JunoaJunoa Privacy Policy
Last updated: 1 November 2026
This policy explains what Junoa collects, why, who can see it, how long we keep it, and what you can do about it.
Who we are
Junoa is operated by Ketan Mahajan. In data-protection law we are the "controller" of your personal data. Contact: support@juno-a.com.
What Junoa is
Junoa is a mobile app to plan trips, share them, and make your own version ("fork") of another person's trip.
Information we collect
Account information.
- If you sign up with email: your email address, password, name and username. Your password is stored only as a hash by our authentication provider (Supabase Auth). When you log in with a username, your password passes through our server once, over an encrypted connection, to sign you in. We never store it and never log it.
- If you sign in with Apple or Google: the provider sends us your email address and your name if you allow it, plus an email-verified flag and the provider's ID for your account. Google also sends a link to your Google profile picture. Our authentication provider (Supabase Auth) stores these fields. Junoa does not copy the picture link into your profile or show it. With Apple you can choose to hide your email; we then get a relay address from Apple. You choose a username in the app.
- Your profile picture, if you add one, and when your account was created.
- Which onboarding screens and tips you have already seen (stored with your account and on your phone).
Your name and username are visible to every signed-in Junoa user, even if you never publish a trip, so that other people can find you, mention you and see who wrote a trip or comment.
Trips you make. Trip titles, destinations, descriptions, tags, stops (name, category, order, day number, optional duration, notes), photo captions, and the map location (latitude and longitude) of each stop.
Photos. When you save or publish a trip, the photos you kept on its stops (up to 10 per stop) are uploaded to our storage provider (Supabase Storage). Before the upload, the app makes a new copy of each image, which removes the data inside the file (EXIF): GPS location, time taken and device model. A photo on a public trip is visible to signed-in Junoa users; a photo on a private trip is visible only to you.
Building a trip from your photos. If you use this feature, the app reads the date and GPS location saved inside the photos you select. It reads them on your phone, to sort the photos into days and places. To name each place, the app sends that photo location to Apple Maps, which returns places within about 200 metres. A stop made this way is placed at the place Apple Maps found, or, if it found none, at the location where the photos were taken. So imported stops can show where you were. You can move or delete any stop before you publish.
Social activity. Likes, saves, forks, comments, replies, likes on comments, @-mentions of other people, and the people you block.
Notifications. When someone likes, comments on or forks your trip, or mentions you, we store a notification for you: who did it, what, which trip, when, and when you read it. Notifications show only inside the app; we do not send push notifications.
Reports. If you report a trip or a comment, we store your user ID, the reason you chose, a copy of the reported text as it was then, who wrote it, the time, and the report's status (open, actioned or dismissed).
Automatic content checks. Text you post (trip titles, descriptions, comments) and usernames are checked automatically against a word list. Matching text is refused. A username that matches is replaced with a temporary one (user_ and 12 characters) that you can change.
Usage data. We record a small set of events to learn how people use the app: when a trip editor opens, when a trip is published or discarded, how long a section of a trip page is on screen, and when you share a trip as an image (with the kind of app you chose, for example Instagram or Messages, or that you cancelled). Each event holds a random session ID, the screen name and the hour it happened: no user ID, no trip ID and no text. Because the app has few users, these events are pseudonymous, not anonymous: in principle they could be matched to an account. You can object to this by email (see "Your rights"). We also record when each trip was first published.
Map routes. To draw routes, we keep a shared cache of routes between stop locations (rounded coordinates, distance, travel time). It holds no user ID and is shared by all users.
Sign-in protection. When you log in with a username, we keep the text you typed as the username and your IP address, to limit repeated attempts. These records are deleted within 2 hours (a purge runs every hour).
On your phone. The app keeps:
- an unsaved trip, so you do not lose it if the app closes;
- full-quality copies of photos you pick for a trip, including their GPS location and time, The app deletes a trip's copies after you publish the trip, save changes to it, discard it, or delete your account. At each app launch it also deletes copies that no unsaved trip uses and that are more than 24 hours old;
- your sign-in session, stored in the phone's secure storage (Keychain).
These files can be included in your phone's own backup.
Information we do NOT collect
- We do not ask for the location of your phone. We read GPS only from photos you choose to import, as described above.
- We do not use your camera or microphone, and we do not collect phone numbers or contacts.
- We do not run a crash-reporting or error-tracking service in the app.
- We do not use third-party analytics or advertising SDKs.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not track you across other apps or websites.
This website
This section covers juno-a.com, not the app.
The website sets no cookies. It runs no analytics or advertising scripts. It loads no fonts, images or scripts from other companies.
If you ask for an invite, we collect your email address. We use it only to send you your TestFlight invite and one message when Junoa is on the App Store. When you send the form, a script on our page sends your email address from your browser to our database, which Supabase runs for us in India (Mumbai). You stay on our page, and the request carries no cookies. Only we can read the list. We delete your address 30 days after we send the launch message, or 12 months after you asked, whichever comes first. You can ask us to delete it sooner at any time: email support@juno-a.com.
Our website host, Cloudflare, receives your IP address and browser details when you load a page, as every host does. Cloudflare keeps these logs for a period consistent with the purposes of running its service, as its privacy policy describes. If you email support@juno-a.com, Cloudflare forwards the message to our Gmail mailbox, which Google runs for us.
Why we use your information, and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Run your account, and let you make, share and fork trips | account, trips, photos, social activity | performance of our contract with you |
| Send your beta invite and one launch message | email address | your consent: you send the form to ask for them |
| Show your public content and name to other users; in-app notifications | name, username, public trips, comments, mentions | performance of our contract with you |
| Keep the app safe: word checks, reports, blocks, rate limits | posted text, reports, blocks, sign-in protection data | our legitimate interest in a safe service |
| Learn how the app is used | usage events | our legitimate interest in improving the app |
You can object to processing based on legitimate interest (see "Your rights").
Who can see your information
- Every signed-in user: your name, username, profile picture, your public trips (with stops, their map locations, photos and captions) and your comments on public trips.
- Only you: your private trips and their photos, your notifications, your blocks and reports.
- Copies by other people: when someone forks your public trip, their copy keeps the stops you wrote (name, category, notes, map location), the photos on them, and shows you as the contributor. Deleting your trip or making it private does not delete those copies. Your name stays on them until you delete your account.
- Share images: the owner of a published trip can share it as an image outside Junoa, for example to Instagram or X. The image can show a photo from any stop of that trip, including a photo you added to it, with your username beside the photo. After the image is posted in another app, we cannot remove it from there.
Service providers and other parties
These providers process data for us, under contract:
- Supabase: database, sign-in, photo storage and server functions. Region: Mumbai, India (ap-south-1). Supabase privacy policy
- Cloudflare: hosts this website and forwards email sent to support@juno-a.com. Cloudflare privacy policy
These parties receive data to provide their own services, under their own privacy policies:
- Apple: Sign in with Apple; and Apple Maps, which receives what you type in place search, the map area you view, route start and end points, and, for photo import, the photo locations. Apple privacy policy
- Google: Sign in with Google, and the Gmail mailbox that receives our support email. Google privacy policy
International transfers
Our providers process data in the United States. Supabase stores our data in India (Mumbai). Where data about people in the EU or UK is transferred, we rely on the providers' Standard Contractual Clauses (and the UK addendum) or the EU-US Data Privacy Framework where the provider is certified.
How long we keep your information
| Data | How long |
|---|---|
| Account, trips, photos, comments, likes, saves, blocks, notifications | until you delete them or your account |
| Copies of your stops in other people's forks | until the fork's owner deletes them; your name is removed when you delete your account |
| Reports you made | 24 months after the report is closed, then deleted; your user ID is removed at once if you delete your account |
| Reports about you (with a copy of the reported text) | 24 months after the report is closed, also after you delete your account, to enforce our rules |
| Usage events | 13 months |
| Route cache | 180 days after an entry is made; it holds no personal data |
| Invite requests from the website (email address) | 30 days after we send the launch message, or 12 months after the request, whichever comes first |
| Sign-in protection (typed username, IP) | see "Sign-in protection" above |
| Server logs (Supabase API, function and sign-in logs; may hold IP address, device user agent and email) | 7 days |
| Database backups | 7 days; deleted data can stay in a backup until it expires |
Deleting your account
You can delete your account in the app: Profile → ⚙ → Account → Delete account. You confirm with your password, or again with Apple or Google. The deletion starts at once and is permanent.
We delete: your account, profile, trips, stops, photos, comments (and the replies other people wrote to them), likes, saves, mentions, blocks and notifications.
What stays:
- Forks other people made of your trips keep the stops that came from you (name, category, notes, map location). Those stops show "kept by a deleted user". Your photos are removed from them.
- Your @username stays as plain text in other people's comments that mentioned you.
- Reports, as described in the retention table, without your user ID if you made them.
- Server logs and backups until they expire (see the retention table).
Apple: if you signed up with Apple, or linked Apple to your account later, we cancel Junoa's access in your Apple ID before we delete any data. If that cancellation fails, the deletion stops and nothing is deleted. Google: we do not cancel Google's access for you. Remove Junoa at myaccount.google.com/connections.
If a deletion fails partway, contact us and we will finish it.
You can also delete a single trip, comment or photo at any time (copies in other people's forks stay, as described above).
Your rights
Depending on where you live, you have the right to access your data, get a copy (export), correct it, delete it, restrict or object to its processing, and complain to your data-protection authority (in the EU, the authority in your country; in the UK, the ICO). To use any right, email support@juno-a.com. We answer within 30 days. You can correct your name, username and profile picture, and delete your account, in the app at any time.
Do Not Track: the app does not respond to Do Not Track signals; it does not track you across other apps or websites.
Children
Junoa is not for children under 13. We do not knowingly collect data from children under 13. If you think a child has made an account, contact us and we will delete it.
Changes to this policy
We will tell you in the app before a material change takes effect, and show the new date at the top of this page.
Contact
support@juno-a.com. Junoa is operated by Ketan Mahajan.