Privacy Policy

Valid from: 28 October 2026 • Provider: MY YACHTWEEK SL
It is important to us that you understand what data we need — clearly, briefly and fairly.

1. Controller (Art. 4 GDPR)

MY YACHTWEEK SL
Paseo del Borne 14
07012 Palma de Mallorca
Islas Baleares, Spain
E-Mail: privacy@hellokiwi.app
Represented by the Director: Pierre Schorb

2. Purposes

3. Account & sign-in (optional)

You can use HelloKiwi without an account; all data then stays on your device. To sync via the HelloKiwi server and to share trips, you sign in in the settings. There are four ways to do so; there is no separate password:

In addition, there is technical session data (timestamps, expiry; sign-in tokens only as a hash). We never see the passwords of your Apple or Google accounts. Different sign-in methods result in separate accounts.

You can sign out at any time. You can permanently delete your account and all server data in the settings with “Delete account and server data” (see the section “Storage & retention”).

4. Synchronisation via the HelloKiwi server

When you sign in, HelloKiwi syncs your data with our server so that you have it on several devices and can share it with others. All content of your trips is synced: titles, periods, destinations, accommodations (with address, check-in and check-out time, booking number, phone number and website), flights, trains, cruises, activities (with address, booking number, phone number and link), tasks, participants (names, email addresses and other details you enter yourself), expenses, packing lists, notes, results of the packing list assistant, saved places, cover images and attachments (photos, documents) as well as your profile and settings (e.g. language and reminders closed in the web app, the latter for at most 7 days).

The server is located in a data centre in the European Union (Spain). Transmission is encrypted (TLS), attachments are stored encrypted on the server, and backups are encrypted.

Synchronisation is voluntary. It ends when you sign out; your data stays on the device (if you wish, you can have it removed from the device when signing out). Data that has already been synced stays on the server until it is deleted (see “Storage & retention”).

On iOS, while it is working, the packing list assistant stores a device identifier assigned by the app vendor (identifierForVendor) on the trip so that two devices do not create the same list at the same time. It is synced with the trip and is therefore also stored for the trip’s members; it serves no other purpose.

Key figures: for your account and for each trip, we store which platform it was created on (iOS, Android or web). From the data on the server we calculate weekly totals, e.g. new accounts and trips per platform. Nothing is evaluated or stored per person; names and email addresses of invited people are not read for this. The purpose is to understand how HelloKiwi is used so that we can improve it; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The platform information is deleted together with your account or the trip; we keep the weekly totals for 25 months.

Push notifications: When you are signed in and share a trip with others or are signed in on more than one device (including the web app), the app registers a push token with our server as long as “Get changes instantly” is switched on in the app settings (default: on). This applies while you are a member of a trip with at least one other member, have created an invitation (for 14 days), have an open request to join one of your trips, are waiting for your own request to be approved or are signed in on another device or in the web app; once none of this applies any more, the app deregisters the token. The token comes from Apple (iOS, Apple Push Notification service) or Google (Android, Firebase Cloud Messaging); the app obtains it directly from the provider, who sees your IP address in the process. On Android, Google also assigns a Firebase installation ID for this. With your account we store the push token, a random identifier of the app installation (not a device characteristic), the platform, on iOS the type of app version (test or store version), on Android whether the app creates visible notifications itself, the app language and the times of registration and of the last change. We do not store the device model, app version, IP address or location for this.

When a trip is changed on one device, your other devices and the devices of the other members receive a silent notification that is not displayed. It contains only the type of notification and an internal identifier of the trip; the device then fetches the changes via synchronisation. Visible notifications are sent when someone asks to join a trip (to the trip owner) and when the request is accepted (to the person who asked). Via Apple or Google we only send the type of notification, internal identifiers of the trip and the invitation, and a generic text – no names, amounts, places or trip titles. From iOS 1.6.4 and Android 1.3.5, the app inserts the trip title (shortened) into the notification only on your device, from its own data; depending on your device’s preview setting, it can also be seen on the lock screen. Your device only shows visible notifications if you have allowed them in the system settings; silent notifications do not need this permission. We never send trip content via Apple or Google.

Apple or Google deliver the notifications and process the push token and the content of the notification for this purpose, including in the USA (see “Third countries”). On Android, the Firebase SDK also sends delivery reports to Google (e.g. whether a notification has arrived), without trip content. The token is deleted when you sign out, switch off “Get changes instantly”, are no longer involved in a shared trip and are signed in on only one device, or delete your account; if you sign in with another account on the same device, it is assigned to the new account. Our server automatically removes invalid tokens (e.g. after the app has been deleted) as soon as Apple or Google report them as invalid. The legal basis is the provision of synchronisation and sharing (Art. 6(1)(b) GDPR).

If you enter names, email addresses or other data of your travel companions, please make sure you are entitled to do so.

5. Earlier iCloud data (iOS)

Earlier versions of the iOS app synced your data between your devices via iCloud (Apple CloudKit) and offered sharing trips via iCloud. Neither exists any more: sync and sharing now run via the HelloKiwi server (see above).

So that nothing is lost, the app takes over the data in your private iCloud storage once, on the first start of the new version, and stores it on your device. After that, the app no longer reads from or writes to iCloud. Shares from other people received via iCloud are not taken over and are no longer shown.

We have no access to your iCloud data. It stays in your iCloud storage until you delete it: in the iOS settings under your name → iCloud → Manage Storage → HelloKiwi.

6. Sharing trips with others (HelloKiwi sharing)

You can share a trip with other HelloKiwi users. To do so you create an invitation (“Invite someone”), optionally with the name and email address of the invited person, and send them the invitation code, a link or a QR code. An invitation is valid for one person and for 14 days. When someone opens the invitation link, the invitation page shows, as long as the invitation is valid, the name of the trip, its dates and your first name (the first word of your profile name), but never your email address; anyone who has the link can see this. If the invitation has expired, been withdrawn or already been used, the page only shows a general text. The invitation page is not indexed by search engines, sets no cookies and loads no third-party content.

The invited person signs in and sends a request. As the owner of the trip you see their name and email address and decide whether to approve them. Only after your approval do they get access.

All members of a shared trip can see its content (including attachments) and edit it, but cannot delete the trip. All members see the names and email addresses of the other members. The owner can remove members at any time, and members can leave the trip at any time (“Leave trip”). What a member has already entered stays in the trip.

Change history of shared trips: So that we can trace who changed what in case of errors or disagreements, our server stores the following for every change to a trip with several members: which account created, changed or deleted which entry, when, with which app (iOS, Android or web app) and which app version, whether the server accepted the change, and the previous and new value of the field. We also record who invited, approved or removed people, who accepted, declined or withdrew an invitation, who left the trip and to whom ownership passed (with the name from the invitation, but without its email address). For email addresses and other details of participants (except the name and the cost split), notes and other free text, flight and booking numbers and the content of attachments, we do not store the value, only the fact that it was changed. We do not store the IP address, device identifier or location for this. Personal packing lists, saved places and trips without other members are not affected. The history is not shown in the app; we only look at it when this is necessary for a support request or to fix an error. It is deleted automatically after 90 days, and immediately when the trip is deleted; if you delete your account, we remove your account identifier from the history. The legal basis is our legitimate interest in reliable operation and in clearing up errors and disagreements (Art. 6(1)(f) GDPR). You can request information about your entries in the history at privacy@hellokiwi.app.

Linking participants to accounts: In a shared trip, you can link a participant of the trip to your account; the owner can also link participants to other members’ accounts. If you, as the owner, invite someone directly from the list of participants, the invitation belongs to that participant: before sending their request, the invited person sees which participant they will join as, and when you approve, we automatically link their account to that participant. All members of the trip can see which account is linked to which participant; you can remove a link to your account at any time. We use the link only so that the participant’s name is shown with ratings of saved places (see below) and so that reminders and notices about trip content assigned to a participant (such as tasks) appear on that person’s devices – as a notification from the device or, in the web app, as a notice at the top of the page, not as a push notification. We also store, for each task, which account created it. This only serves to send the reminder to that person if nobody is assigned to the task or none of the assigned participants is linked to an account; the members then see this person in the task as the recipient of the reminder. If a member leaves the trip, is removed or deletes their account, we remove their links and enter the trip owner as the creator of their tasks.

Rating saved places: If you rate a saved place with 1 to 5 stars, we store the rating with your account; only you can change or delete it. In a shared trip, all members see the average and each individual rating. If your account is linked to a participant of the trip, your rating shows that participant’s name, otherwise no name; we do not show account names or email addresses there. If a member leaves the trip, is removed or deletes their account, we delete their ratings.

If the owner deletes their account, the trip passes to the member who has been involved the longest; if there is none, it is deleted.

Please do not pass on third-party data without their consent. Check the name and email address of the requesting person before every approval.

Reports of content: If you report content (“Report content” or by email to dsa@hellokiwi.app), we store on our server (sync.hellokiwi.app, data centre in Spain) your account or your name and email address, the trip and – if provided – the member and content concerned, the reason, your explanation, the time and our decision. A notification with this information, but without the reported content itself, is sent to our support mailbox (Microsoft 365); we send you the confirmation of receipt by email. We do not tell the person concerned who reported them, unless we are legally obliged to do so. If we take a measure (such as deleting content or making it inaccessible, or suspending an account), we store it together with the reasons and send the person concerned an email. If necessary, we keep reported content as evidence, even if the account or trip concerned is deleted. If there is a suspicion of a criminal offence that threatens people’s life or safety, or of child sexual abuse material, we pass the necessary information on to the competent authorities. Legal bases: our obligations under the Digital Services Act (Art. 6(1)(c) GDPR in conjunction with Art. 16–18 DSA) and our legitimate interest in keeping HelloKiwi free of illegal content and defending against claims (Art. 6(1)(f) GDPR).

7. Web app (app.hellokiwi.app)

The web app lets you use HelloKiwi in your browser. With an account, it syncs your trips via the HelloKiwi server like the apps (see “Synchronisation”); without an account, you can try it out as a demo (see “Demo without an account”). The web app keeps trip data only in the memory of the open tab; it is not stored permanently in your browser.

Sign-in: You sign in with Apple, Google or an email code. You are only redirected to Apple or Google when you click the respective button; before that, the sign-in page loads nothing from these providers. After a longer period of inactivity, the web app signs you out automatically.

Cookies and browser storage: The web app only stores what it needs to work; this does not require consent (Art. 22(2) LSSI):

Only if you agree to usage statistics is a visitor identifier added (see “Usage statistics (Matomo)”). There are no advertising or tracking cookies.

Content via our servers: The web app loads place search and places from OpenStreetMap (Geoapify), weather (Google Weather), AI features (Anthropic), flight information (AeroDataBox), Viator offers including images, map tiles (OpenStreetMap) and content from Wikipedia and Wikidata via our servers. The providers do not see your IP address. Our server caches retrieved content (map tiles and images up to 30 days, Wikidata 7 days; for Wikipedia see below); this cache contains no information about you. To prevent misuse, the number of requests per account and day is limited, in the demo per internet connection (see “Demo without an account”).

Places nearby (Google): If you open “Places nearby” for a destination or the web app shows a saved Google place, your browser loads content directly from Google (see “Recipients”, “Places nearby (Google)” and “Saving places”).

Demo without an account: With “Try without an account” you can test the web app without signing in; it creates a sample trip for this. Your entries stay only in the memory of the open tab and are not sent to the HelloKiwi server; they are neither stored in your browser nor transferred to an account and are deleted when you close or reload the tab. Place search, weather, AI features, flight information and Viator offers run via our servers to the providers named above, as described; “Places nearby” and saved Google places are loaded by your browser directly from Google in the demo too (see “Places nearby (Google)”). For the requests via our servers, the open tab receives a random demo pass that is not linked to you; it is valid for 10 minutes and is not stored in your browser. To prevent misuse, our servers count demo requests per internet connection; the IP address is used for this only as a hash value with a daily changing random key in memory and is deleted at the end of the day at the latest. Sharing, inviting and “Write a review” are not available in the demo. The legal basis is the provision of the demo you requested (Art. 6(1)(b) GDPR) and, for the limits, our legitimate interest (Art. 6(1)(f) GDPR).

Write a review: Under “Settings → Write a review” you can rate HelloKiwi with 1 to 5 stars and optionally add a text (up to 2000 characters); this is only possible when signed in, to prevent abuse. In the apps, the same row takes you to the App Store or Google Play. Our server (sync.hellokiwi.app, data centre in Spain) stores the stars, text, language, platform and time – without account ID, email address or IP address – and sends the same data by email to our support mailbox (Microsoft 365). To allow at most one review per account per day, the server counts your account ID only as a hash value in memory; it is forgotten after 24 hours or a restart. If you have agreed to usage statistics, they also record that you sent a review and with how many stars (without the text). We analyse the reviews to understand how satisfied our users are. We may show the average star rating and individual texts without names on our website; we do not publish personal details from texts. Please still do not write names or other personal details in the text. Because we do not link a review to your account, we can only find it if you tell us the date and roughly what it said; we will then delete it on request (support@hellokiwi.app). The legal basis is our legitimate interest in improving HelloKiwi and showing reviews (Art. 6(1)(f) GDPR); you can object at any time (Art. 21 GDPR). Stored reviews are deleted automatically after 2 years.

Usage statistics: When you first open it, the web app asks whether you agree to usage statistics (see “Usage statistics (Matomo)”).

8. Legal bases

9. Recipients and third-party services

We only pass on data where this is necessary to provide the functions:

Requests to Anthropic, Google Places (older iOS versions), Google Weather, Geoapify, AeroDataBox and Viator go through our relay server (api.hellokiwi.app): the providers receive the request, but not your IP address. In the web app, our servers also fetch map tiles, content from Wikipedia and Wikidata and Viator images for you, and in the apps from iOS 1.6.4 or Android 1.3.5 content from Wikipedia and Wikidata and Viator images, so these providers do not see your IP address either. Sign-in with Google and Apple, in app versions before iOS 1.6.4 or Android 1.3.5 the queries to Wikipedia and Wikidata, the Apple services on iOS, in the Android app loading map tiles (on iOS via Apple), in these older app versions loading Viator images (Tripadvisor), and in the web app and the apps “Places nearby” and saved Google places (see below) are made directly from your device – your IP address is then visible to the provider. If you open a map, Wikipedia or booking link, the provider’s page or Google Maps is opened. For an accommodation or activity, you choose the map service under “Open in Maps”: Apple Maps or Google Maps on iOS, a maps app on your device on Android, Google Maps or OpenStreetMap in the web app. Only when you tap it are the name and address of the accommodation or activity (and the coordinates for a hotel chosen via the search) passed to the chosen service, which sees your IP address. The website and phone number you enter for an accommodation or activity open directly in your browser or phone app, not via our servers. Our HelloKiwi server determines the time zone of a destination, port or place itself from its coordinates, using its own time zone data from OpenStreetMap; no other service is contacted, and the coordinates are neither stored nor logged. If an activity has a place that is not one of the trip’s destinations, the app first looks it up via the place search (Geoapify). The time zone is only stored when you save the activity.

Places nearby (Google): If you open “Places nearby” for a destination in the web app or the apps, your browser or the app loads the list with photos, ratings and opening hours directly from Google’s servers (Google Places UI Kit; in the apps via Google’s Places SDK); the app points this out there. The same applies when a saved Google place is shown, for example in the trip overview, including one saved by another member of the trip. Google receives your IP address, information about your browser or device (e.g. operating system version and device model), in the apps the app’s identifier and an identifier of the Google SDK, the coordinates of the destination as the search location with radius and category, the language and your selection; the Places SDK also sends usage data (on Android also crash data) to Google (information from Google). We do not use your location; the apps have no location permission. The apps receive the key needed for this from our server, also without signing in; to prevent misuse, the server counts retrievals without sign-in per internet connection, using the IP address only as a hash value in memory and deleting it after one day at the latest. Older iOS versions (up to 1.4.9) load “Places nearby” via our server instead. Google processes this data as an independent controller under Google’s Privacy Policy, including in the USA (EU-US Data Privacy Framework); whether Google stores data in your browser is Google’s responsibility. The legal basis is providing the feature you called up (Art. 6(1)(b) GDPR) or our legitimate interest in showing saved places with up-to-date information (Art. 6(1)(f) GDPR). As long as you do not open “Places nearby” and no saved Google places are shown, nothing is transmitted to Google.

Saving places: If you save a place from Google, we store in the trip only Google’s identifier of the place (place_id), our category and the time, plus your own entries (e.g. note, rating, period, participants, attachments). We do not store Google’s names, photos or ratings; they are loaded again from Google when shown. For your own places, we store the name and address and – if you choose it via the search – the coordinates and Geoapify’s identifier of the place. Saved places are synced with the trip and visible to its members.

AI features (Anthropic): You start the packing list assistant yourself at the push of a button. For this we send Anthropic (Claude) the trip title, the period, the number of participants, the destinations (city, country code), the selected trip themes and means of transport, up to 250 standard items of the selected trip themes (to avoid duplicate suggestions), when generating again the AI’s previous suggestions, and the app language; we do not send your own packing list items. Using the country codes of the destinations, we also look up commonly used currencies. HelloKiwi fetches country information automatically when you select a destination or open its page and no information has been saved yet; for this we send the country code, the coordinates of the destination and the app language. HelloKiwi fetches flight information automatically when you save or view a flight with a date and no information has been saved yet; for this we send the airline, flight number, departure and arrival airports including terminal and gate, departure and arrival dates and the app language. For the packing list assistant we also send your home country (country code from the language or region setting of your browser or device), for each destination the coordinates (rounded to 2 decimal places) and start and end dates, for flights the airline, departure and arrival airports and date (no flight number), for cruises the cruise line, ship, ports of embarkation and disembarkation and dates, for trains the departure and arrival stations and departure time, the names of your accommodations with their period, the titles of your activities with their date and the names of up to 15 of your “Liked Places” with their destination (without descriptions, addresses or notes); the commonly used currencies come in the same request. For country information via Anthropic we also send, in a single request, the start and end dates of your stay at the destination, if entered. Our server caches the generated information, without any details of who asked, and returns it for an identical request: flight information per flight number, route, date and language for 7 days, country information per approximate position (about 20 km), country, language and month of the start of the trip for 30 days. Names of people, email addresses, addresses or account data are not transmitted; because trip titles and destination names (and, for the packing list assistant via Anthropic, accommodation names, names of “Liked Places” and activity titles) can be free text, please do not enter personal data there, in particular no names of other people and no health information. The content is used only to create the respective suggestions; the results are saved in the trip and are visible to its members. To improve the packing list assistant, our server counts how often an AI suggestion is shown, accepted, renamed or removed; only monthly totals per AI suggestion text, language, section and trip theme, means of transport or country are stored, without any reference to you, your account or your trip and without any text you entered (legitimate interest, Art. 6(1)(f) GDPR). According to the providers, the transmitted content is not used to train models, but may be stored briefly to detect misuse. You can report AI content with “Report content”. In the apps from iOS 1.6.4 and Android 1.3.5 and in the web app, this opens the same form as for shared trips, with the additional reason “False or misleading”. We store the report as described under “Reports of content”, together with the type of AI content (country, currency and flight information or packing list assistant) and the destination, flight or trip concerned, but not the AI text itself. The legal basis is our legitimate interest in checking and improving the AI features (Art. 6(1)(f) GDPR). In older app versions, an email to support@hellokiwi.app opens instead.

10. Server logs (log files)

Technical logs are created when our servers are accessed. They contain the time, the requested path, the response code and a shortened IP address (for IPv4 without the last byte); on the relay server (api.hellokiwi.app) and on our HelloKiwi server (sync.hellokiwi.app) also the identifier of the app or browser (user agent). Error and security logs (server errors, firewall, login attempts on the server) may contain the full IP address. All logs are deleted after 7 days at the latest. The hosting provider may keep its own logs. From the log of the HelloKiwi server we create app start statistics (see “Usage statistics (Matomo)”).

Website (www.hellokiwi.app): For visits to our website, the log also contains the previously visited page (referrer) and the browser identifier (user agent); for IPv6 addresses only the first three blocks are kept. We create visitor statistics from this log (see “Usage statistics (Matomo)”). The website sets no cookies, loads no content from third parties and only sends statistics data with your consent (see “Usage statistics (Matomo)”); links to the App Store and Google Play only take effect when you click them.

Web app (app.hellokiwi.app): For the web app, our web server keeps the same log as for the website (shortened IP address, previously visited page, browser identifier, 7 days). It also contains the requests our server makes to third parties on your behalf (map tiles, Wikidata, Viator images; from iOS 1.6.4 or Android 1.3.5 also for the apps); the requested path may contain the search term, usually the name of the destination. This log is not used for the website visitor statistics.

The purposes are operation, troubleshooting and defence against attacks (legitimate interest). To limit requests, the IP address is used briefly in memory. These legal texts are served without an access log.

11. Storage & retention

We store data only for as long as it is necessary for the respective purpose.

12. Your Rights

www.aepd.es

How to exercise your rights: In the app’s Settings you can download your data with “Export my data” (on Android as a ZIP with a readable overview, a machine-readable JSON file and all attachments; on iOS as a machine-readable JSON file) and delete your account with “Delete account and server data”. You can also contact privacy@hellokiwi.app – even if the app is no longer installed.

13. Third countries

Our servers are located in the EU (Spain, Germany). Some third-party services may process data outside the EU, in particular in the USA (e.g. Anthropic, Apple, Google, Microsoft, Wikimedia, Viator/Tripadvisor). Such transfers take place only on the basis of recognised safeguards, such as an adequacy decision of the European Commission (EU-US Data Privacy Framework) or the EU Standard Contractual Clauses.

14. Security

15. Usage statistics (Matomo)

If you agree, we use the open-source software Matomo to record how the app is used, so that we can improve it where it matters. The app asks you on its first start (older versions on the second start): in older iOS versions (up to 1.4.9) with two equal buttons (“No thanks” and “Sure”), otherwise with the categories “Essential” (always active) and “Analytics” and the buttons “Accept all”, “Reject all” and “Save selection”. Nothing is preselected; “Save selection” without a tick at “Analytics” counts as a refusal. Without your consent the app sends no usage data to Matomo; only the app start statistics based on our server logs also run without consent (see below). Your decision applies to the respective device and is not synced with your account.

Matomo runs exclusively on our own server (track.hellokiwi.app) in a data centre in the EU. There is no disclosure to third parties and no transfer to third countries.

What is recorded:

What is not recorded: no content such as trip titles, names, email addresses, places, amounts, notes or packing list items, no account ID and no advertising ID. There is no cross-app or cross-platform tracking.

Legal basis: your consent (Art. 6(1)(a) GDPR; for storing the identifier on your device Art. 22(2) LSSI (Spain)).

Withdrawal: You can withdraw your consent at any time in the settings under “Privacy → Usage statistics”. The app then stops sending, and the identifier and any unsent data are deleted from your device.

Retention: Raw data is deleted automatically after 13 months. Aggregated statistics without reference to individual users may be kept longer.

Older iOS versions (up to 1.4.x) send anonymous usage analytics without a stored identifier. This data is stored separately and is also deleted after 13 months.

Web app: The web app asks when you first open it with “Accept all”, “Reject all” and “Customize” (categories as in the apps, “Analytics” not preselected) and again after 24 months; you can change your choice at any time via “Cookie settings” at the bottom of the page; the choice applies to the respective browser. Only after you agree does it store the random identifier in your browser’s storage; it is deleted when you withdraw consent in the settings. It records screens and features, platform “Web”, version, sign-in method, app language, browser language and screen resolution as well as the browser identifier (user agent) that your browser sends; no device model is transmitted. If your browser sends “Do Not Track”, nothing is recorded. Otherwise, everything said above applies.

App start statistics (iOS and Android): When it starts, and occasionally afterwards, the app loads the current packing list templates from our HelloKiwi server (sync.hellokiwi.app); the app needs this to work. Our own statistics server regularly reads the new entries from the access log of these requests, also without your consent. The app does not store anything on your device for this and does not send anything extra. The web app is not counted.

What is analysed:

Matomo combines requests on the same day into one visit based on this information; visits are not linked across several days. Other requests, such as syncing your trips, are not analysed; account and trip identifiers, content and advertising IDs do not appear in the app start statistics. They are linked neither with the usage statistics nor with your account.

Purpose and legal basis: We want to see how many devices start the app each day, in which countries and with which version – including new users who have not been asked yet and users who have not agreed to the usage statistics. This is our legitimate interest (Art. 6(1)(f) GDPR). Raw data is deleted automatically after 13 months; aggregated statistics without reference to individual users may be kept longer.

Objection: You can object to the app start statistics at any time (Art. 21 GDPR) by emailing support@hellokiwi.app. Tell us your IP address and we will exclude your truncated IP address range from the analysis (other devices from the same range may also be excluded).

Website visitor statistics (www.hellokiwi.app): For our website we use Matomo without a script and without cookies. Nothing is stored on or read from your device for this, which is why we do not ask for consent. Instead, our own statistics server in Germany regularly imports the new entries from the website’s access log (see “Server logs”).

What is analysed: time, page requested, response code, previously visited page (referrer), browser identifier (user agent) and the IP address already truncated in the log (IPv4 without the last byte, IPv6 only the first three blocks). Matomo truncates it further to two bytes when importing and uses it to determine the approximate location (country, region and city). Matomo groups requests from the same day into one visit based on these details; visits are not linked across days. Requests from bots are filtered out. The visitor statistics are linked neither to the app’s usage statistics nor to your account.

Purpose and legal basis: We want to see which pages are read and how visitors find us, so we can improve the website. This is our legitimate interest (Art. 6(1)(f) GDPR). Raw data is deleted automatically after 13 months; aggregated statistics without reference to individual visitors may be kept longer.

Objection: You can object to the visitor statistics at any time (Art. 21 GDPR) by emailing support@hellokiwi.app. Because the statistics contain no names or accounts, we can only recognise you by your truncated IP address range: tell us your IP address and we will exclude that range from the analysis (this may also exclude other visitors from the same range).

Additional statistics with consent (www.hellokiwi.app): On your first visit, the website asks you with “Accept all”, “Reject all” and “Customize” (“Analytics” not preselected) and again after 24 months; you can change your choice at any time via “Cookie settings” at the bottom of the page; the choice applies to the respective browser and is stored there so that we do not ask again on every visit. Only if you agree does a small program of the website itself (no Matomo script, no cookies) send data to our server track.hellokiwi.app on each page view. For this, your browser stores a random identifier, the date of your first visit, the number of your visits and the time of your last page view in local storage (localStorage) so that we can recognise returning visits.

What is recorded:

This data is stored separately from the visitor statistics based on server logs and is linked neither to the app’s usage statistics nor to your account. If your browser sends “Do Not Track”, nothing is recorded.

Legal basis and withdrawal: your consent (Art. 6(1)(a) GDPR; for storing the identifier in your browser Art. 22(2) LSSI (Spain)). You can withdraw it at any time via “Cookie settings”; the website then sends nothing more and the identifier is deleted from your browser. Raw data is deleted automatically after 13 months. The visitor statistics based on server logs continue independently of this (see above).

Crash reports from Apple and Google: The apps do not contain their own tool for crash or diagnostic reports. If you have allowed sharing analytics with app developers in your device settings (iOS) or sending usage and diagnostics data to Google (Android), Apple (App Store Connect) or Google (Google Play Console) provide us with crash reports and technical metrics, such as device model, operating system and app version and the state of the app at the time of the crash. We do not receive trip content or account data in this way; we cannot attribute the reports to any person and use them only to fix errors. Apple or Google are responsible for collecting this data; you can change the setting on your device at any time. The legal basis for our use is our legitimate interest in an error-free app (Art. 6(1)(f) GDPR).

16. Feedback form and email contact

You can use the feedback form on www.hellokiwi.app to send us outages, bugs, wishes or questions. You submit the type of your request and your message, and optionally your operating system, device type and an email address. The website language is sent along. Without an email address we cannot reply to you.

The form is sent to our server (sync.hellokiwi.app, data centre in Spain). It forwards the details by email to our support mailbox (support@hellokiwi.app, Microsoft 365). If you entered an email address, you receive an automatic confirmation of receipt (at most one per day; for this the address is only counted as a hash in memory). The server keeps no access log for the form; your IP address and browser identifier are not stored and no cookies are set. To prevent abuse, the server counts requests in memory for at most one hour, using your IP address only as a hash with a changing random key.

Analysis for help texts: In addition, we store the type, operating system, device type, language, text and date of your message on the server – without your email address. This lets us identify frequent questions and improve help texts. Your message itself is never published. Please do not put names, addresses or other personal details in the text that we do not need for your request.

If you email us directly (e.g. support@ or privacy@hellokiwi.app), we process your email address, your message and any details you provide only to handle your request. Please do not send us passwords or health data.

Legal basis: our legitimate interest in answering enquiries and improving HelloKiwi and its help texts (Art. 6(1)(f) GDPR); if your request concerns your account or the use of the app, Art. 6(1)(b) GDPR. You can object to the analysis at any time (Art. 21 GDPR).

Retention: we keep messages and our replies in the support mailbox for as long as we need them to handle your request and any follow-up questions. After that we delete them unless statutory retention obligations apply. Form messages stored on the server are deleted automatically after 2 years. On request we delete your message sooner: write to support@hellokiwi.app and give the date and rough content, because without an email address this is the only way we can find it.

Our channels on TikTok and YouTube: HelloKiwi has its own channels on TikTok and YouTube. When you visit them, the operators (TikTok Technology Limited, Ireland; Google Ireland Limited, Ireland) process your data under their own privacy policies (TikTok, Google), also in third countries. From TikTok and YouTube we only receive aggregated statistics on the use of our channels (e.g. views, reach, approximate origin and age groups), no information about individual people. For TikTok’s statistics we are joint controllers with TikTok (Art. 26 GDPR); under the agreement with us, TikTok takes on the main obligations, in particular providing information and handling your rights – but you can also contact us. If you write to us or comment there, we process your username and your message in order to reply. The legal basis is our legitimate interest in making HelloKiwi known and getting in touch with you (Art. 6(1)(f) GDPR). The app, the web app and our website do not embed any content or functions from TikTok or YouTube; they only contain links to our channels.

17. Obligation to provide data

You do not have to provide us with any data to use the app locally. An account, sync and sharing require sign-in (Apple, Google, email code or passkey); without it, these features are not available. Usage statistics are voluntary. Some features also need certain information or permissions (e.g. reminders without notification permission, flight information without a flight number).

18. Device access

The app may request the following permissions – only when you use the function; you can revoke them at any time in the system settings:

19. No tracking (advertising & profiles)

The app uses no advertising tracking SDKs, no advertising profiling, no advertising networks and no cross-app or cross-site tracking.

The app’s usage statistics only run with your consent; without consent, the app start statistics and the website visitor statistics only analyse truncated server logs; additional website statistics only run with your consent (section “Usage statistics (Matomo)”). All of them run on our own server and are not combined with data from other providers.

This also applies to the web app: it loads no advertising or tracking scripts, and its usage statistics also only run with your consent.

20. Changes

Adjustments are made when services or legal requirements change. See the header for the latest update.

Contact

privacy@hellokiwi.app

Version 2.37 • Document ID: HK-PRIV-2026-10-28-EN

↑ Back to top