DPRT is a travel itinerary application operated by NVWL LLC ("we", "us", or "our"), a Nebraska limited liability company. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.
By using DPRT, you agree to the practices described in this policy. If you do not agree, please discontinue use of the application.
Account information. When you sign in, we collect your email address. We do not collect your name, phone number, or payment card details directly — payment processing is handled by Google Play, the Apple App Store, or Stripe, with subscription status managed by RevenueCat (see Section 4). If you invite someone to a trip, or someone invites you, your email address is visible to the people on that trip.
Trip and itinerary data. We store the trips and events you create, including event names, dates, times, durations, locations, addresses, GPS coordinates, timezone information, travel routes, notes you add to events, any packing list items you create for a trip, and the event reminder times you set. This data is stored locally on your device and, if you are signed in, synced to our cloud database.
Collaboration. If you invite another DPRT user to a trip, or are invited to one, we store that membership (which trip, which accounts). Everyone on a trip can view and edit its events, dates, notes, and packing list, and can see an activity log showing which collaborator made each change, identified by email address. Only the person who created a trip can rename it, share it, or manage its collaborators. If you have notifications enabled, an invited user receives a notification naming the trip and the inviter's email address.
Authentication metadata. Supabase, our authentication and database provider, automatically records your account creation timestamp, last sign-in time, and a unique user identifier (UUID) when you sign in.
Location search and travel times. When you search for a location in DPRT, your search query is sent through a server-side proxy we operate. On the free plan, address searches are answered by LocationIQ, which uses OpenStreetMap data. With a DPRT First subscription, business and venue searches are answered by the Google Places API. When DPRT calculates a travel time between two places, the start and end locations are sent through our proxy to the Google Routes API. GPS coordinates are also sent, via the same proxy, to Google's Geocoding API to resolve a location to a city name, and directly to open-meteo to determine the correct timezone and to retrieve weather information (current forecasts, historical weather, and multi-year averages) for the places and dates in your itinerary. These providers log requests in accordance with their own privacy policies. We do not request or collect your device's own location.
Push notification tokens (mobile app only). If you enable notifications in the DPRT mobile app, we collect a device-specific push token and store it so we can deliver timely reminders for flights, trains, and other time-sensitive events. This token is used with Firebase Cloud Messaging, a Google service, to deliver the notification to your device. We do not use this token for any purpose other than sending you notifications you've enabled, such as event reminders and notices that you were added to a trip. The token is removed from our systems when you sign out of the app on that device.
Shared itinerary data. If you enable sharing for an itinerary, we host a read-only version of that itinerary (including a calendar file) at a unique URL. This content is accessible to anyone who has the link until you disable sharing. If you subscribe to your itinerary in a calendar app, your calendar app regularly requests your itinerary from a link containing a private token; anyone with that link can see the itinerary's events, so treat it like a password.
Purchase information. If you subscribe to DPRT First, the payment is processed by Google Play (on Android), the Apple App Store (on iOS), or Stripe (on the web). We never receive your card number. RevenueCat receives your account's unique identifier and your subscription status so we can unlock paid features, and we store whether your subscription is active and when it expires.
Analytics. We use self-hosted Plausible Analytics to understand how DPRT is used. Plausible is privacy-first: it sets no cookies, collects no personal data, and does not track you across sites or devices. We collect anonymous behavioral signals only — for example, whether a trip was created, which event types are used, and whether the upgrade flow was completed. Your IP address is anonymized before storage and never recorded. We host Plausible on our own server; your data never leaves our infrastructure or reaches a third-party analytics service. The same analytics apply on the website and in the mobile app.
We do not sell your personal information. We do not use your data for advertising.
Your trip data is stored locally on your device using your browser's or the app's local storage. If you are signed in, it is also stored in our cloud database hosted by Supabase (Supabase, Inc.), which uses industry-standard encryption in transit and at rest.
Your account is protected by one-time passcode authentication — we do not store passwords. We implement row-level security policies in our database so that only you can access your own trip data.
No method of electronic transmission or storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.
We share personal data only with three kinds of parties: (a) service providers that process it on our behalf to run DPRT — cloud hosting and database, subscription and payment processing, mapping, geocoding and routing, weather, and push notification delivery; (b) other people you choose to share with, such as collaborators you invite and anyone you give a share or calendar link to; and (c) authorities, where we are required to by law. We do not sell your personal information and do not share it for advertising.
DPRT uses the following third-party services. Each is governed by its own privacy policy:
We retain your account and trip data for as long as your account is active. Deleting a trip removes it, along with its notes, packing list, reminders, and activity log, from our database, and any share or calendar link for that trip stops working.
How to delete your DPRT account. In the DPRT app or on the website, sign in, open the menu, choose Delete account, and type DELETE to confirm. Deletion takes effect immediately. If you cannot sign in, email support+DPRT@support.nvwl.app from the email address on your account with the subject "DPRT account deletion", and we will delete your account within 30 days.
What is deleted. Your account and email address, every trip you created (including its notes, packing list, event reminders, and activity log), your collaborator memberships, your notification settings and device tokens, and your subscription status record in our database. People you shared a trip with lose access to it. Trips other people own, which you edited as a collaborator, stay with their owners, and your past edits may remain in those trips' activity logs.
What may be kept. We may retain limited records that we are required to keep by law. Google, Apple, Stripe, and RevenueCat keep their own transaction and subscriber records under their own policies. Deleting your account does not cancel a subscription billed by a store, so cancel it first through Google Play, the Apple App Store, or Stripe.
Local data stored on your device is controlled by you and can be cleared at any time through your browser or device settings.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at support+DPRT@support.nvwl.app. We will respond within 30 days.
If you are located in the European Union or United Kingdom, the following additional provisions apply.
Lawful basis for processing. We process your personal data on the following legal bases: (a) performance of a contract — to provide the DPRT service you have requested; (b) legitimate interests — to maintain and improve the application, detect fraud, and ensure security; and (c) consent — where you have explicitly agreed to specific processing (such as sharing an itinerary).
Data transfers. Your data may be transferred to and processed in the United States, where our service providers (Supabase, RevenueCat, Stripe, Google, LocationIQ) operate. These transfers are made under appropriate safeguards including standard contractual clauses.
Right to lodge a complaint. You have the right to lodge a complaint with your local data protection authority.
If you are a California resident, you have the right to know what personal information we collect, to request deletion of your personal information, and to opt out of the sale of your personal information. We do not sell personal information. To exercise your rights, contact us at compliance@nvwl.app.
DPRT is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at compliance@nvwl.app and we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this page. Continued use of DPRT after changes are posted constitutes acceptance of the updated policy.
NVWL LLC
Nebraska, United States
Privacy inquiries: compliance@nvwl.app
General support: support+DPRT@support.nvwl.app