Request deletion of your data ("right to be forgotten") Portability: Receive your data as a machine-readable JSON file from Account → Download my data Restriction: Limit how we process your data Objection: Object to certain processing activities Withdraw Consent: Revoke previously given consent

To exercise these rights

• Use in-app settings for most requests
• Email privacy@champord.com for complex requests
• We respond within 30 days (GDPR requirement)

Note: Some requests may be limited by legal obligations or legitimate interests.

US state privacy laws: some US state laws, such as California's, may treat sharing data with our advertising partners to measure our ads as "sharing" or "targeted advertising". You can opt out at any time with Cookie settings on champord.com, or in the app under Account → Your data → Usage and ad measurement. On champord.com, a Global Privacy Control signal from your browser is treated as an opt-out until you accept on the cookie banner. We will not treat you differently for using any of these rights.

6. Data security

We implement industry-standard security measures

Technical Safeguards

• TLS 1.3 encryption for data in transit
• AES-256 encryption for data at rest
• Secure password hashing (bcrypt)
• Regular security audits and penetration testing

Organizational Measures

• Access controls and authentication
• Employee security training
• Incident response procedures
• Data minimization practices

While we strive to protect your data, no system is completely secure. We encourage you to use strong passwords and protect your account credentials.

7. International data transfers

Your data may be processed in countries outside your residence. We ensure adequate protection through:

• EU Standard Contractual Clauses (SCCs)
• Data Processing Agreements with all vendors
• EU–U.S. Data Privacy Framework (where applicable to U.S.-based sub-processors)
• Adequacy decisions by data protection authorities

We store your data in the EU: our servers and database are hosted by Contabo in France, and photos and files in Microsoft Azure in Sweden. AI requests may be processed by our AI providers outside the EU, as described in International Data Transfers.

Champord Travel Technologies is based in Armenia, which does not have an EU adequacy decision, and some of our providers, such as Anthropic, Google and Paddle, may process data in the United States or other countries. Where personal data from the EU/EEA or UK is transferred to or accessed from these countries, we rely on the Standard Contractual Clauses or another safeguard recognised by law. You can ask for a copy of the safeguards at privacy@champord.com.

8. Children's privacy

Our Services are not directed to children under 16. Everyone who signs up confirms they are 16 or older. We do not knowingly collect personal information from children.

If you believe a child has provided us with personal information, please contact us immediately at privacy@champord.com. We will promptly delete such information.

Parents or guardians who wish to review or delete their child's data may contact us with proof of identity.

9. Cookies and tracking

On the website, Google Ads tags loaded through Google Tag Manager and the Meta Pixel may set advertising cookies to measure our own ad campaigns, and PostHog keeps an identifier in local storage to measure how the website is used, as described in Information we collect. In the EEA, the UK and Switzerland they are off until you accept, and you can accept or decline at any time with Cookie settings at the bottom of every page. The website also remembers for 90 days the campaign and site that first brought you to it, as described in Information we collect. Apart from that, the website keeps only what it needs to work in your browser's local and session storage: your sign-in, language, subscription status, unfinished trip and cookie choice. The mobile app keeps your sign-in and settings in its own storage, sends crash reports through Firebase Crashlytics and, while measurement is on, uses Google Analytics for Firebase to measure app usage and our own ad campaigns, as described in Information we collect. In the EEA, the UK and Switzerland this starts only after you allow it, and you can turn it off at any time in Account → Your data.

Sign-in with Google or Apple, Paddle checkout and the map providers load only when you use them and may set their own cookies. Our Cookie Policy on champord.com lists everything we store and how to remove it.

10. AI and automated processing

Our AI-powered features process your data to:

• Generate personalized travel recommendations
• Provide conversational trip assistance
• Improve suggestion accuracy over time

AI Processing Transparency

• AI decisions are based on your stated preferences and publicly available travel information
• You can request human review of AI-generated content
• We don't use AI for automated legal or financial decisions
• We use third-party AI services (Azure OpenAI, Anthropic and Google Gemini) to process trip requests and chat messages; your data is sent to these services under strict data processing agreements
• Anonymized structural patterns from trips that users approve (such as pacing, activity mix, and budget tier) are stored and used to improve recommendations for other users; no personally identifying information is included in these patterns
• Health-related information is sent to the AI services only when it is needed to build your trip or answer your question
• AI answers are marked as AI-generated in the app and may be wrong; you can report a harmful or wrong answer with the Report option

You have the right to opt out of AI-based personalization while still using basic app features.

11. Changes to this policy

We may update this Privacy Policy periodically. Changes will be:

• Posted in the app with the new effective date
• Notified via email for material changes
• Communicated through in-app notifications

Continued use after changes indicates acceptance. We encourage you to review this policy regularly.

12. Contact us

For privacy-related questions or to exercise your rights:

Data Protection Officer

Email: privacy@champord.com

Champord Travel Technologies Yerevan, Republic of Armenia Email: support@champord.com

For EU/EEA residents

You have the right to lodge a complaint with your local data protection authority if you have concerns about our data practices.

We aim to resolve all privacy concerns within 30 days.