隐私政策

1. Who we are

Forugo Limited, a company incorporated in the Hong Kong Special Administrative Region ("Forugo", "we", "us"), decides how and why your personal data is processed in connection with the Forugo mobile app, the website at forugo.app, and related services (together, the "Platform").

Our registered office is:

Forugo Limited

3906, 39/F, The Center

99 Queen's Road, Central

Hong Kong

Data Protection Officer. We have appointed a Data Protection Officer, who is responsible for overseeing how we handle personal data and is the point of contact for any question or complaint about it:

Van Quyen To

[email protected]

Contact for anything in this policy, including requests about your data: [email protected], or by post at the address above.

2. Quick summary

• We never see your card number. — Card details go directly to Stripe. We store only a token and the brand, last four digits and expiry so you can recognise a saved card.
• We never see your ID document. — Identity verification is performed by Veriff inside the app. We receive a verdict, the name read off the document, and the issuing country — never the document or the selfie.
• We don't hold your password. — Sign-in is handled by Firebase Authentication.
• Traveller details go to suppliers. — We cannot book a flight or a room without passing on who is travelling. Exactly what goes where is in section 5.
• Passenger details are erased after your trip. — Passport numbers, dates of birth and contact details are stripped from completed trips 90 days after they end, automatically.
• We run no advertising or analytics trackers. — The app contains no advertising SDK, no analytics SDK and no third-party tracking SDK.
• Marketing is off by default. — Promotional notifications are opt-in. Booking and earnings notifications are on, because they are service messages, not marketing.
• You can export everything and delete everything. — Both from within the app.

3. What we collect

3.1 When you create an account

• Email address — Required. Also the account identifier.
• First and last name — Become your display name; your first name seeds your username.
• Phone number — Optional. Stored as a country dialling code and a national number, kept separate. Contact only — never used to sign you in.
• Password, or Google / Apple identity — Held by Firebase Authentication, not by Forugo. We receive a verified token, exchange it for our own session, and never see your password.
• Profile photo and username — Optional; publicly visible if you publish Plans.

3.2 Your preferences

Currency, language, theme, distance units, time format, temperature units, and your notification preferences by category.

3.3 Devices and sessions

When you sign in we record the platform (iOS or Android), app version and a device label such as "iPhone 15 Pro", when the session was created, and when it was last renewed. This exists so you can see every device signed in to your account and end any of them. Revoked sessions are marked revoked rather than deleted, so the list can show you that a device was signed out.

If you enable push notifications we also store a Firebase Cloud Messaging token for each device.

3.4 Traveller and passenger details

To make a Booking we need to know who is travelling. Depending on what is being booked, this includes:

• full name as it appears on the travel document;
• date of birth and gender;
• nationality;
• passport or travel-document number, its expiry date and issuing country;
• contact email address and phone number; and
• for children and infants, age at travel.

You can save travelling companions so you do not have to re-enter their details. Saved companion records hold the same categories of data.

Passport and travel-document numbers are encrypted at rest using AES-256-GCM, both on saved companion records and on the copies attached to a Trip. Everywhere they are listed in the app they are masked; they are shown in full only when you open a specific companion record.

When you book, traveller details are copied onto the Trip. Editing a saved companion afterwards does not change a booking already confirmed.

3.5 Payment data

Card details are entered into Stripe's own interface and are transmitted to Stripe directly. Forugo does not receive, process or store your full card number, expiry or security code.

If you choose to save a card, we store a Stripe token plus the card's brand, last four digits, expiry month and year, and the country the card was issued in. That is all.

We also store the transaction records themselves: what you booked, what you paid, the fees and taxes, the currency, refunds, and the resulting ledger entries.

3.6 Identity verification, for Creators who earn money

If you want to publish a Plan, earn Commission or withdraw earnings, you must complete identity verification. This is performed by Veriff, an independent identity-verification provider, inside the app.

Forugo never receives your identity document or your selfie. Veriff captures and holds them under its own privacy policy. What reaches us is: a session reference, the verdict (pending, verified or rejected), the name Veriff read off the document, the issuing country, the document type, and — where verification failed — the machine-readable reason code so we can tell you what to fix.

3.7 Payout details, for Creators

If you withdraw earnings, we store your bank name, the account holder's name, the last four digits only of the account number, and the currency. We do not store full bank account numbers.

3.8 Content you create

Plans and their day-by-day itineraries, destinations, dates, budgets, traveller counts, photographs you upload for Plans and for your profile, travel journal entries and the photographs attached to them, and any report you submit about another user's content.

Photographs are processed when you upload them. Each upload is converted to a 2048px WebP master with smaller 800px and 320px versions generated automatically, so the app can load the right size for each context. Images that nothing references are removed by an automated nightly sweep after 24 hours.

3.9 How you use the Platform

• Searches you run, and the parameters used — Tuning search relevance. Searches by signed-out visitors are logged without a user identifier.
• Which results you saw, tapped and saved, and at what rank — Measuring whether the ranking is any good.
• Plans you view, like, save, share or hide — Powering the feed and the "not interested" signal.
• A taste profile derived from all of the above — Personalising your feed — see section 9.

3.10 Location

The app asks for location permission only in two places: the hotel map and the trip map, to centre the map on where you are. Permission is requested when you first use one of those screens and is "while using the app" only.

Your GPS position is used on your device and is not sent to our servers. We do not build a location history, and we do not track you in the background.

3.11 Support requests

When you contact support from within the app we record your message, the booking it relates to if you selected one, your app version, platform and locale, and whether our notification email about it was delivered.

3.12 Technical and diagnostic data

Standard server logs, and crash and error reports. Errors are reported to Sentry where error reporting is enabled. Sentry receives the exception, the stack trace and the technical context attached to it. We do not deliberately send personal data to Sentry, though an error message can incidentally contain an identifier such as a user or booking ID.

3.13 On the marketing website

The website at forugo.app collects nothing about you unless you fill in a form.

• No analytics, no advertising, no tracking pixels. The site runs none.
• One cookie, forugo_locale, which remembers the language you chose. It is

functional, lasts one year, and is set only when you actively change language.

• Three forms — waitlist, contact, and investor enquiry. When you submit one

we record what you typed, plus your IP address and browser user-agent string, and email it to us. The IP and user-agent are kept as an anti-abuse and anti-spam measure alongside a submission rate limit.

• Waitlist — Email address; whether you identify as a traveller, creator or vendor; where you came from
• Contact — Name, email address, topic, your message
• Investor enquiry — Name, email address, firm, your message

3.14 What we do not collect

For the avoidance of doubt, and because these are commonly assumed: we do not collect your contacts, your photo library beyond the images you choose to upload, your microphone or camera except where you use Veriff's in-app verification, your browsing activity outside the Platform, your background location, or any advertising identifier. We do not buy personal data from data brokers, and the Platform contains no advertising network.

4. Why we use your data

• Providing the service — Creating your account, authenticating you, showing search results and the feed, saving your Plans, placing Bookings, issuing confirmations.
• Processing payments — Taking payment, screening for fraud, issuing refunds, and paying Creator Commission.
• Fulfilling Bookings — Passing traveller details to the Travel Suppliers who will actually perform the service.
• Personalising what you see — Ranking the feed and search results — see section 9.
• Communicating with you — Booking confirmations and changes, trip reminders, earnings and withdrawal notices, and replies to support requests.
• Verifying identity — Meeting anti-money-laundering obligations before anyone is paid.
• Keeping the Platform safe — Detecting and preventing fraud, abuse, multiple-account schemes and artificial bookings; reviewing reported content.
• Meeting legal obligations — Tax and accounting records, record-keeping for payouts, responding to lawful requests.
• Improving the Platform — Measuring whether search and ranking work, and fixing errors.

5. Who we share your data with, and exactly what they get

5.1 Travel Suppliers

To book a flight or a room we have to tell the supplier who is travelling. This is unavoidable: it is the booking.

For a flight booking, the airline or flight provider receives, for each traveller: first and last name, email address, phone number, date of birth, gender, passport or travel-document number, document expiry date, document issuing country, and nationality. Where available, the device IP address and browser user-agent of the booking request are also passed as a fraud signal at the supplier's request.

For a hotel or accommodation booking, the supplier receives, for each guest: first and last name, email address, phone number, and — for children and infants — age.

Suppliers are independent controllers of the data we pass them and handle it under their own privacy policies and under the rules of the jurisdictions they operate in, which can include mandatory disclosure to border and aviation authorities.

5.2 Service providers

• Stripe — Your card details, directly from you, never through us. From us: your email address, the amount, and fraud-risk signals we compute from your booking — how soon you are travelling, whether the trip contains a flight, how many orders you have paid before, how old your account is, and the pricing country. Processing payments, and screening them for fraud. We deliberately send Stripe no name and no address.
• Veriff — Your identity document and selfie, captured by Veriff in the app and never passing through us. Verifying the identity of Creators who earn money.
• Google (Firebase) — Authentication credentials, and push notification tokens and message payloads. Sign-in, and delivering push notifications.
• Sentry — Error reports and stack traces. Diagnosing faults.
• Stadia Maps — Map tile, geocoding and routing requests. Rendering maps, searching for places, and calculating routes.
• Our hosting and storage providers — Whatever is stored on the Platform, in the ordinary course of hosting it. Running the service.
• Our email provider — Notification and support emails. Sending you email.

5.3 Other recipients

• Professional advisers — accountants, auditors and lawyers, under duties of

confidence.

• Authorities — where we are legally required to disclose, or where

disclosure is necessary to establish or defend legal claims, or to prevent fraud or harm.

• A successor business — if Forugo is sold, merged or reorganised, subject

to the acquirer continuing to honour this policy.

We do not sell your personal data, and we do not share it for anyone else's advertising.

6. What other people can see

Published Plans are public. When you publish a Plan, it becomes discoverable by other users in the app and viewable by anyone with the link, including on the open web where it may be indexed by search engines. A public Plan page shows the Plan's title, destination, dates, duration, traveller count, price estimate, cover photographs, and the Creator's display name and profile photo.

What stays private on a public Plan page: the day-by-day itinerary and the Creator's local advisories are not shown. That material is what a Creator is paid for and is not given away.

Other users can see your public profile, your Published Plans, and aggregate counts such as likes and saves. They cannot see your email address, phone number, traveller details, bookings, journal entries, wallet balance or verification status.

Your travel journal is private to you.

7. Transfers outside your country

Forugo is a Hong Kong company. Our infrastructure, and the service providers listed in section 5, are located in several countries. Personal data collected from you will therefore be transferred outside the country where you live, including to Hong Kong, Singapore and the European Union and United States where particular providers are based.

Travel Supplier transfers are inherent to travel: booking a hotel in Japan means sending the guest's name to Japan.

Where we transfer personal data internationally we do so under contractual arrangements requiring the recipient to protect it, and only to the extent necessary for the purposes in section 4.

8. How long we keep it

• Account and profile — While your account is open. On deletion, anonymised — see section 11.
• Passenger details on completed trips — Automatically stripped 90 days after the trip ends. Passport numbers, dates of birth, document expiry and issuing country, nationality, gender, and traveller email and phone are removed. Traveller names are kept so your trip history still reads correctly. This runs daily and is irreversible.
• Saved companions — Until you delete them, or you delete your account.
• Trips and itineraries — Kept as your travel history, with passenger details removed as above.
• Orders, payments, refunds, disbursements, tax records — Retained after account deletion, in anonymised form, because accounting and tax law requires it.
• Identity verification records — If you have never taken a payout: erased on account deletion. If you have taken a payout: retained for 5 years from deletion, for anti-money-laundering record-keeping. Even then, the document image itself was never held by us.
• Saved card tokens — Until you remove the card or delete your account.
• Sessions — Revoked sessions are retained as a record that the device was signed out.
• Search and impression logs, taste profile — Retained while your account is open; the taste profile is derived data and is rebuilt continuously.
• Uploaded images nothing references — Removed by an automated nightly sweep, 24 hours after they become unreferenced.
• Support requests — Retained as the record of the request. The trip reference is deliberately kept as text so the request still reads correctly if the trip record is later removed.

9. Personalisation and automated processing

We build a taste profile from how you use the Platform: the destinations you search for and book, your typical spend, your transport preferences, the kinds of stops you save, your typical trip length, and where you have already been. Searches count least, saves count more, and completed bookings count most. Places you have recently visited are down-weighted, so the feed does not keep showing you where you have just been.

This profile ranks your feed and personalises search results. It does not change the price you are offered.

We also compute fraud-risk signals on each payment — how soon you are travelling, whether the trip includes a flight, whether this is your first order, how old your account is, and the pricing country — and send them to Stripe, where fraud rules may require you to complete additional bank authentication before a payment goes through. Every one of these signals is computed by us from your booking and account history; none is taken from anything your device claims.

No decision with a legal or similarly significant effect on you is made by automated means alone. A payment declined on fraud grounds can be raised with us, and a rejected identity verification can be retried and reviewed.

10. Marketing and notifications

Promotional messages are off by default. The offers and promotions notification category defaults to disabled and stays disabled until you turn it on.

Service messages are on by default, because they are not marketing:

• booking confirmations, changes and cancellations;
• trip reminders; and
• earnings and withdrawal notifications — being told you have been paid is not

advertising.

You can change any category, or turn off all push notifications with a master switch, in your notification settings. Turning a category off stops the interruption; the corresponding entry still appears in your in-app notification list, so that muting reminders does not mean you silently miss that something happened.

Transactional emails about a booking you have made cannot be turned off while that booking is live.

11. Your rights and how to use them

Get a copy of your data. From within the app, you can export everything we hold about you as a structured, machine-readable file, immediately. It includes your profile, settings, saved companions, Plans, Trips, orders, journal entries, support requests, sessions, payout accounts and identity-verification status.

It deliberately excludes: credentials, payment tokens, identity document images and the identity read off them, card details of any kind (we hold none), and anything belonging to another user. Those are omitted because an export is a file you might email to yourself or hand to someone else, and putting a credential or a passport scan in it would create a risk rather than serve a right.

Delete your account. From within the app. It is immediate and irreversible, and requires you to confirm your email address. What happens is set out in section 8 and in section 19 of the Terms of Service.

Correct your data. Edit your profile, settings and saved companions in the app. For anything you cannot change yourself, contact us.

Object, restrict, or withdraw consent. Contact us at [email protected]. Withdrawing consent does not affect processing already carried out, and some processing — completing a booking you have made, keeping the accounting records of it — cannot be stopped without ending the service.

How to reach us, and what to expect. Email [email protected], or write to us at the address in section 1. We acknowledge every request as soon as we receive it and respond within 7 days. Where a request is complex, or where a third party such as a Travel Supplier has to be involved before we can answer, we will tell you within those 7 days what is happening and when you can expect a full response. Where the law that applies to you gives you a shorter deadline than this, that deadline applies.

Complaints. If you are unhappy with how we have handled your data, contact us first. You may also complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong, or to the data protection authority in your own country.

12. Security

• Passport and travel-document numbers are encrypted at rest with

AES-256-GCM, and masked wherever they are listed.

• We hold no card data. Card details go to Stripe directly.
• We hold no identity documents. Veriff captures and holds them.
• We do not hold your password. Firebase Authentication does.
• Access tokens are short-lived and refreshed from a separate longer-lived

token; you can revoke any device's session yourself.

• Passenger data is minimised over time by the automated 90-day sweep in

section 8 — the most sensitive data we hold about a trip stops existing shortly after the trip does.

• Administrative access is role-based and audit-logged, with two-factor

authentication on administrator accounts. Changes to financial settings require a second administrator to approve them.

No system is perfectly secure. If a breach occurs that is likely to put you at risk, we will notify you and the relevant authorities as the law requires.

13. Children

The Platform is not for children. You must be at least 18 to hold an account. We do not knowingly collect personal data from children as account holders.

Children can of course travel: a Plan or Trip may include child and infant travellers, and we process their names, dates of birth and travel-document details for that purpose. That data is provided by the adult making the Booking, who is responsible for having the authority to provide it.

If you believe a child has created an account, contact [email protected] and we will remove it.

14. Third-party services and links

Travel Suppliers, Stripe, Veriff, Google and others named in section 5 operate under their own privacy policies, which we do not control. Where you follow a link out of the Platform, or complete a step inside a provider's own interface, that provider's policy applies to what happens there.

15. Changes to this policy

We may update this policy. The version date at the top changes when we do, and where a change materially affects how we use your data we will tell you in the app or by email before it takes effect. Continuing to use the Platform after that means you accept the updated policy.

16. Contact

• Privacy and data requests — [email protected]
• Data Protection Officer — Van Quyen To — [email protected]
• General and support — [email protected], or Profile → Help & Support in the app
• Security reports — [email protected]
• By post — Forugo Limited, 3906, 39/F, The Center, 99 Queen's Road, Central, Hong Kong

Language. This policy may be translated. If there is a conflict between the English version and a translation, the English version prevails, except where local law requires otherwise.

Forugo Privacy Policy, version 1.0, effective 21 September 2026.