Privacy Policy

Last Updated: September 29, 2026

1. Introduction

Borrowed Fire LLC ("we," "us," or "our") built Jurni ("the App") with privacy as a core principle. This Privacy Policy explains how the App handles your information. It covers Jurni 2.0 and later.

2. How Your Data Is Protected

2.1 End-to-End Encryption

Trip content is end-to-end encrypted (E2EE) on your device before being transmitted to our servers. This includes trip names and destinations, activities, expenses and splits, decisions and votes, documents and their files, cover images, the trip's shared photo album, and the member details stored with the trip. This means:

• Your trip content is encrypted with keys that only you and your trip members hold
• We cannot read, access, or decrypt your trip content — even if compelled
• Each trip has its own AES-256-GCM key, shared with members using P-256 ECDH key agreement and HKDF-SHA256

2.2 What We Can See (Metadata)

To provide the service, certain information is stored unencrypted on our servers:

• Your account profile: the identifier from Sign in with Apple, your display name, your email address, and your public encryption key
• Trip identifiers, owners, and timestamps (created, modified)
• Trip membership: who is in which trip, each person's role, when they joined, and the Jurni version they use
• Invite metadata: the trip name and inviter name shown with an invite link, any label you add, who asked to join, and the outcome
• Activity records: which member added, changed, commented on, or uploaded an item, and when — but not what it says
• The names of document files, which can include a short description, such as an expense's name on a saved receipt
• For the shared album: how many photos a trip has, their file sizes, and who added each one
• For push notifications: your device's push token, and who each notification is for, what kind it is, and when it is sent (for example, a decision's deadline)
• Records of deleted items and trips, including the account identifiers of a deleted trip's former members, so every member's devices remove them

This metadata is necessary for trip sharing, sync, notifications, and access control to function. Your account profile is not end-to-end encrypted, because other members need your name and public key to share a trip with you. Today, our server also lets other signed-in Jurni accounts retrieve profile records, including the email address stored in them.

2.3 What Never Leaves Your Device

The following sensitive information is stored only on your device and is never transmitted to our servers:

• Passport numbers, issuing countries, and issue and expiration dates
• Known Traveler Numbers (KTN)
• Global Entry numbers

These numbers are masked in the App and open only after Face ID, Touch ID, or your passcode. When you copy one, it is copied only to this device and cleared from the clipboard after 60 seconds. Like other app data on your iPhone, they may be included in your own device backups.

2.4 Named Exceptions

These features send details from your bookings or plans to an outside service, beyond our encrypted sync:

• Flight schedule check: When you import a flight, or look one up in the flight form, Jurni sends only the flight number and date to Jurni's server, which asks the flight schedule provider AeroDataBox (through RapidAPI) for its times. The provider does not receive your account or anything else from your trip. Jurni's server does not keep these lookups.
• Stay address lookup: When a booking email has no address for a stay, Jurni searches Apple Maps for the stay's name near your trip's destination. Only the name and the destination are sent.
• Apple Private Cloud Compute (off by default): If you turn it on, AI features can send text to Apple's Private Cloud Compute for better results. See Section 6.7.
• Travel time estimates (off by default): If you turn them on in Settings > Privacy & Security, Jurni sends the start and end coordinates of a trip leg to Apple Maps to estimate travel time. Apple does not receive names, notes, or who you travel with.

Jurni also uses Apple Maps for everyday map features, and outside services for destination images and exchange rates. Section 6 lists every service and what each receives.

3. Information We Collect

3.1 Sign in with Apple

Jurni uses Sign in with Apple for authentication. When you sign in, Apple provides:

• User identifier: A unique, anonymous ID specific to our app
• Display name: Your name, if you choose to share it (you can choose to hide it)
• Email address: Your email or an Apple-generated relay address (you choose)

Your display name and email are stored locally on your device and in your account profile on our server (see Section 2.2). Your authentication credentials are managed by Apple.

3.2 Trip Data

All trip data you create in Jurni is:

• Stored locally on your device in plaintext (for offline access, widgets, Live Activities, Siri, and Spotlight)
• Encrypted on your device, then synced to our servers for cross-device sync and sharing

Trip data includes: trip details, activities, documents, passes and QR codes, expenses, decisions, photos you add to the trip album, and locations you enter.

3.3 iCloud

Jurni does not sync trip data through iCloud. It uses iCloud in two ways:

• iCloud Keychain stores your encryption private key so your other devices can open your trips (see Section 7)
• iCloud key-value storage syncs your Jurni badges and their progress between your devices, together with your Jurni account identifier

This is governed by Apple's Privacy Policy.

3.4 Shared Trips

When you share a trip with others:

• Trip data is end-to-end encrypted — only approved members can decrypt it
• You share a trip with an invite link or code. For invite links created in Jurni 2.0, the organizer approves each person before they can see the trip, and the trip's encryption key is released only after approval. Invite links created with earlier versions of Jurni keep the settings they were created with
• Each person has a role: Organizers invite and approve people, Planners add and edit the plan, and Guests see the trip and vote
• You can revoke access at any time

3.5 Shared Photo Album

Photos you add to a trip's album are shared with everyone on the trip. Before a photo leaves your device, Jurni resizes it, removes its location and other embedded details, and encrypts it with the trip's key. Our servers store only the encrypted photo and the metadata listed in Section 2.2.

3.6 Smart Import and Share to Jurni

Smart Import reads booking emails, PDFs, screenshots, and web pages you scan, paste, or share to Jurni from other apps. It reads them on your iPhone, using Apple's on-device text recognition and, when available, Apple Intelligence's on-device model; otherwise pattern matching extracts the details. You review everything it found before it is saved. Jurni does not open links you share. Nothing you import leaves your device except through the named exceptions in Section 2.4, or as encrypted trip data once you save it.

3.7 Travel History From Your Photos

If you choose to rebuild your travel history, Jurni reads only the dates and locations of photos in your library, on your device, and names places using data stored in the App. It never uploads your photos for this. The trips it creates are saved and synced, encrypted, like any other trip.

3.8 Support Requests

If you send a problem report from the App, it includes your message, your app version, iOS version, device model, language, region, and time zone, summary counts such as how many trips you have, and recent invite steps — never trip content. A contact email is included, and the report is linked to your account, only if you choose.

4. Information We Do NOT Collect

We do not collect, store, or transmit:

• Advertising IDs, and we do not track you across other companies' apps or websites
• Personal data tied to analytics (see Section 6.4 for anonymous usage signals)
• Browsing history
• Crash reports (unless you opt in via Apple's built-in crash reporting)
• Your device's location — Jurni does not use location services. It reads photo locations only on your device (Section 3.7)

5. Device Permissions

Jurni may request the following device permissions:

• Camera: To scan QR codes and documents using your device camera. Images are processed on-device only.
• Photo Library: To import trip cover photos, document images, and album photos you select, and to rebuild your travel history from photo dates and locations on your device. Photos are uploaded only when you add them to a trip (as a cover, a document, or to the album), and then only encrypted.
• Contacts: To pick a friend to invite. Their email or phone number fills in the message on your device. Their name may be stored with the invite link as its label (see Section 2.2).
• Calendar: To add your trip activities to a "Jurni" calendar. Jurni reads and changes only the events it created.
• Face ID or Touch ID: To unlock the App when you turn on App Lock, and to open passport and traveler numbers. This happens on your device through Apple's system; Jurni never receives your biometric data.
• Notifications: For reminders and trip updates. Some are scheduled on your device, such as reminders and decision deadlines. Others, such as a new decision, a new expense, or new album photos, are sent by Jurni's server through Apple's push notification service. Their text is filled in on your iPhone: the trip's name is read from your device, and item names are encrypted with a key derived from the trip's key, so neither our server nor Apple can read them. They can see which trip a notification belongs to and what kind it is.

You can revoke any permission at any time through your device's Settings app. The App will continue to function with reduced functionality.

6. Third-Party Services

6.1 Supabase (Data Sync)

Jurni uses Supabase for authentication, data sync, trip sharing, notifications, and the flight schedule check. Supabase infrastructure is hosted on Amazon Web Services (AWS). All trip content stored on Supabase is end-to-end encrypted — Supabase and AWS can see only encrypted data and the metadata in Section 2.2. See Supabase's Privacy Policy.

6.2 Apple iCloud

Jurni uses iCloud Keychain and iCloud key-value storage as described in Section 3.3. When you view photos from your library, Apple's Photos may download them from iCloud Photos to your device. This is governed by Apple's Privacy Policy.

6.3 Sign in with Apple

Authentication is handled by Apple. See Apple's Sign in with Apple documentation for details on how Apple handles your credentials.

6.4 TelemetryDeck (Anonymous Analytics)

Jurni uses TelemetryDeck to collect anonymous usage signals — such as which features are used, app version, device type, and language. Some signals include random identifiers that Jurni creates for a trip or plan item, so we can tell repeat use of a feature apart without knowing what the trip contains. This data is not linked to your identity and contains no names, email addresses, or trip content. No advertising IDs, no IP addresses, and no cross-app tracking. See TelemetryDeck's Privacy Policy.

6.5 Apple Push Notification Service

Push notifications are delivered by Apple. Apple and our server see the trip identifier and the kind of notification, but not trip names, item names, or other trip content (see Section 5).

6.6 Apple Maps

Jurni uses Apple Maps to search for places, find addresses and coordinates for places you enter, show maps and Look Around, suggest things to do near your trip in free time, find a stay's address (Section 2.4), and, if you turn them on, estimate travel times (Section 2.4). Apple receives only the search text, address, or coordinates needed for each request — not your name, your account, or the rest of your trip. See Apple's Privacy Policy.

6.7 Apple Private Cloud Compute (Off by Default)

On devices that support it, you can turn on Private Cloud Compute in Settings, or when a feature that can use it offers it. While it is on, these features can send text to Apple's Private Cloud Compute: Smart Import and receipts, trip summaries, Travel Story narration, Trip Reel captions, decision option suggestions, and the order of free-day ideas. The text can include booking details, trip and place names, activity titles, dates, and totals. Before sending, Jurni removes the email addresses and phone numbers it finds; other details in the text, such as names and confirmation codes, are sent as they appear. Photos, images, and files never leave your iPhone this way. Apple says the text is never stored and is used only for your request, and that its privacy promise can be independently verified. Every feature works without it, using the model on your iPhone or Jurni's own rules. You can turn it off in Settings at any time. See Apple's description of Private Cloud Compute.

6.8 AeroDataBox (Flight Schedules)

For the flight schedule check (Section 2.4), Jurni's server sends a flight number and date to AeroDataBox through RapidAPI. No account or trip information is sent with it.

6.9 Pexels and Wikipedia (Destination Images)

To show a photo of a destination, Jurni sends the destination's name to Pexels, or a city's name to Wikipedia, and downloads the image it returns. Nothing else from your trip or account is sent.

6.10 Frankfurter (Exchange Rates)

To convert expenses between currencies, Jurni's server fetches exchange rates for the currency codes involved from Frankfurter. Only currency codes are sent.

6.11 RevenueCat

Jurni includes RevenueCat's software, which uses an anonymous identifier that RevenueCat generates. Jurni does not share your name, email address, Jurni account, or trip content with RevenueCat. See RevenueCat's Privacy Policy.

7. Data Security

Your data is protected by multiple layers:

• End-to-end encryption: Trip content is encrypted with AES-256-GCM before leaving your device
• Key management: Your encryption private key is stored in Apple's Keychain, synced via iCloud Keychain, and never sent to our servers. Trip keys reach other members only wrapped for them with P-256 ECDH and HKDF-SHA256
• App Lock: You can require Face ID, Touch ID, or your passcode to open the App
• Transport security: All network communication uses TLS 1.2+
• On-device storage: Local data is protected by your device's passcode and hardware encryption
• Row-level security: Server-side access control ensures you can only access trips you are a member of

8. Data Retention and Deletion

8.1 Account Deletion

You can delete your account at any time from Settings within the App. This permanently removes:

• Your profile and all authentication data from our servers, and we ask Apple to end Jurni's access to your Sign in with Apple account
• All trips you own and their associated data from our servers, including their documents and album photos
• Your membership in shared trips, your invites and join requests, and your push notification tokens
• Your encryption private key from your device's Keychain and iCloud Keychain
• All local data from your device, and your Jurni badges from iCloud

Photos and files you added to a trip someone else owns stay in that trip for its members, no longer linked to your account. Records of deleted trips, which list former members' account identifiers, are kept for a limited time so every member's devices remove the trip.

8.2 Trip Data

Deleting the App removes all local trip data. To remove synced data, use the in-app account deletion feature. Records of which member changed an item, without its content, are removed after 180 days.

9. Children's Privacy

Jurni is not directed at children under 13. We do not knowingly collect information from children. Since the App requires Sign in with Apple, Apple's own age restrictions apply.

10. International Users

Your encrypted data is stored on servers in the United States (AWS). Because trip content is end-to-end encrypted, the data stored on our servers is not readable by us or our infrastructure providers. Metadata (account information, trip membership) is subject to US data protection laws. The services in Section 6 handle the limited information they receive under their own privacy policies, and may process it outside your country.

11. Your Rights

Regardless of where you live, you have the right to:

• Access: All your data is visible within the App
• Delete: Use the in-app account deletion feature
• Portability: Your data is stored locally on your device, and you can export a trip's itinerary as text or PDF
• Revoke sharing: Remove participants from shared trips at any time
• Turn off optional sharing: Private Cloud Compute and travel time estimates are off by default, and you can turn either off in Settings at any time

Because your trip content is end-to-end encrypted, we cannot access it to provide copies or make corrections — you control your data directly through the App.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last Updated" date above. Continued use of the App after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, please contact us at:

By using Jurni, you acknowledge that you have read and understood this Privacy Policy.