Skip to content
Jourimo

Legal

Privacy policy

Last updated 5 Oct 2026

Jourimo is a planning tool, not an advertising platform. We use no analytics or tracking tools, embed no ad networks, load no fonts from third-party servers and set no third-party cookies. What we store is what planning a trip needs — and you can export or delete all of it at any time. The German version of this page is the authoritative one.

1. Controller

Jens Willems
Talstr. 15
50997 Köln
Deutschland
admin@jourimo.de

A data protection officer need not be appointed under Art. 37 GDPR and § 38 BDSG. Please send privacy questions to the address above.

2. What we process

AreaData
Account
E-mail address, display name, language, time of last sign-in. With our own sign-in also a password hash (scrypt) — the password itself is never stored. With Google sign-in an identifier from the sign-in service instead.
Consent
A record of your consents (terms, privacy, personalisation, location, marketing e-mail) with the time and the version of the document.
Travel profile
Home airports, preferred airlines, maximum flight and driving times, accommodation types, budget level, climate preferences, preferred regions, usual number of travellers.
Trips
Title, dates, trip type, stops, day plans, activities, notes, budget, your travel diary, what you ticked off, struck off or added on your packing list, and the feedback you give afterwards. The travel diary is visible only to you and is not shown when you share the trip.
Learned travel model
Preferences derived from your trips and feedback. Created only while personalisation is switched on in your privacy settings.
Searches
Flight and accommodation searches you triggered, with their results. They act as a cache so the same search does not hit the provider twice.
Technical logs
Requests to our servers produce log data: IP address, time, path, status code, browser identification. Our own application logs contain no tokens, passwords, e-mail addresses or coordinates and record paths without query parameters.

We ask for your location only if you allow it in the privacy settings and your browser grants it. It is used for the feature at hand and not stored permanently. Coordinates are rounded before a weather service sees them.

3. Shared trips

When you share a trip, we create a public page at your request under a randomly generated address (jourimo.de/r/…). Anyone who has the link can open it. Unless you untick it when sharing, search engines may list the page, so others can come across it too; you can change this at any time. The page is a copy of your plan at the time you shared it; later changes to your trip only appear there once you update the page.

AreaData
On the page
Title, your optional description, trip type and means of transport, number of nights, destination, stops with their nights (coordinates rounded to about a kilometre), day plan, activities with freely licensed images, and whether the trip has already been made. Your display name only if you explicitly choose so when sharing.
Never on the page
Travel dates, number of travellers, budget, notes, departure airport, chosen flights and prices, booking links, skipped activities, your feedback on the trip and your e-mail address.

If someone takes your trip over, a separate private trip with their own dates is created in their account. It is not connected to your account, and you are not told who took it over.

To tell whether shared trips are used, we count views and takeovers. For each event we store only its kind, the time, the channel the link was shared through (such as WhatsApp, where the link says so) and, for a takeover, whether the account was newly created for it. We do not store who opened the page — no account, no IP address, no device characteristics — and nothing is stored on the viewer’s device for this. You see the number of views and takeovers of your page.

If someone without an account taps “Take over this trip”, their browser keeps the address of that trip in local storage until sign-up is complete, for at most 24 hours, so they come back to it afterwards. This happens only on that action and is strictly necessary for it (§ 25 (2) no. 2 TDDDG).

Trip ideas without an account (jourimo.de/ideas): your answers — what the trip should be about, the country or the starting point with the longest drive, the length, the way of travelling and the month — are sent only to work out the suggestion and are not stored; they are in the page address. A town from our own list is enough as a starting point. If you tap “Use my location”, your browser asks for your permission; the location is rounded to about a kilometre before it is sent and used only for the drive times. Our map service works these out from the rounded coordinates, without any information about you. If you sign up to keep an idea, your browser keeps its address in local storage for at most 24 hours as described above (§ 25 (2) no. 2 TDDDG); the interests in it are preselected in onboarding and stored only when you confirm that step. You can skip onboarding and finish it later. When you are signed in, a trip idea takes your travel profile into account like the other suggestions: your stated interests and driving day always, learned preferences only while personalisation is on. Your profile is not changed by it.

Photo book: the photos you choose for a photo book are read, arranged and turned into a PDF on your device only; they are not sent to us or anyone else. So that you can come back to the draft, your browser keeps reduced copies and the draft in local storage (IndexedDB) until you delete it, at most 30 days. This happens only on your choice and is strictly necessary for it (§ 25 (2) no. 2 TDDDG). Diary texts in the book come from your account. For the pages with what you did, your device loads the pictures from our catalogue from Wikimedia Commons, as the trip page does too, and keeps them with the draft; you can leave these pages out. Facts about these places (such as when they were built or their style) and the opening of their Wikipedia article are looked up by our server at Wikidata and Wikipedia; only the places’ identifiers and the articles’ titles are sent, nothing about you.

Anyone can report a shared page, for instance because of personal information or spam. We store the reason, an optional note and the time — not who reported it. After a review we can remove a page from search engines or take it down.

You can stop sharing at any time. The page, its counts and reports are then deleted immediately and the link stops working; if you share again later, a new address is created. The same applies when you delete the trip or your account. Search engines that had already listed the page may still show it for a few days until they notice it is gone. Trips others have already taken over remain theirs.

4. Purposes and legal bases

PurposeLegal basis
Running the account, signing in, keeping the session
Art. 6 (1) (b) GDPR (contract)
Planning, storing, printing and sharing trips
Art. 6 (1) (b) GDPR (contract)
Publishing a shared trip, letting search engines list it and letting others take it over
Art. 6 (1) (b) GDPR (contract), at your request
Reviewing reports about shared trips
Art. 6 (1) (f) GDPR (legitimate interest in removing unlawful content or other people’s personal information)
Counting views and takeovers of shared trips
Art. 6 (1) (f) GDPR (legitimate interest in knowing whether the feature is used); nothing is stored that points to a person
Flight and stay search on your explicit action
Art. 6 (1) (b) GDPR (contract)
Learning suggestions from your behaviour (personalisation)
Art. 6 (1) (a) GDPR (consent) — switchable off at any time
Marketing e-mail
Art. 6 (1) (a) GDPR (consent) — withdrawable at any time
Location-based features
Art. 6 (1) (a) GDPR (consent)
Operational security, abuse prevention, logs, audit trail
Art. 6 (1) (f) GDPR (legitimate interest in a secure service)
Forwarding to booking sites through affiliate links
Art. 6 (1) (f) GDPR (legitimate interest in funding the service)
Proving consent was given
Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR (legal obligation)

5. Cookies

Jourimo uses three cookies. All three are strictly necessary or are set only on your explicit choice, so no consent is required under § 25 (2) TDDDG. That is why there is no cookie banner. We set no third-party cookies.

CookiePurpose and lifetime
jourimo_at
Signed-in session. Readable by the server only, valid for 15 minutes.
jourimo_rt
Renews the session without you signing in again. Readable by the server only, sent to the sign-in endpoints only, valid for 30 days.
jourimo_locale
Remembers the language you chose. Set only when you actively pick one, valid for one year.

6. Recipients

We do not sell data and do not pass it on for advertising. Only the following services are involved, each for the stated purpose. Processing agreements under Art. 28 GDPR are in place with the processors.

7. Transfers outside the EU

Processing happens mostly inside the EU. With Supabase, Google and the Wikimedia Foundation access from the United States can occur; this rests on the European Commission Standard Contractual Clauses under Art. 46 (2) (c) GDPR, together with the EU-US Data Privacy Framework self-certification where the provider takes part in it. Switzerland (Open-Meteo) is covered by an adequacy decision. Hong Kong (Travelpayouts) is not; we send only search parameters there, with no personal reference. If you click an affiliate link you visit the destination site on your own responsibility.

8. How long we keep things

DataRetention
Account, travel profile, trips, learned model
Until you delete the account. Deletion is immediate and complete.
Shared trips, their counts and reports
Until you stop sharing, delete the trip or the account, or we take the page down after a report.
Sessions
At most 30 days; invalidated immediately when you sign out.
Flight and stay searches
Cached for 30 minutes; the records are purged regularly.
Server logs at the host
Thirty days by default.
Consent record and audit trail
After account deletion only an identifier without personal reference remains, for as long as proof is needed.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on a legitimate interest (Art. 21). Consent you gave can be withdrawn at any time with effect for the future.

Two of these rights need no detour through us: under “Settings” you can download everything stored about you as a file, and delete your account with all trips there as well. For anything else a message to the address above is enough.

You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence or of the alleged infringement. Ours is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

10. Automated decisions

Jourimo scores destinations and suggestions automatically from your profile and — where switched on — your learned model. The result is a recommendation with reasons, which you can take or leave. No automated decision producing legal effects or similarly significant consequences within the meaning of Art. 22 GDPR takes place.

11. Whether you have to provide data

An account needs an e-mail address and a display name; without them no account can be kept. Everything in the travel profile is voluntary — the less you enter, the more general the suggestions become.

12. Changes

We update this policy when the service changes — when another provider is added, for instance. The version published here, with the date above, is the one that applies.

Privacy policy · Jourimo