Privacy — Bivio

Last updated 27 October 2026

The principle

Bivio has no account. Your trips stay on your devices and in your private iCloud. A small server of ours (Cloudflare) relays a few specific services, described below: exchange rates, plan links, the Community you choose to join, and bookings forwarded by email if you create your address. We never receive, store or see any of your data. There is nothing for us to sell, lose or hand over, because there is nothing on our side to begin with.

What the app keeps

Bivio records what you put into it:

your trips, their stops and their coordinates, your scenarios and your wishes
for each stop: your notes, where you sleep (name, link, price per night, whether it is booked), your activities (name, day, time, duration, price, booking link, notes), and the flight or ferry you leave on (terminal, reference, departure time)
your trip settings: dates, starting point, way of travelling, daily hours and driving limits, budget, currency, fuel consumption and price
the arrival and departure times detected for a stop, if you turn detection on
your bookings: type, provider, confirmation number, address, phone, email, link, times with their time zones, check-in hours, flight or trip segments (number, seat, terminal), status and notes — and the documents you attach to them (PDFs, photos, scans)
your budget: amounts in their own currency, whether paid or estimated, card or cash, and any exchange rate you type in
your packing list and, if you enter it, your passport’s expiry date — never its number
your notebook: places, accommodation, activities, links and notes outside any trip
what you share to Bivio from another app (a link, a PDF, an image), in the app’s own folder on your device, until you choose where it goes
a summary of the current travel day, in that same folder, for the widget

Where it lives

On your device. If you turn iCloud on, it also syncs through your own private iCloud database, which Apple encrypts and which we cannot open, read or list. We have no key and no access of any kind.

What it asks permission for

Every one of these is optional. Refuse any of them and the rest of the app keeps working.

Location, while you use the app: To show where you are on the map, when you touch the location button. Your position is shown, not stored, and never sent anywhere.
Location, including in the background: Only if you turn arrival detection on. The app draws a circle around each stop and asks iOS to tell it when you enter or leave one. It never reads your position otherwise, and your coordinates are never stored: what gets saved is a time, not a place. Leave the feature off and the app never asks.
Calendar — write only: To add your itinerary — stops, activities and flights. iOS grants write-only access, so the app cannot see anything already in your calendar.
Camera: Only to scan a paper confirmation or ticket into a PDF you attach to a booking. The images stay on your device and in your private iCloud.
Notifications: Local reminders for your packing list, scheduled on your device — J-30, J-7, and a warning if your passport expires too soon. No push, no server.

What leaves the device

The app has no analytics, no crash reporting, no advertising and no third-party kit of any kind. What it does send, it sends only to the services below, and only for what you asked it to do:

Apple Maps, to search: What you type in the search field, and the region you are looking at.
Apple Maps, to route: The coordinates of the start and the end of a leg, to get the distance and the driving time — and of a wish near your route, to measure the detour.
Apple Maps, to name a place: The coordinates of a point you tap, to turn it into an address.
Apple Maps, to draw: The map region shown in a printed booklet.
Apple Weather: The coordinates of a stop and the dates of your stay, to show the forecast when those days are near, and the usual weather for them — averages of past years — when they are not.
Google Maps, to read a shared list: The link of a Google Maps list you paste, and only when you ask Bivio to read it — nothing about your trips.
Our exchange-rate relay: Nothing about you. Once or twice a day the app downloads the whole table of the European Central Bank’s reference rates from a Nidello relay (bivio.nidello.ca). The request is the same for everyone: no currency, no amount, no identifier, no trip. The relay keeps no log of requests. Every conversion is done on your device.
Bookings by email (optional): If you create your address in Bivio (Profile › Bookings by email), emails you forward to voyage+<code>@nidello.ca reach Bivio’s server (Cloudflare Workers). Each email is encrypted for your device as soon as it arrives (the private key never leaves your iCloud Keychain), kept 7 days at most, and deleted as soon as the app picks it up. The server does not read it; the app reads it on your device. Unknown addresses are rejected. You can stop using the address at any time.
The Community (optional): Nothing is public by default: you publish one trip at a time, after an exact preview of what will be shared. Published: the title, the month and year (or the dates, if you choose), the countries, the stop cities in order (placed to within about a kilometre), the nights at each stop, the driving distance and time, the name you chose (a nickname or first name, never taken from your Apple ID) and an optional author’s note. Never published: travelers, bookings and their numbers, attachments, costs, notes, lodgings and your starting point. These itineraries are kept on Bivio’s server (Cloudflare) and shown on bivio.nidello.ca/social and in the app for as long as you leave them published. You can remove them at any time, one by one or all at once, and removal is immediate. The ratings (stars) you give other people’s trips are tied to an anonymous key on your device, one per trip. Reporting a trip sends an email to Nidello. Contact: [email protected].

None of it reaches us. We have no server in any of these paths, and we never receive a copy.

The suggestions

When the app suggests stops, it does the thinking on your iPhone, with Apple’s on-device model. Nothing about your trip is sent to a model on a server — not ours, not anyone’s. The place names it comes up with are then checked against Apple Maps, which is the outgoing search described above. With Plan with your AI, the app sends nothing either: it writes a text — what you want and, if you leave them on, the trip’s stops, scenarios and numbers, or the regions you have visited — that you copy yourself into the AI of your choice. That AI receives what you paste, under its own policy; its answer comes back the same way, through you, and every place in it is checked against Apple Maps. If you add our MCP connector (bivio.nidello.ca/mcp) to your AI, the AI sends it the plan it wrote, to check it and make an import link: no account, no request log; the plan is encrypted with a key that exists only in the link, so we cannot read it, and it is deleted after 7 days. When the AI cannot fit something into the plan, the connector notes it for us in general terms — the names of the unsupported fields and the AI’s generic description, never your values — and sends us a daily summary of these feature requests.

Sharing a trip

If you share a trip, the app puts a copy — its title, dates and settings, the stops with their coordinates, your notes, where you sleep, your activities, your bookings and their times, the flights and ferries you entered, and the first letter of your name — in your own iCloud and gives the people you name a link to it. That copy never carries amounts, confirmation numbers or attachments. When you share to be followed read-only, the copy is updated in your iCloud after each change and re-read by the people who follow it. The share is never public: only someone you invited can open it. We cannot. A .bivio file you export leaves the same way any file does, to whoever you send it; by default it carries no confirmation numbers, no amounts paid and no attachments, and you add them only if you choose to.

Talking to Cartina

Bivio and Cartina pass each other a file in a folder the two apps share on your device: Cartina writes where you have been, Bivio writes what you have planned. That file never leaves the phone, and only Nidello apps can open that folder.

Your data is yours

Export everything, whenever you want, without asking us. Delete the app and what was only on the device is gone; what synced to iCloud goes when you remove it from your iCloud settings. We cannot recover any of it for you, because we never had it.

Children

The app is not directed at children and collects nothing about anyone, of any age.

Changes to this page

If the app ever starts doing something this page does not describe, this page changes first. The date at the top says when it last did.

Your rights

Quebec’s Law 25 and similar laws elsewhere give you the right to access, correct and delete the personal information a business holds about you. In our case the answer is the same every time: we hold none. Your information is on your device and in your own iCloud, where you can already read, change and delete all of it yourself.

Contact

Nidello — Canada — [email protected]

See what Bivio does