Navori is an app for finding and joining activities with other people. This policy explains what we collect, why, who else sees it, and how long we keep it.
We have tried to write it in plain language. Where we had a choice between a vague sentence that covers us and a specific one that tells you what actually happens, we chose the specific one.
1. Who is responsible for your data
Controller: Şükrü Caner Özdil, an independent developer trading as Navori.
Contact: privacy@navori.app
We are not a company and we do not have a registered office. The email address above is how you reach the person responsible for your data, for any request under this policy.
If you are in the UK or the EU/EEA and you think we are handling your data wrongly, you can complain to your national data protection authority. You can do that without contacting us first, though we would rather you gave us a chance to fix it.
2. Navori is for adults
Navori is for people aged 18 and over. We do not knowingly allow anyone under 18 to use it.
If our systems or a report suggest an account belongs to someone under 18, we put that account on hold and a person reviews it. We do not ask for identity documents and we will not accept them if you send them.
See our Child Safety Standards for how we handle this and how to reach us about it.
3. What we collect
You give us
| Data | When | Required? |
|---|---|---|
| Email address and Google account name | When you sign in with Google | Yes: it is how you sign in |
| Username, display name | Sign-up | Yes |
| Date of birth | Sign-up | Yes: we check you are 18+, and show your age on your profile if you allow it (Settings › Privacy › Show My Age; followers only by default) |
| Gender: Male, Female or Rather not say | Sign-up | Yes, but "Rather not say" is a full answer. Shown as F or M on your profile, to your followers by default (Settings › Privacy › Show My Gender); "Rather not say" is never shown. When someone filters Discover's "Meet someone" by gender, you appear only if your gender is visible to them. The filter they choose is not stored. If an activity is for women only or men only, your gender decides whether you can see and join it; with "Rather not say" you do not see these activities |
| Profile photo | If you upload one | No |
| Your home city, or cities if you live in more than one place | Sign-up | Yes: it tells us which country you live in, lets us count you as a local in the "people online" number, and makes sure your own home town does not earn you points as if it were a trip. Shown to your followers by default; you can change this in Settings |
| Nationalities, hobbies, countries visited | If you fill them in | No: hobbies stay visible only to you unless you change Settings › Privacy › Who Sees My Interests |
| Activities you create, and their location | When you create one | Location yes, for the activity to be findable |
| Channels you create: their name, ID, description, photo, and the places they are about | When you create one | The name, the ID and at least one place, yes |
| Messages, photos, voice messages, polls, expenses and checklists you post, in chats and in channels | As you use the app | No |
| Guides you write, and posts you share to Explore | When you write or share one | No |
| Reports you submit about other people | If you report someone | No |
| Feedback you send from Settings › Give feedback: what it is about, where in the app, how often, your message and up to 5 screenshots. If you leave "Include app and device details" on, also the app version, Android version, phone model and light or dark theme | If you send feedback | No. Only our team sees it. Screenshots are kept private and are never shown to other people |
We collect as you use the app
| Data | Why |
|---|---|
| Which activities you join, RSVP to, or check in at | To run the activity |
| Who you follow and who you block | To run those features |
| Guides and posts you like | To show you what you have liked and to count likes. The author sees how many people liked their guide or post, never who. Removed when you take the like back or delete your account |
| Channels you join, the invitations you receive and the requests to join you send | To run channels |
| Which voice chat you are in, and whether you are muted, deafened or have raised your hand | To run voice chats. Members of the channel can see it while the voice chat lasts. Deleted when the voice chat ends |
| A notification token for each device you use, and which kinds of notification you have switched off | To deliver notifications to your phone. A token is removed when you sign out on that device, and automatically when the device has not been seen for 90 days |
| Daily usage counters, such as how many AI suggestions you asked for today | To apply daily limits |
| Karma ratings you give and receive | Community rating feature |
| Your device's location, only while the app is open | Only if you allow location access. See "Location" below |
| Points (EXP), your level, achievements and community helper score | Worked out from what you do in the app, such as places you visit, activities you attend and guides you publish. Your level and achievements are shown on your profile to everyone |
| A device integrity check | When you sign up, and about once a day while you use the app. It confirms that the app is genuine and running on a real device, so that points for visits are fair |
| Moderation counters: warnings, suspensions, reports about you | To enforce our community rules |
Location
Location is optional. Navori asks for it the first time a feature needs it, and uses it only while the app is open on your screen. It never tracks you in the background.
We use it for three things:
- Maps and nearby suggestions. To show where you are and what is around you.
- Your passport and the "people online" number. When you open the app, your device works out which country and city you are in. If it is a country you have not visited before, we ask whether to add it to your passport. We also count you as online in that city for ten minutes. For this, only the country and the city are saved, never your coordinates.
- Checking visits before giving points. While the app is open, about every five minutes and whenever you check in at an activity, your device sends your coordinates to our server. The server uses them to confirm that you really were in a city or a country before it gives you points for the visit. It looks at whether your phone reports the location as simulated, whether the app passes the device integrity check, whether two positions could really have been reached in the time between them, and which country your internet connection comes from.
Your coordinates are deleted automatically after 24 hours. After that we keep only the result: which place, when, how many times you have been there, and whether the visit could be verified. Your coordinates are never shown to other people, never used for anything else, and never sold.
If you do not allow location access, Navori works normally. You simply do not earn points for visits. You can still add places to your passport yourself.
Microphone, voice messages and voice chats
The microphone is optional. Navori asks for it the first time you hold the record button in a chat or join a voice chat. For a voice message it is used only while you are recording: while you hold the button, or, if you lock a recording, until you stop it.
A voice message can be up to five minutes long. It goes only to the people in that chat or channel, the same way a photo would, and it is played through short-lived links that work only for them. A notification about it says "Voice message" and how long it is, never what was said.
We do not transcribe or analyse voice messages when you send them. The only automatic check confirms that the file really is an audio recording. If someone reports a voice message, our file storage provider turns it into text automatically so that we can review the report, and we may listen to it. Only that text, never the recording, can go on to our AI provider (see section 5).
In a channel's voice chat, the microphone works only while you are in the voice chat and unmuted. You always join muted. If you choose Push to talk, it works only while you hold the button. While you are in a voice chat your phone shows a notification, and the voice chat keeps going when you switch to another app, until you tap Leave.
Voice chats are live, with one safety exception. While you speak, our voice chat provider keeps a temporary recording of your voice, separate from everyone else's. People who only listen are never recorded. We keep only the last 10 minutes of each speaker and delete everything 24 hours after the voice chat ends. If someone reports a speaker, we keep that speaker's recording, and only theirs, as evidence for our review, together with what they say in the next 30 minutes, and our voice chat provider turns it into text automatically. Before you join a voice chat for the first time, we show you these rules and ask you to agree to them. The sound travels through our voice chat provider, which passes it to the other people in the voice chat as it happens; they do not see your IP address.
A voice chat ends when everyone has left, after two hours, or when everyone in it has been muted for five minutes. The record of who was in it, who was muted and who raised a hand is deleted when it ends.
If you do not allow microphone access, everything else in Navori works normally, and you can still listen in voice chats while the app is open.
Translating messages. When you tap the translate icon next to a message, or Translate in its menu, the text of that message is sent to our AI provider, which works out its language and translates it into your phone's language. We keep the translation with the message, so the next person who reads it in the same language gets it without the text being sent again. It is deleted when the message is deleted, deleted for everyone or changed. You can translate up to 50 messages a day and 250 in total for free. Opening a translation that already exists does not count.
What stays on your device
Language of messages. To decide which messages get the translate icon, your phone works out the language of the messages in your chats itself. Nothing is sent anywhere for that.
Trip documents. Files you add to My Attachments in a trip, such as tickets or booking confirmations, are encrypted and stored only on your phone. They are never uploaded to Navori, and other people in the trip cannot see them. If you lose the phone or uninstall the app, they are gone, unless you backed them up.
Backup to your own Google Drive. If you back up your trip documents, they are copied, still encrypted, to a hidden app folder in your own Google Drive. Google keeps them under your Google account and your storage. We keep the key that unlocks the backup, so that you can restore it on a new phone; it works only when you are signed in to your own account, and it is deleted when you delete your account.
Offline trips. If you make a trip available offline, a copy of it is stored, encrypted, on your phone.
App lock. If you turn on the lock with your fingerprint, face or PIN, your phone checks it. Navori never sees your fingerprint or face.
Voice chat settings. Noise suppression, echo cancellation, Push to talk and the volume you set for each person are stored only on your phone.
We do not collect
We do not use advertising identifiers, we do not run ad networks or third-party analytics SDKs, and we do not sell or rent your data to anyone. We do not build advertising profiles.
Some interests can say more about you than a hobby
Interests are optional, and you pick them from a list we provide: you cannot type your own. We removed the options that could suggest your sexual orientation, political opinions or health. One option, Vegan, may still suggest a philosophical belief, which the law treats as sensitive.
Three things you should know:
- Choosing any interest is entirely optional. Navori works without them.
- Your interests are private by default: only you can see them. In Settings › Privacy › Who Sees My Interests you can let your followers, or everyone, see them. If you do, an interest you share with someone can be shown to them when Discover suggests saying hi to people online nearby.
- You can add or remove any interest at any time, and removing one removes it everywhere.
We do not use your interests for advertising, we do not sell them, and we do not use them to make decisions about your account.
4. Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Run your account and show you activities | Performance of a contract |
| Keep the community safe: moderation, reports, suspensions, preventing banned people from coming straight back | Legitimate interests: protecting our users and the service |
| Check that users are 18 or over | Legal obligation and legitimate interests |
| Use your location for maps, nearby suggestions, your passport and checking visits | Your consent, given through your device's location permission |
| Deliver the voice messages you record | Performance of a contract. The microphone works only while you record, and only if you allowed microphone access |
| Keep a temporary recording of voice chat speakers, and keep and transcribe a speaker's recording when they are reported | Legitimate interests: keeping voice chats safe and being able to act on reports. We tell you before you join a voice chat, and people who only listen are never recorded |
| Run voice chats in channels | Performance of a contract. The microphone works only while you are in a voice chat and unmuted, and only if you allowed microphone access |
| Run channels, including their automatic posting limits | Performance of a contract, and legitimate interests: keeping large channels usable and free of spam |
| Work out your points, level, achievements and monthly ranking | Performance of a contract |
| Check that visits are real and that the app runs on a genuine device, so points and levels stay fair | Legitimate interests: a fair points system for everyone |
| Send you notifications about your activities, plans and messages | Performance of a contract |
| Send you content updates about places and activities you follow, such as a weekly summary or what is on this weekend near you | Legitimate interests: you can switch these off in Settings → Notifications, and they stop by themselves if you ignore them |
| Respond to legal requests and defend legal claims | Legal obligation, and establishing or defending legal claims |
You can withdraw location consent, or microphone access, at any time in your device settings. The rest of the app keeps working.
5. Automated checks, reports and decisions
Navori uses automated systems to help keep the community safe. You should know what they do and what they cannot do.
Photos. Every photo uploaded to Navori is checked on our servers before it is shown to anyone, so a modified app cannot skip the check. First, our servers compute a short digital fingerprint of the photo and compare it with known child sexual abuse material (see below). A photo that passes is then sent to an image safety provider, which checks it for explicit content and returns a result. A smaller model on your own device also scores each photo. We keep the fingerprint, these scores and the result with the photo (numbers, not the picture), so that if the photo is reported later for sexual content we can judge it without sending it anywhere again.
Known child abuse material. Navori accesses Shield by Project Arachnid (projectarachnid.ca), a program of the Canadian Centre for Child Protection Inc., to facilitate the detection and removal of child sexual abuse material and harmful-abusive material of children and survivors of child sexual abuse on its services. For this check our servers compute a short digital fingerprint of every photo you upload; only that fingerprint leaves our servers, never the photo. A photo that matches known material is blocked and never shown, the evidence is kept, and we review the case ourselves.
When you report something. At that moment we copy what you reported into a closed evidence store, so it can still be reviewed if it is changed or deleted. Only our team can open it, and every time we do is logged. What happens next depends on what was reported:
- Text (a message, a bio, a caption, a guide, an activity or a channel): checked by an AI model, together with a short window of the conversation around a message (at most the 25 messages before it and the 10 after it).
- Voice messages and voice chats: turned into text automatically. The AI model only suggests; because an automatic transcript can be wrong, we always make the decision ourselves.
- Photos reported as sexual: never sent anywhere. We decide using the scores stored when the photo was uploaded and, where needed, we look at it ourselves.
- Reports about safety, anyone under 18, fake profiles, copyright or private information: we decide them ourselves.
When automation decides. The automated check acts only when it is confident, and for text only when the words it relies on really appear in what was reported. It can remove the content and apply the restriction our rules set for that violation. Anything it is unsure about comes to us. Reports involving physical or sexual harm, threats, stalking, or anyone under 18 are never decided by automation alone.
Restrictions. A decision can remove content and, for a while, limit what you can do where the violation happened: for example sending messages, posting, or creating activities. The length follows a fixed ladder, described in our Terms of Use. Four violations within six months lock the account for 60 days; a violation after that closes it. Six months without a new violation and your count starts again from zero.
What you are told. Every decision tells you what was removed, which rule it broke, what changes and for how long. You can see your decisions and current limits in the app, in Settings › Account status. We never tell you who reported you, and we never tell someone who reported you what happened to your account.
Appeals. You can appeal every decision once, in the app, until 30 days after the restriction ends. We answer within 30 days. Appeals are decided by us, never by automation, and what you write in an appeal is never sent to an AI. The restriction stays while we look again. If you were right, everything comes back: the content, your access and your karma. For age holds, the exact sentence that triggered the hold is shown to you in the app, so you know what to respond to.
Reports from outside the app. Anyone can report illegal content on Navori through navori.app/report, and authorities can send official requests there. The page first checks that a person is using it (see "Bot protection" in section 6). Email addresses are confirmed with a code. Your IP address is stored only as a one-way code, to limit how many notices one connection can send. A notice about content on Navori is reviewed like a report from the app, and we email our decision to the address you gave.
Activity descriptions. Titles and descriptions of new activities are checked automatically.
Guides. Before a guide you publish appears, its text is checked automatically. A guide is turned down only when the check is confident it breaks our rules; if the check is unsure, the guide is published. If the check cannot run, it is tried again later, and a failure never approves or rejects anything. Photos in guides are not part of this check, because every photo was already checked when it was uploaded.
Voice messages are not checked when you send them. Only a voice message that someone reports is turned into text, as described above. Voice chats are not checked while they happen. Only when someone reports a speaker is that speaker's temporary recording kept and turned into text, as described above. A channel's owner and moderators can mute people for everyone or remove them from a voice chat. See "Microphone, voice messages and voice chats" above.
Channel names. When a channel is created or its name, ID, description or a thread name changes, an automatic check compares the text with our rules. If it fails, the channel is not shown on place pages or in Explore until its managers change it, and we review it. Anyone can report a channel, its name, description or a thread; we handle it like any other report.
Limits in channels. Automatic limits decide how often you can post in a channel: slow mode, set by the channel's managers or raised automatically as the channel grows; a waiting period before new members of a large channel can post, and a longer one before they can send photos, voice messages or links; a cap on how many messages a very large channel accepts per minute; and a block on sending the same text twice in a row within ten minutes. These limits only delay or refuse a message. They never count as a violation.
Visits. Whether a visit earns points is decided automatically, from the signals described under "Location" above. The only thing this decides is points: a visit that cannot be verified earns fewer points, and one where the location looks simulated earns none. It never counts as a violation on its own. If you think a real visit was missed, write to us.
6. Who else sees your data
We do not sell your data. We use a small number of service providers who process data on our instructions and are not allowed to use it for their own purposes.
| Category of provider | What they receive |
|---|---|
| Cloud hosting and database | Everything in your account. They store it for us |
| File storage and delivery | The photos and voice messages you upload, which they store and deliver for us, and the closed evidence store described in section 5. When a voice message or a voice chat speaker is reported, they also turn the recording into text automatically. They also host our website |
| Notification service | The title and text of each notification we send you, and a token that identifies the app on your phone. For a message, the text is usually its first lines; for direct messages you can switch this off in Settings › Notifications › Show message text. This is the notification service built into Android |
| Sign-in provider | Confirms your identity when you sign in |
| Device integrity provider | A one-time token from your device when you sign up, and about once a day after that. It confirms the app is genuine and running on a real device. It does not include your location |
| Known-material check | A short digital fingerprint of every photo you upload, never the photo, to check it against known child sexual abuse material. The Canadian Centre for Child Protection receives it and decides on its own use of it, under its own privacy policy |
| Image safety provider | Every photo you upload that passes the known-material check, to check it for explicit content before anyone sees it, and a photo reported for violence. Only the result comes back to us |
| Voice chat provider | The live sound of voice chats you join, and your IP address, to connect you and pass the sound to the others as it happens. While you speak, also a temporary recording of your voice (the last 10 minutes, deleted 24 hours after the voice chat ends) and, if you are reported, its automatic transcript |
| AI provider | Reported text (a message with a short window of the surrounding conversation, the reported bio, caption, guide, activity or channel text, or the automatic transcript of a reported voice message or of a speaker reported in a voice chat); new activity titles and descriptions; channel names, IDs, descriptions and thread names, to check them against our rules; the text of a chat message when you ask to translate it; the text of guides you publish; text you type when asking for a generated checklist; when you ask for a trip plan, only the cities and the length of the trip; and, when you ask for nearby suggestions, your coordinates together with the interests on your profile. Never photos or recordings |
| Maps providers | Map tiles, your searches for places, coordinates you look at, and the point you pick as an activity's location, to find its address |
| Weather provider | The coordinates of an activity, to show its forecast |
| Exchange rate provider | Only a currency code (your group's main currency) |
| Email provider | An alert telling us a new report needs review, with a report reference and its category but no message text, no names and no other user content. On navori.app/report: the one-time code that confirms your email, our decision on your notice, and, for authorities, the receipt and our reply |
| Bot protection | Only on navori.app/report: your IP address and signals from your browser, to check that a person is sending the form. Nothing is stored by us apart from the result |
Some images in the app, such as country flags, load from public image services. When an image loads, that service can see your device's internet address. We send them nothing about you.
Before a message goes for an automated check, usernames in it are replaced with placeholders. The text itself is sent as written, because that is what is being judged. Attachments are never sent for message checks.
Other users see what you would expect them to see: your profile, the activities you join, and what you post in them. If your profile is private, followers need your approval first.
An activity marked women only or men only is shown only to people of that gender, and to people who are already in it.
Channels. Anyone on Navori can find a channel by its ID. For a public channel they see its photo, name, description and number of members, and can join. A public channel with at least 25 members and recent posts is also shown on the pages of the places it is about and in Explore, with the same details; its owner can turn this off in the channel's settings. Private channels are never shown there. A channel can carry a verified badge: its owner asks for it, telling us who runs the channel, and a person on our team decides. We keep these requests and our decisions for as long as the channel exists. For a private channel they see the name, description and number of members, without the photo, and need an invite link or the managers' approval to join. Nothing else is shown before someone joins. Inside a channel, every member sees the messages, the shared items and the full list of members, and can search it. A channel can have up to 200,000 members, and everything you post there is seen by all of them. A channel's managers choose whether new members also see earlier messages. The owner and moderators see requests to join and who sent them, and can remove or ban members. Anyone with an invite link can see the channel's card. Opened on the web, a channel link shows nothing about the channel. Channel photos are public files, like profile photos.
Guides and posts. Guides you publish are public. Anyone can read them in the app and on the web at navori.app, with your username and profile photo, and search engines can list them. If you unpublish a guide, its web page goes away. If you delete your account, published guides stay, shown as written by a deleted account. If a guide is about your home city, people in the app who can already see where you live (Settings › Privacy) see a "Local" badge and "Lives in" that city on it; nobody else does, and the web page never shows it. Posts you share to Explore are seen by everyone, or only by your followers, as you choose for each post. If you mention someone with @ in a caption, their username links to their profile, and they get a notification only if they can see the post. When an activity or trip you joined is shared to Explore, people who can see that post may see your profile photo among the people going, but not your name. The same goes for activities you joined on the Activities map and list: people who can see the activity may see your profile photo among the people going, but not your name. If you add your own cover photo when you create an activity, everyone who can see the activity sees that photo. Other photos in an activity stay visible only to its members. If your profile is private, only your approved followers see it there.
Links you share. When someone opens a link to an activity or a trip on the web, they see its title, and for an activity its place and date. Nothing else is shown there, and these links stop working after three days.
Your level, achievements, karma and how reliably you host meetups are visible to everyone on Navori. Your other numbers, such as meetups, trips and places, follow Settings › Who Sees My Stats (followers by default). You appear on the monthly rankings unless you turn them off in Settings. Your memory photos can appear on your passport map, but each one only to people who can already see that photo: photos from an activity only to people who were in it, trip photos only to the trip's members or to readers of a journal you published with them.
A trip is Private or Public, and you choose. Either way, only the outline is shown to people outside the trip: the title, the cities and how many people are going. Your followers also see the exact dates. If the trip is Public, anyone can see this outline and ask to join; people who do not follow you see only the month and the length of the trip, for example "6 days in October", not the dates. The plan, chat, expenses and lists stay visible only to members, and nobody joins without your approval.
When another traveller's trip goes to the same city on overlapping dates, the outline of your trip can appear on their trip page under "Same place, same time", but only if they could already see your trip. If they follow you, they may also get a notification about it.
Journals. When you publish a journal, you choose who can read it: everyone on Navori, your followers, or only you. Readers can like it and save it to read later. You see how many people liked it, but nobody, including you, sees who liked or saved it. You can tag the people you travelled with. Each of them gets a request, and only those who accept are named on the journal and see it on their own profile; they can remove themselves at any time and cannot edit it. A spending summary appears only if you turn it on, and then shows a rounded amount per person and the share of each category, never single expenses or who paid. Booking and flight numbers are never shown.
We may also disclose data where the law requires it, or to establish, exercise or defend legal claims.
7. Where your data goes
Our providers are located in the United States and elsewhere outside the UK and the EEA. Where data leaves the UK/EEA, it is transferred under the European Commission's standard contractual clauses or another lawful transfer mechanism.
8. How long we keep it
| Data | Kept for |
|---|---|
| Your account and profile | Until you delete your account |
| Coordinates used to check visits, and the position you checked in from | 24 hours, then deleted automatically |
| Visit results (which place, when, verified or not), points, level and achievements | Until you delete your account |
| Messages you sent in group chats, channels and direct messages | Kept after you delete your account, shown as "Deleted user". The photos and voice messages in them are deleted |
| Translations of messages | Kept with the message. Deleted when the message is deleted, deleted for everyone or changed |
| A message you, or a chat's managers, delete for everyone | Removed from the chat for everyone straight away, together with its photo, voice message or other attachment. Only our team can open the copy we keep, for 30 days, so that a report about it can still be checked. After that it is permanently deleted. If the message was reported, the copy is kept as long as the report |
| Photos and voice messages you uploaded | Until you delete them or your account, then removed from storage. Two exceptions, below |
| Photos you contributed to a place's public page, once we accepted them | Kept after you delete your account, credited to your former username, as you agreed when you submitted them |
| Guides you published | Kept after you delete your account, with their photos, shown as written by a deleted account. A guide is about a place, not about you. Guides you never published are deleted |
| Your journals | Deleted with your account, including published ones: their title, notes, and the choice and captions of photos. Photos other members took stay in the trip for them |
| Likes, saves and tags on journals | Deleted with your account. Removing yourself from a journal deletes your tag straight away |
| Posts you shared to Explore | Deleted with your account |
| Activities you created | Kept after you delete your account |
| Trips you own | When you delete your account, the longest-serving moderator becomes the owner. If there is none, the trip stays for its members, so their plans, chat and expenses are not lost |
| Channels you own | When you leave or delete your account, the longest-serving moderator becomes the owner. If there is no moderator, the channel closes |
| Closed and deleted channels | Hidden from everyone for 1 year, so that reports and legal claims can still be answered, then permanently deleted with their messages and files |
| Voice chats | While you speak, a temporary recording: only the last 10 minutes of each speaker, deleted 24 hours after the voice chat ends. A reported speaker's recording and its transcript are kept like other report evidence (below). Who was in one, mutes and raised hands are deleted when the voice chat ends |
| Notification tokens | Until you sign out on that device, or 90 days after the device was last seen. Deleted at once when you delete your account |
| The key that unlocks your Google Drive backup | Until you delete your account. After that, the backup in your Drive can no longer be opened |
| Reports, the copy of what was reported, and evidence files | 6 months, then deleted automatically. Kept longer only while one of these is still running: an official process (until it ends), an appeal (until it is decided), or a restriction from the report (until 30 days after it ends). If an account was closed for good, its evidence is kept 6 months from the decision; after that only the fact that it was closed remains |
| Violation counts (how many violations of each kind, with no content) | Until 6 months pass without a new violation, then reset to zero |
| Notices sent through navori.app/report, with the name and email in them | As long as the reports they led to, then deleted |
| Email codes and form keys from navori.app/report | 2 days |
| Official requests from authorities and their letters | Until the request, and any process that follows it, is finished |
| Feedback you sent from Settings | Until you delete your account. Its screenshots are deleted as soon as we close your feedback, and never kept longer than 60 days |
| Record of who on our team opened a report | Kept with the report |
| Signals that stop a suspended person from immediately signing up again | For as long as the suspension lasts, then deleted automatically. Indefinitely where the account was closed for good or suspended for being under 18 |
| Backups | Up to 7 days. Our hosting provider keeps daily backups for 7 days; anything you delete disappears from those backups as they roll over |
Why some things survive deletion. If we deleted your messages when you deleted your account, other people's conversations and channels would be full of holes, and activities you organised would disappear from under the people who joined them. So those stay, with your name removed. Guides stay too, because they are about places, not about you. Everything else that is about you, such as your passport, your journals, your saved places, your home city, your devices and your settings, is deleted at once.
Why moderation records survive deletion. If someone reported you, or you reported someone, that record is kept so that we can answer a legal claim and so our safety records are not rewritten by the person they are about. They are deleted on the schedule above.
9. Preventing banned accounts from returning
If an account is suspended, we keep a one-way cryptographic signature of the email address and the device it used. A signature cannot be turned back into an email address or a device ID.
We keep it so that someone who is suspended cannot delete their account and sign up again the next minute with the same address, wiping the suspension.
Being straightforward about this: because the system can answer the question "is this address suspended?", this is still personal data about you: it is pseudonymous, not anonymous. That is why it is described here, why it is not linked to anything else once an account is deleted, and why it expires when the suspension does. Only when an account is closed for good does its signature stay.
A device match on its own never blocks anyone. Phones get resold. It only flags the sign-up for us to look at.
10. Your rights
You can ask us to:
- give you a copy of your data
- correct anything wrong
- delete your account and data
- restrict or object to how we use it, including our safety processing
- take your data elsewhere in a portable format
- withdraw consent where we rely on it, such as location
Deleting your account. You can delete it yourself in the app under Settings → Delete account, or on the web at https://navori.app/delete-account by signing in with the same Google account: both take effect immediately. If your account is suspended or on hold, the in-app option is on that screen too. If you cannot sign in at all, write to privacy@navori.app.
Before you confirm, we tell you exactly what is deleted and what is kept. Deleting your account does not end an active suspension.
We answer requests within one month. We do not charge for this.
11. Security
Your data is held in a database where access rules are enforced by the database itself, not only by the app. Private profile details, moderation records, and safety tables are not readable by other users. Photos and voice messages in chats and channels, and your memories, are served through short-lived links that work only for people allowed to see them. Profile photos, channel photos and the photos in published guides are public files.
No service can promise perfect security, and we are not going to pretend otherwise. If a breach affects your rights, we will tell you and the regulator as the law requires.
12. Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the top always shows the current version.
13. Contact
privacy@navori.app Navori Circle