1 · What we collect
- Email address: to deliver your QR code and order confirmations.
- Payment metadata from Stripe: a payment intent ID. Stripe holds your card details, we never see them.
- eSIM usage data: how many MB you've consumed against your active plan. Used to display in your dashboard and enforce the fair-use policy.
- Customer IP at order time: for fraud screening and to detect when an order may need manual review.
- Locale: to display the site in the right language.
2 · What we don't collect
- Card numbers (Stripe handles those).
- Phone number history, call records, SMS content.
- Real-time location (we know which country your IP says you're in at order time; we don't track movement).
- Browsing history outside travel.to.
- Behavioral profiles for advertising.
3 · Who we share it with
- Stripe: payment processing. Subject to Stripe's privacy policy.
- eSIM provisioning partners (eSIM Go, Airalo Partners as applicable): your order ID is sent so they can issue the eSIM. They don't receive your name, billing address, or card data.
- Email transport provider: to deliver your QR code email.
We do not sell, rent, or otherwise share your data with third parties beyond the operational vendors above.
4 · Cookies & analytics
First-party session cookies only, for login state. No advertising cookies. No Google Analytics, no Facebook Pixel, no behavioral trackers. If we ever change this, the date at the top of this page changes and we tell you in plain words.
5 · How long we keep your data
Order records and payment metadata: 7 years (required by tax law in most jurisdictions). Account email and usage data: until you delete your account, or 24 months of inactivity. eSIM usage data tied to an expired plan: 6 months after expiry.
6 · Your rights
If you're in the EU, UK, California, or any jurisdiction with similar laws, you have the right to access, correct, or delete your data, and to ask us to limit processing. Email hello@travel.to with "DATA REQUEST" in the subject. We respond within 30 days.
7 · Security
HTTPS everywhere, password hashing via Django's PBKDF2, data at rest encrypted on the database side. No system is 100% secure. If we discover a breach affecting your data, we tell you within 72 hours of detection.
8 · Children
travel.to is intended for adults. We don't knowingly collect data from anyone under 16. If you believe we have, contact us and we'll delete it.
9 · Contact
Muddy Holdings LLC operates travel.to. Email hello@travel.to for any privacy-related question.
10 · The travel.to Android app
The app has no accounts and shows no ads. It contains no analytics or advertising SDK. What it sends to travel.to, and why:
- Your email address and the plan you pick, when you buy: to create the order and send your eSIM and receipt-related emails.
- Payment: card or Google Pay details go from the app straight to Stripe through Stripe's own payment sheet. We never see them. Stripe's sheet also collects device and network signals for fraud prevention, under Stripe's privacy policy.
- Order look-ups: the app asks travel.to for the status, eSIM details and data usage of orders you made, by their order ID.
- The app's language, so emails and prices come in it.
- A random install ID created by the app (not your phone's hardware or advertising ID), used to rate-limit requests. It disappears when you uninstall the app or clear its data.
- Feedback you choose to send, with the email you type, if any.
- Crash and error reports: the error message, stack trace, app version, Android version and device model.
Stays on your phone: the list of your orders, the cached plan catalogue, and the result of the eSIM support check (the app asks Android whether the phone has an eSIM, nothing is sent). Notifications are scheduled on the phone. Everything is sent over HTTPS.
11 · Deleting your data
See how to delete your data. In the app, removing an order from the list or uninstalling the app deletes what the app stored on your phone.