Privacy policy

Doku is an app for organizing travel documents. This policy explains what data we collect, what we use it for, and the rights you have over it.

Who is responsible

The data controller is the Doku team. For any question about your data, write to contact@dokutravel.com.

What we collect

• Account data. When you sign in with Google or Apple we receive your name, email and profile photo. We never see your password.
• Your documents. The files you upload or share into the app (PDFs, screenshots or photos of bookings, tickets, vouchers, policies) and the data the AI extracts from them (dates, booking codes, times, passengers, destinations).
• Shared trips and invitations. When you invite someone to a trip, we store the invitation: the trip, who invited them, the role granted, the expiry date and, if you invited by email, the invited person's email address. Once accepted, we store who is a member of each trip and with what role.
• Purchases. If you buy a Trip Pass or the annual subscription, we store what you bought, when, which trip the pass was applied to, and the store transaction identifier. Purchases are processed in the App Store or Google Play through RevenueCat: we neither receive nor store payment details (card, billing address).
• Notifications. If you turn on notifications, we store your device's push token and its platform (iOS or Android) so we can send them.
• Technical data. Error and crash reports (via Sentry), per-trip AI-analysis usage counters — used to enforce the fair use limit — and product-usage metrics (via PostHog): which screens and features are used, tied to a random internal identifier, never to your name, your email or the content of your documents.
• On this website. If you join the waitlist we store your email for the sole purpose of announcing the launch. This website uses no tracking cookies.

What we use it for

• Providing the service: storing your documents, organizing them by trip and syncing them across your devices.
• Analyzing the documents you choose to analyze with AI, to extract their data.
• Sharing a trip with the people you invite — they only see that trip's documents.
• Notifying you about activity in a shared trip and about your plan, if you turned notifications on.
• Recording your purchases and enabling in the app what you paid for.
• Keeping the app stable and diagnosing errors.

We do not sell your data or use it for advertising. Full stop.

Legal bases

• Performance of a contract: storing, organizing, analyzing and syncing your documents, sharing a trip and recording your purchases is the service you ask for by using Doku.
• Legitimate interest: keeping the app stable (error reports) and understanding how the product is used in order to improve it (metrics with no personal data beyond an internal identifier).
• Consent: push notifications, joining the waitlist on this website and any communication you opt into. You can withdraw it at any time.
• Legal obligation: keeping the record of purchases for as long as applicable tax and accounting rules require.

AI analysis

When you analyze a document, it is sent securely to Google's Gemini API to extract its data. Under the terms of Google's paid API, processed documents are not used to train their models. Analysis only happens when you request it (or when you share a file into the app), never on documents you did not upload.

Where and how it is stored

Your documents and data are stored in Supabase (database and file storage), encrypted in transit (TLS) and at rest. Access is restricted by row-level rules: each document is visible only to its owner and to members of trips it was explicitly shared with.

Providers that help us run the service

We do not share your data with third parties for their own purposes. We do use these providers (subprocessors), which process data solely to provide their service to us:

• Supabase — database, authentication and storage of your files.
• Google (Gemini API) — AI analysis of the documents you choose to analyze.
• RevenueCat — purchase and subscription management. It receives an identifier for your account and the state of your purchases, never your documents.
• Apple and Google — payment processing in the App Store and Google Play, as independent controllers under their own policies.
• Expo — delivery of push notifications to your device. The text of a notification may include the trip name and the name of the person who acted.
• Sentry — app error and crash reports.
• PostHog — product-usage metrics (it receives only the internal identifier and usage events, never your documents or your email).
• Vercel — hosting of this website.

International transfers

Some of these providers process data in the United States or other countries outside your own. When that happens, the transfer relies on contractual safeguards such as standard contractual clauses or applicable adequacy frameworks.

How long we keep it

For as long as your account exists. If you delete a document, it is removed from our storage. If you delete your account, your account, documents, trips, invitations, notification tokens and extracted data are deleted within 30 days. The record of purchases (which product, when, and the transaction identifier) is kept unlinked from your account for as long as tax and accounting rules require.

Your rights

You can access your data and correct it directly in the app (every extracted field is editable). You can turn notifications off at any time from your device or app settings. You can request full deletion of your account and data — see how to delete your account. For any other request (access, portability, restriction), write to contact@dokutravel.com.

Children

Doku is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has given us their data, write to contact@dokutravel.com and we will delete it.

Changes to this policy

If we change this policy in a substantial way, we will announce it in the app or by email before the change takes effect.