Sojourn Privacy Policy

Last updated: 22 July 2026

This Privacy Policy explains how the Sojourn app, including beta builds distributed through Apple TestFlight and releases distributed through the App Store as "Sojourn - Travel Tracker," handles information. The app itself is branded simply as "Sojourn." Sojourn is a residency-day and travel tracker for people whose lives span multiple borders.

The short version: your travel data lives in your own iCloud and on your device. We do not run a database of your travel history. We have no accounts and no login. The application data that reaches our own infrastructure is pseudonymous, opt-out usage analytics associated with a rotating analytics identifier, the bare minimum needed to look up a public flight schedule (a flight number, or a route and date), and, only if you choose to send feedback, your message, optional email, rating or category, and the app and iOS versions used to provide support. Cloudflare also necessarily receives network metadata, including the request IP address, when it carries these requests; the narrow ways that metadata is used and retained are described below.

This policy is written to be honest and specific to how Sojourn is actually built. Where it refers to "we," "us," or "Sojourn," it means Sacha Allard, the operator of the Sojourn app.

1. Who this applies to

This policy applies to everyone who uses Sojourn, anywhere in the world. Because Sojourn is built for people who track tax residency, many of our users are in the European Union and the United Kingdom. We have written this policy to align with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA). Your rights under those laws are described in Section 12.

2. What data we do, and do not, collect

We want to be precise, because "we collect almost nothing" is core to how Sojourn is designed.

We do NOT collect or store on our own servers:

Your trips, stays, or travel history
Your location or location history
Your trackers, residency calculations, or day-counts
Your passports, citizenships, or any document scans
Your boarding passes or flight records
Your name, account, or any login (Sojourn has no accounts). The one exception is the optional email you can type into the feedback form, and only if you choose to (see Section 6).
Your payment details (Apple handles all payments; see Section 9)

The data that reaches our infrastructure:

Pseudonymous usage analytics, if you leave analytics on. Events carry a rotating analytics identifier but no account, email, location, or travel history. See Section 5.
Feedback you choose to send, if you use the in-app feedback form. This contains your message, optional email, optional rating or category, and the app and iOS versions used for support context. See Section 6.
Flight lookup application fields, when you choose to look one up. These contain only a flight number, or a route and a date, and never a name, account, email, travel log, or Sojourn analytics identifier. Cloudflare also receives the request IP as network metadata and uses an HMAC-derived pseudonym for a short-lived abuse-prevention counter. See Section 7.
TestFlight beta diagnostics, while you use a beta build. Apple automatically collects and shares crash logs, usage information, device and OS context, and any TestFlight feedback you choose to submit. This is separate from Sojourn's in-app analytics setting. See Section 9.

Everything else stays under your control on your device and, where the app supports sync, in your personal iCloud account.

3. Where your data lives

Sojourn is built on a simple principle: your data is yours, and it stays with you.

On your device. Sojourn stores your travel log, tracker settings, passports, boarding passes, flight records, and document scans on your iPhone using Apple's on-device storage.
In your own iCloud where supported. In TestFlight Build 10, which is currently distributed to beta testers, supported travel-log records and document metadata sync through your personal iCloud account (Apple's CloudKit Private Database). Document image and PDF files, along with some device-specific settings, remain only on the device where you added them. CloudKit data is encrypted in transit and at rest by Apple, tied to your Apple ID, and unavailable to us. We do not have, and never receive, a copy. We will update this policy before distributing a replacement build if that storage boundary changes.
Never on a Sojourn server. We do not operate any database that holds your trips, locations, trackers, passports, or other personal travel information. There is no Sojourn account to create, and no Sojourn server that stores your travel data. The narrow analytics and optional feedback described in Sections 5 and 6 are separate from that travel log.

This is a deliberate architectural choice, not just a promise. Sojourn has no developer-accessible store for your personal travel data.

4. Location

Sojourn can sense your location on your device to help count the days you spend in each country, which is the heart of tax-residency tracking.

Sojourn receives location through Apple's Core Location. For eligible same-country significant-change checks, it can use a bundled on-device country map without a network geocode. Visit, initial, possible-crossing, and other resolution paths ask Apple's geocoding service first and fall back to the bundled map if geocoding fails or returns no country.
The resulting travel days are stored only on your device and in your own iCloud, exactly like the rest of your travel log (Section 3).
Your coordinates and location history are never sent to Sojourn's servers. They may be processed by Apple's Core Location and geocoding services as described above, but we do not receive, log, or store them. We have no map of where you have been.
Location access is requested through the standard iOS permission prompt, and you can change or revoke it at any time in the iOS Settings app. Sojourn also supports adding and editing trips manually, so you can use it with location turned off.

5. Analytics (pseudonymous, opt-out, and how to turn it off)

To understand which features are useful and prioritize improvements, Sojourn collects a small amount of pseudonymous usage analytics. It does not contain your name, email, Apple ID, account, location, or travel history, but events carrying the same identifier can be associated until it rotates.

What it is:

Pseudonymous, not tied to a real-world account. Analytics events do not contain your name, email, Apple ID, account, location, or travel history. They are associated with a rotating device-level identifier. For Apple's App Privacy disclosure, we declare Product Interaction and Device ID as Linked to the User because Apple includes association with a device in that definition. We do not use the identifier for advertising or cross-app or cross-site tracking.
An allow-list of events only. Sojourn can only send a fixed, pre-approved list of simple event names (for example, a record that a screen was opened). Anything not on that allow-list is rejected and dropped. Event details may only contain simple values (text, numbers, true/false), never structured personal data.
A rotating, opaque device id. Sojourn uses an opaque token that rotates roughly every month. It may survive an encrypted device-backup restore until its next rotation. It lets us de-duplicate events and estimate distinct-device counts during that period. It is not an account identifier and is not mapped to your name, email, Apple ID, location, or travel history.
How the request IP is handled. Our Railway analytics database never receives your IP address, and the Cloudflare gateway does not attach it to the events it forwards. Cloudflare necessarily receives the address as network metadata. For abuse prevention, the Worker uses the raw address only as part of an internal Cloudflare Cache API rate-limit key, which expires no later than the end of the current 60-second window. The application log payload does not include the raw address, and it is not forwarded to Railway. Automatic invocation logs are disabled in every deployed Worker profile, so Cloudflare's automatic request envelope, including the URL, headers, and IP metadata, is not persisted in Workers Logs.
What the Worker logs. For each accepted analytics event, the Worker writes a custom operational log entry containing the allow-listed event name, the first 32 characters of the rotating device identifier, its timestamp, and its simple properties. Those entries remain in Cloudflare Workers Logs for no more than seven days (three days on Cloudflare's Free Workers plan and seven days on its Paid plan). They do not contain location, travel history, an account, an email address, request headers, or an IP address.

Your control:

Analytics are opt-out. They are on by default, and you can turn them off at any time in the app under Settings. When you turn them off, Sojourn stops sending analytics.

Where analytics flow (and what each step does):

The Sojourn app on your device batches pseudonymous events.
They are sent to our Cloudflare Worker gateway, which applies the short-lived 60-second abuse-prevention key described above, validates them against the allow-list, writes the bounded operational log described above, and does not attach your request IP, location, or travel data to the event forwarded to Railway.
The sanitized, IP-stripped batch is forwarded to our analytics service hosted on Railway (a managed Postgres database).
We view aggregate trends in Grafana, a dashboard tool.

Because this data is IP-stripped and uses a rotating identifier that is not mapped to an account, it does not directly identify you by name or email. For Apple's App Privacy disclosure, we nevertheless declare the analytics Product Interaction and Device ID as Linked to the User. This analytics database is entirely separate from your travel data, which (as Section 3 explains) never reaches us at all.

6. Feedback you choose to send

Sojourn has an optional in-app feedback form (Settings → Help & feedback → Send feedback). This is the one place where you can deliberately send us a message, and it is entirely your choice.

What it collects. A free-text message that you write, and (only if you fill it in) an optional email address so we can reply. The form also records an optional sentiment and kind tag (bug, idea, praise, or other), plus the Sojourn app version and iOS version so we can understand the software context of a problem.
It is optional. If you never open the feedback form, none of this is collected. The email field can be left blank, in which case we receive no email.
Where it goes. Your feedback is sent to our own infrastructure. The Cloudflare gateway applies the same short-lived 60-second abuse-prevention key described in Section 5, but it does not attach your request IP to the feedback record forwarded to Railway (a managed Postgres database), where we read it. Its custom application log records only the feedback category and rating, whether an email was supplied, the message length, and an optional legacy device-identifier prefix. It does not log the feedback body, email value, request headers, or IP address. Automatic invocation logs are disabled; these bounded custom logs remain in Workers Logs for no more than seven days.
An email is linked to the feedback you send. Sojourn has no accounts, so your feedback is not tied to an account or to your travel history. If you include an email address, we store it with that feedback message so we can reply and process a deletion request. An email address can identify you, so for Apple's App Privacy disclosure we declare the feedback fields as Linked to the User. We use them only for support, never for marketing or advertising.
Deleting your feedback. If you want a feedback submission deleted, email us (Section 16) and we will remove it. Because there is no account, please include enough detail (for example, the email you used or the approximate date) so we can find the right message.

7. Flight lookups, calendar, and photos

Sojourn offers a few optional, opt-in features that read flight or trip information. Boarding-pass, calendar, and Photos content is not uploaded to Sojourn infrastructure. A flight lookup sends only the schedule fields described below; Cloudflare separately receives ordinary network metadata needed to carry and protect that request.

Flight schedule lookups. When you choose to look up a flight, Sojourn can query a public flight-schedule provider (AeroDataBox) through our Cloudflare edge proxy. The application fields contain only a flight number, or a route (from and to) and a date. They do not contain your name, account, email, travel log, or Sojourn analytics identifier. Cloudflare necessarily receives your request IP as network metadata. The Worker HMAC-pseudonymizes that address with a secret key and uses the pseudonym only to select a per-client Durable Object rate limiter; neither the raw address nor the pseudonym is added to the custom log fields or forwarded to AeroDataBox or Railway. The Durable Object stores only a request count and reset time, and its counter state is scheduled for deletion after the 60-second window reset plus a ten-minute cleanup grace. Automatic invocation logs are disabled, so request headers, IP metadata, and lookup URLs are not persisted in Workers Logs. Custom flight-protection logs contain only bounded gate, route-class, timing, quota, and provider-status fields; they do not contain an IP address, its pseudonym, a flight number, route, or date. The proxy holds the provider key so it never has to live on your device, and AeroDataBox receives only the route, date, or flight-number information.

Boarding passes. You can add a boarding pass by scanning its barcode, pasting an itinerary, or importing a PDF or photo. This all happens on your device. The resulting boarding pass is stored only on your device and in your own iCloud, like the rest of your data. It is not uploaded to us.

Calendar (optional, opt-in). If you choose to, Sojourn can read calendar events on your device to find flight-shaped events and help fill in your travel log. It can also add stays to a dedicated "Sojourn" calendar. This happens only after you explicitly tap to connect your calendar. Sojourn never requests calendar access automatically. Calendar information stays on your device and is never uploaded to us.

Photos (optional, opt-in). In the currently distributed TestFlight Build 10, if you choose to grant Photos access, Sojourn reads saved location and date metadata from photos in your main Photos library to create approximate past-location evidence. Build 10 does not scan videos and does not preserve the source asset's saved accuracy in the imported record. Shared Albums are not scanned, and limited Photos access exposes only the items you select. Sojourn does not request the original photo bytes. It saves a country, date, and representative coordinate for each imported location group; those records can sync through your private iCloud like the rest of your travel log. Border, coastal, and nearby same-day groups can require review before you rely on tracker totals. Nothing is uploaded to Sojourn's servers. A replacement build under validation expands this metadata-only path to photos and videos and preserves saved accuracy, but that behavior is not yet distributed; we will update this policy before it is.

You can grant or revoke calendar and photo access at any time in the iOS Settings app.

8. What our infrastructure does

Our infrastructure primarily delivers public rule, visa, and flight data. It also provides the narrow analytics and feedback gateways described above.

Sojourn downloads rule packs (the day-cap parameters and display text for residency rules, such as the Schengen 90/180 window) and visa data from a Cloudflare Workers edge proxy.
The proxy serves rule packs and visa data, acts as the privacy gateway for analytics (Section 5) and feedback (Section 6), and proxies flight lookups (Section 7). It validates and forwards only the documented fields and does not persist a developer-accessible copy of your travel log.

9. App distribution and Apple

Sojourn v1.0, including the current TestFlight beta, is free during launch. Every feature in this version is available without a purchase, subscription, trial, or redemption code.

At the date of this policy, version 1.0 Build 10 is available as a public TestFlight beta and is not an App Store release. When you use TestFlight, Apple automatically collects crash logs and usage information and shares them with us through App Store Connect. This may include the beta build and installation status, sessions, crashes, device model and identifier, OS version, and language. Apple says this collection cannot be disabled in TestFlight; Sojourn's in-app analytics switch does not control it. Public-link testers' names and email addresses are not visible to us through the tester list.

If you submit feedback, a screenshot, or crash feedback through TestFlight, Apple also shares the content and associated device, connection, battery, storage, and app-uptime context described in Apple's TestFlight & Privacy notice. Feedback may be associated with a name or email address. We use TestFlight diagnostics and feedback only to test and improve Sojourn and related product functionality, and we do not share it with third parties. Apple's notice controls Apple's collection and retention.

We may introduce paid features in a future app version. If we do, the app and these documents will explain the price and terms before any purchase is offered. Purchases would be processed by Apple under Apple's privacy policy. We would not receive your payment card or billing details.

10. Third parties and what each receives

Sojourn relies on a small number of service providers. Here is exactly what each one can see.

Provider	Role	What it receives
Apple (iCloud / CloudKit)	Stores your travel data in your own private iCloud; syncs across your devices.	Your travel data, in your personal iCloud account. We cannot access it. Apple encrypts it in transit and at rest.
Apple (Core Location / geocoding)	Delivers location signals and resolves coordinates on paths that require network geocoding; eligible same-country checks can use Sojourn's bundled map instead.	The device coordinate needed to provide the location or geocoding service. Coordinates and travel history are never sent to Sojourn's infrastructure.
Apple (App Store)	Distributes the app and processes downloads.	App Store download and account information under Apple's privacy policy. We do not receive your Apple Account credentials.
Apple (TestFlight)	Distributes beta builds and automatically shares beta diagnostics through App Store Connect.	Build/install and usage information, crash logs, device and OS context, and any TestFlight feedback, screenshots, or diagnostic context you choose to submit. Public-link tester names and emails are hidden from us unless supplied with feedback.
Cloudflare	Edge proxy that serves rule packs and visa data, gateways analytics and feedback, proxies flight lookups, applies abuse controls, and holds bounded custom operational logs.	Network traffic needed to service each request; a raw-IP Cache API key lasting no more than the remainder of a 60-second window for analytics and feedback; an HMAC-pseudonymized flight-client limiter whose stored count/reset state is scheduled for deletion after the window plus a ten-minute cleanup grace; and the bounded custom application-log fields described above. Automatic invocation logs are disabled, so the request URL, headers, and IP metadata are not persisted in Workers Logs. Neither the raw flight-request IP nor its HMAC pseudonym is forwarded to AeroDataBox or Railway or added to Sojourn's custom log fields. Custom Workers Logs are retained for no more than seven days.
Railway	Hosts the analytics database (managed Postgres) and dashboards, and stores feedback you choose to send.	Pseudonymous, allow-listed analytics events with a rotating device-level identifier and no stored IP; plus any feedback message, optional email, rating or category, and app/iOS versions you submit.
AeroDataBox	Public flight-schedule data provider for flight lookups.	Only a flight number, or a route and date. Never your identity.

We do not sell your personal information to anyone. We do not share your personal information with advertisers or data brokers. We do not use third-party advertising or analytics SDKs.

11. Data retention and deletion

Because your travel data lives in your own iCloud and on your device, you are in control of it.

Delete the app and your travel data. To remove your travel data from your device, delete the Sojourn app. To remove the iCloud copy, delete Sojourn's data in your iCloud through the iOS Settings app (Apple ID, iCloud, Manage Storage), or by managing app data in iCloud. We never hold a copy of that travel log. Deleting the app does not by itself erase analytics already delivered or feedback you previously submitted; those records follow the controls below.
Analytics retention. Pseudonymous analytics events are retained only as long as needed to understand product usage trends. Their rotating identifier is not mapped to an account, name, or email. Turning analytics off stops future collection and clears the unsent on-device queue. We will honor applicable access or deletion rights to the extent matching stored records can reasonably be identified.
Feedback retention and deletion. If you sent feedback (Section 6), its message, optional email, optional rating or category, and app/iOS support context are kept only as long as needed to act on it. You can ask us to delete a feedback submission at any time by emailing us (Section 16); include enough detail for us to find it, since there is no account to look it up under.
Edge abuse-control retention. The analytics/feedback raw-IP Cache API key expires no later than the end of its current 60-second window. For flight lookups, the raw IP is HMAC-pseudonymized to select a limiter object; the object's application state contains only a request count and reset time and is scheduled for deletion after the 60-second window reset plus a ten-minute cleanup grace.
Cloudflare Workers Logs retention. Automatic invocation logs are disabled in Sojourn's committed configuration and inherited by every deployed Worker profile. Cloudflare retains only the bounded custom logs described above: three days on its Free Workers plan or seven days on its Paid plan, with a maximum of seven days. Sojourn does not configure a separate persistent Workers Logpush destination for these logs.
TestFlight retention. Apple controls and retains TestFlight records under its TestFlight & Privacy notice. Apple states that beta feedback is retained for one year and that crash and usage data may be retained until the relevant bugs are resolved. We use any copy available to us through App Store Connect only as long as needed to investigate a beta issue or improve Sojourn.

12. Your rights

If you are in the EU or UK (GDPR / UK GDPR). You have the right to access, correct, delete, restrict, and port your personal data, and to object to processing. For the personal data Sojourn handles, these rights are mostly exercised directly by you, because the data lives in your own iCloud and on your device, which you fully control. You can access, correct, export, or delete your travel data inside the app and through iCloud at any time.

Lawful basis. For the small amount of data we do process: pseudonymous analytics rely on our legitimate interest in improving the app, balanced against your privacy and made controllable by an in-app opt-out. Feedback you send (the message, optional email, rating or category, and app/iOS support context) is processed on the basis of your consent, since you choose to submit it, and you can ask us to delete it at any time. The processing required to deliver the app's features (such as serving rule packs, or making a flight lookup you requested) is necessary to perform the service you asked for.
Data minimization. We process the minimum data needed. We do not collect personal data we do not need, and our architecture is built so that your personal travel data never reaches us.
No selling of data. We do not sell your personal data, and we do not use it for advertising.
Complaints. You have the right to lodge a complaint with your local data protection authority.

If you are in California (CCPA). You have the right to know what personal information is collected, to delete it, and to opt out of its sale. We do not sell your personal information. Your travel data is not collected by us at all; it stays in your iCloud and on your device. The limited analytics and optional feedback that do reach us are described, controlled, and retained as set out above.

To make any request or ask a question about your rights, contact us using the details in Section 16.

13. Children

Sojourn is not directed at children and is not intended for use by anyone under the age required by their local law to consent to data processing (for example, 16 in parts of the EU, or 13 in the United States). We do not knowingly collect personal information from children. If you believe a child has used Sojourn in a way that concerns you, please contact us.

14. Security

Your travel data is protected by Apple's device encryption and by iCloud's encryption in transit and at rest, tied to your Apple ID.
The application data that reaches our infrastructure is pseudonymous (analytics), user-submitted (feedback), or limited to public-schedule lookup fields that contain no name or account (flight lookups), and is transmitted over encrypted (HTTPS) connections. Cloudflare also processes the network metadata and short-lived abuse-control state described in Sections 5, 7, 10, and 11.
Because we do not hold your travel data, there is no central store of your travel history for an attacker to target on our side.
No method of transmission or storage is ever completely secure, but Sojourn's design minimizes risk by keeping the sensitive travel log out of our hands and limiting its own infrastructure to the narrow analytics and optional feedback described above.

15. Changes to this policy

We may update this policy as Sojourn evolves. When we make a material change, we will update the "Last updated" date at the top and, where appropriate, note the change in the app. Continued use of Sojourn after an update means you accept the revised policy.

16. Contact

If you have questions about this Privacy Policy or your data, contact us:

Email: sacha.dev.app@gmail.com
Operator: Sacha Allard

Sojourn counts your days. Not tax or legal advice. Verify with a professional.