Privacy policy

1. Google sign-in information

When you sign in with Google, Google and Firebase Authentication provide basic account information, such as your name, email address, profile picture if available, account identifiers, email verification status, and sign-in time. We use this information to identify you, check your access, secure your session, and connect you to your Bosa profile and trips. Bosa does not receive your Google password.

Google sign-in does not grant Bosa access to your Gmail inbox, Google Drive files, Calendar, or Contacts. Booking emails you choose to forward and files you upload are information you provide separately.

2. Information you provide and activity we record

We store the information you or an authorized inviter provide to set up your account, including profile details and your account email. You may also provide a home location, travel preferences, saved companions, traveler names and ages, dietary or accessibility needs, destinations, dates, itineraries, reservations, booking references, documents, images, messages, and feedback. Only share another person’s details when you have permission.

We record sign-in and approximate browser-activity timestamps, service requests, task results, errors, and technical diagnostics. Hosting and security services may also process IP addresses and browser or device information. Browser-activity tracking records when you use Bosa; it does not record the text you type or the contents of individual interactions. Messages and other content you submit are stored as part of the service.

3. How we use information during testing

We use information to operate invited accounts, organize trips and confirmations, personalize planning, provide AI assistance and research, support sharing you request, and respond to feedback. We also use it to diagnose failures, evaluate planning quality, improve Bosa, and protect the service.

Authorized Bosa administrators can review tester profiles, activity, trips, booking information, source documents, and conversations to investigate issues and evaluate the pre-release app. Diagnostic records can include AI prompts, responses, and task outcomes. Please avoid submitting information you do not want used in this testing process.

We do not sell Google account information or use it for advertising. Its use is limited to providing and supporting Bosa as described here.

4. When information is shared

We use service providers to operate Bosa. These include Google Cloud and Firebase for hosting, storage, and authentication; AI providers such as OpenAI or Google for planning and content processing; map, search, and travel-information providers for research; and email and infrastructure providers such as Mailgun and Cloudflare.

Relevant messages, trip details, preferences, and supplied documents may be sent to AI providers to perform the features you use. Research services receive the queries and location or travel context needed for their tasks. Providers process information under their applicable terms and privacy policies, and may process it outside your country.

People you share a trip with can see information allowed by their trip permissions. We may also disclose information when required by law or necessary to address abuse or protect the service. External booking and travel websites handle information you give them under their own policies.

5. Storage, protection, and retention

Bosa stores account and trip records in its cloud database and supplied files in cloud storage. We use encrypted connections, authentication, and access controls to protect information. No system can guarantee complete security.

During pre-release testing, account and trip records, submitted content, and diagnostic records may be retained for the duration of testing and troubleshooting. Raw AI prompts and responses currently have no automatic deletion schedule. Archiving a trip or signing out does not delete these records. Test data may also be reset or removed as the app changes; Bosa is not a permanent backup for travel documents.

You can request deletion using the contact below. We will review the request, verify your identity where needed, and explain what can be removed and any records that must remain for security, legal obligations, or provider retention requirements. Removing Google access alone does not delete information already stored by Bosa.

6. Cookies and browser storage

Bosa and its authentication services use cookies and browser storage to maintain sign-in, keep drafts and cached app state, and remember interface choices. Clearing or blocking this storage may sign you out or remove unsaved local information. Shared-device users should sign out when finished.

7. Your choices and contact

You can edit available profile and trip details in Bosa and manage sharing where your permissions allow. To ask about your information, request access or correction, delete an account or its data, or leave the testing program, email support@gowithbosa.com. Include the email address associated with your Bosa account, but do not send passwords.

You can review or revoke Bosa’s Google connection in your Google Account connections. This may require signing in again if you return to Bosa.

8. Changes to this policy

We will update this page and its date as Bosa’s data practices change. We will bring material changes to invited testers’ attention through the app or their account email. This policy describes the current pre-release service; a broader launch may require updated practices and disclosures.