Privacy Policy
This policy describes what Journey Coin collects, why, and what we do with it. It is written against the actual database behind the service rather than from a template: where it says something is not collected, there is no field for it.
The short version. A coin's journey is public — that is the point of it. Your precise location is not. An email address is held only if you chose an email-and-password account, or gave one to buy a coin or to send us something, and it never appears on a coin. We do not sell data or run advertising.
1. Who we are
Journey Coin is run by World Travel Coins, which operates this website, the mobile app, and the service behind the code engraved on each coin. “We” and “us” in this policy mean World Travel Coins. For questions about this policy or about your data, write to privacy@journeycoin.org.
2. What we collect
| What | Why we hold it |
|---|---|
| Sign-in identifier | If you used Apple or Google: an opaque identifier from them, plus which of the two you used. That is not your email address, and signing in that way never gives us one. (If you later buy a coin, the email you give at checkout is held with the order — see below.) If you made an account here: the email address you chose. Either way it is what lets us recognise you on your next visit. |
| Email address | Held for accounts created with an email and a password, to tell one account from another and to let you recover yours. Also held with an order — whether or not you were signed in — so we can send its confirmation, shipping and refund emails, and with feedback if you give one so we can reply. Never published, never attached to a coin, never sold. |
| Password | Held only for those accounts, and only as a scrypt hash. We cannot read your password and cannot tell you what it was. |
| Passkeys and two-factor | If you add a passkey: its credential identifier and public key (never anything that can sign in on its own) and a label naming the device it was made on. If you turn on two-step sign-in: the secret your authenticator app uses and hashed recovery codes. Removed when you erase your account. |
| Display name | A first name and a last initial, shown publicly when your anonymity settings permit. |
| Language and time zone | To write dates correctly and to avoid sending you a notification in the middle of the night. |
| Your kindness entries | A category, a note of up to 140 characters, and a city label. These are public. |
| Precise location | Recorded when you log or claim a handoff, to confirm two people were actually together. Never shown publicly. The Android phone and watch apps ask only for approximate location, so from them this is already coarse. |
| Approximate location | A deliberately coarsened version of the above. This is the only location anyone else sees. |
| Session records | Your IP address, your browser or app identifier, and an irreversible hash of your session token. Used to keep you signed in and to detect stolen sessions. The IP address is also recorded with a few security events — a password-reset request, a two-step sign-in challenge, a sign-in handed from the website to the app, and changes made by our own staff — so that misuse can be traced. |
| Abuse counters | To stop a form or sign-in being hammered, we count recent attempts against your IP address (or your account, when you are signed in). Nothing else is kept with the count, and it is deleted within two days. |
| Device records | Platform, notification token, and a device identifier used to stop a person passing a coin to themselves. |
| Order records | If you buy a coin: the email address and the delivery name, address and (if you gave one) phone number you entered at checkout, what you ordered and any engraving text, the amount, any discount code, a payment reference, refund and dispute records, and the parcel's tracking number. Anyone with an order's private link can see its status and tracking. Card details go directly to Stripe and never reach us. |
| Coin artwork | If you design a coin on this website: the artwork file you upload and its file name. Kept with the order it was made for; a design that was never ordered is deleted when you erase your account. |
| Families and blocks | If you join a family: its name, who is in it, and invitations sent and accepted. If you block someone: that you did, so their notes stay hidden from you. |
| Crash reports | If the app or this website crashes or freezes: the error, the screen it happened on, the app version, and your device model and operating system, so the bug can be found. No notes, no location and no name are attached. |
| Automatic checks on what you write | Before a note appears on a coin, it is checked automatically — for language, and for things that should not be on a public page, like a phone number or an email address. Most notes pass and appear straight away. When one does not, the coin still moves and the note waits for a person to read it; you are told, and nothing on the coin's page says anything happened. Your display name is checked the same way when you choose it. Where an outside provider is used for this check, the text of the note is sent to them and nothing else about you — see who else sees it below. |
| Feedback you send | If you use the feedback button: what you wrote, and — so that a report is actionable — the app version, your device model, the operating system version, the screen you were on, your language and time zone, and a short log of the last requests your app made. No note text and no location goes into that log. If you attach a screenshot we hold the image; you are shown it before it is sent and can leave it out. Reports are read by us, and one may be turned into a work item in our issue tracker (Plane, see below), which is not published; the screenshot is not sent there. |
| Beta requests | If you ask to join the beta: the email address, a name if you give one, which phone you have, anything you wrote in the box, and the date. Confirming the address is what puts you on the list, and every message we send carries a link that takes you off it. If we approve the request, the address is passed to Apple so TestFlight can send you the invitation. |
| Website visit counts | When a page on this website loads, it tells us the page, the website that linked you here (the site name only, not the full address), and any campaign tag in the link, such as the one on a café counter card. We add one to a daily total for that combination and keep nothing else: no cookie, no IP address, no browser details and nothing that identifies you, so there is no record of any one visit to look up or delete. Pages about a particular coin or order are counted together, never one by one. If your browser sends Do Not Track or Global Privacy Control, the page does not send anything. |
| Launch list | If you ask us to tell you when the shop opens: the email address, which page of this site you asked on, the campaign tags in that page's address if it had any (utm_source, utm_medium, utm_campaign and utm_content, which say which post, card or café sent you there), the date, whether you have confirmed it, and whether we have sent the email yet. Not your IP address and not your browser. We first send one message with a link to confirm the address is yours; until you open it you are not on the list, and if you never do the address is deleted after 7 days. After that it is used to send one email, on the day the shop opens, and for nothing else: it is not added to any other list and not given to anyone. That email carries a link that takes you off the list, and "How long we keep it" below says how to come off it sooner. |
Cookies
This website sets a sign-in cookie when you sign in, and a short-lived one while a sign-in with Apple or Google is in progress. They exist only to keep you signed in, cannot be read by scripts on the page, and are sent only to this site over an encrypted connection. There are no advertising or tracking cookies, and the visit counts above use none.
3. What is public
Anyone who holds a coin — or knows its code — can see its whole journey: every kindness written on it, a display name or anonymous holder label, the approximate area of each handoff, when it happened, and how far the coin has travelled.
Please write notes on that basis. A note is limited to 140 characters, it is public the moment it is committed, and it becomes part of a record other people share.
Choosing anonymity and changing your mind
When recording a kindness, you can choose to keep your name anonymous on that act. You can also make anonymity the default for new acts. This default does not change earlier entries.
In your profile privacy settings, you can hide your name on all past and future acts without deleting your account. This takes priority over the choice made on an individual act. Turning it off restores your name only where you originally chose to share it; acts recorded anonymously remain anonymous.
Anonymity hides your public name, not the kindness itself. Your note, category, approximate location, date and place in the coin's journey remain public. A coin may use an anonymous holder label to keep its journey understandable. We retain the account connection needed to operate the service. Avoid identifying yourself or others in the note if you want anonymity. These controls do not remove copies, screenshots or notifications that someone has already received.
4. How location is handled
This is the part worth reading twice, because we treat two things differently.
- Precise coordinates are used once, at the moment of a handoff, to check that the two people were plausibly in the same place. They are never published and never shown on a map.
- A coarsened location is derived from them and is what appears publicly. It identifies a general area, not a building.
If you decline location access, you can still claim a coin inside the handoff window. The hop is simply marked for human review instead of being verified automatically.
5. What we do with it
- Run the service: showing journeys, transferring coins, and keeping you signed in.
- Confirm that handoffs are real, and detect abuse such as passing a coin to yourself.
- Send notifications you have asked for, at reasonable hours in your own time zone.
- Fulfil and support orders, where you have placed one.
We do not sell personal data, we do not share it with advertisers, and we do not use it to build advertising profiles.
6. Who else sees it
- Apple and Google — they verify who you are when you sign in. We check the proof they issue and then discard it; it is never stored.
- Stripe — our payment processor. If you buy a coin, the card, the email and the delivery address are given to Stripe: they take the payment and may email a receipt, and what comes back to us is the email, the amount, a payment reference and the address to post to. We never hold a card number. Their own privacy policy covers what they do with it.
- Shippo — buys the postage. To print a label it receives the delivery name, address, email and phone number of that order, and to quote a price before you pay it receives only the country and postcode.
- Our email provider — delivers the messages we send: order confirmations and shipping and refund notices, password resets, and launch-list and beta emails. It receives the address and the message.
- Sentry — receives the crash reports described above, from the app, the website and our server.
- Plane — the issue tracker where a feedback report may become a work item. It receives what you wrote, the device details and the request log, but not the screenshot.
- Telegram — carries alerts to the people who run the service when something goes wrong, which can include an order number and an error message, but not your name, email or address.
- Apple and Google push services — deliver notifications to your device.
- Our hosting and network providers — carry the traffic that serves these pages.
- Apple TestFlight — only if you asked to join the beta and we approved it. Apple receives the email address so it can send you the invitation, and nothing else about you.
- A content-screening provider (OpenAI) — only if one is switched on for this service. It receives the text of a note, on its own, to answer one question: should a person read this before it is published. It is not told who wrote it, which coin it is on, or where. It is not used to train anything. If no provider is switched on, notes are checked by this service alone and no text leaves it.
We may also disclose information where the law genuinely requires it.
7. How long we keep it
Account data is kept while your account is active. A session stops working when it expires or you sign out, and the record of it — with its IP address — is kept as a security log. The counters that limit repeated attempts are deleted within two days. Order records, including the email and delivery address, are kept as long as tax and accounting rules require, even after an account is erased.
A coin's journey is kept indefinitely, because it is a shared record. The entries on a coin belong to everyone who has carried it, and deleting one person's line would break the chain for all of them.
A note that was held for a person to read is kept exactly as long as the note itself, whether it ends up published or not. What the check found is kept with it, so a decision about somebody's words can be explained later.
Feedback is kept while the problem it describes is still worth fixing. If you erase your account, everything personal in your reports goes with it — what you wrote, the screenshot, the logs, the device details — and what is left is the record that somebody once reported the bug.
A beta request is kept until you take the address off the list, which the link in every message does. A request we have already acted on keeps only the fact that it was made and what was decided.
An address on the launch list is deleted a year after you signed up, whether or not the shop has opened by then. An address nobody confirms is deleted 7 days after the confirmation message was sent. To come off the list sooner, use the link in the launch email, or write to privacy@journeycoin.org and we will delete it.
8. Deleting your account
In the app: open Profile and choose Erase my account. It takes effect at once. Without the app: write to privacy@journeycoin.org from the email on your account, or tell us how you sign in, and we will erase it for you.
When an account is erased we anonymise rather than delete. Removed: your display name, sign-in identifier, password, passkeys and two-step secrets, notification tokens, and any coin design that was never ordered. Every session is signed out and every device is disconnected; the security log of them remains. The entries you wrote remain on their coins with no name attached, and order records stay for as long as the law requires.
We are being direct about this because it is a real trade-off rather than a technicality. Full deletion would tear holes in journeys that other people are part of. If that is not acceptable to you, please do not write a note you would later want removed.
9. Your rights
Depending on where you live, you may have the right to access a copy of your data, correct it, ask for erasure as described above, object to certain processing, or complain to a data protection authority. Write to privacy@journeycoin.org and we will respond.
10. Children
This service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.
11. Security
Traffic is encrypted in transit. Session and handoff tokens are stored only as irreversible hashes, so a copy of our database does not yield a working token. Reusing an already-rotated session token revokes the whole family of tokens it belongs to, which limits the damage a stolen one can do.
12. Changes
If this policy changes materially we will update the effective date above and, where the change affects how your data is used, tell you in the app.