Privacy policy

1. Who is responsible for your data

MyTravelStatus is run by The Burrowbridge Group, LLC (doing business as MyTravelStatus.com), a South Dakota limited liability company, of 519 W 22nd St Ste 300 #251343, Sioux Falls, South Dakota 57105-1745, United States. We are the data controller for everything on this page, including for members who use the tracker inside the Relo2France portal. The same company also runs HyperActives; nothing about you moves between the two except as section 13A says. Our staff can access your account information and the messages you send us when needed to run the service, help you, and keep it secure.

For anything about your data, write to support@mytravelstatus.com. We read every message ourselves. We have not appointed a data protection officer; that address reaches the people who run the service.

2. What we collect and where it comes from

Almost everything we hold is something you typed in or uploaded. We do not buy data about you and we do not track you across other websites. The website never uses your device's location. Our phone and tablet apps use it only if you turn on automatic tracking, and even then only the country you were in each day reaches us, never where you were (section 2A). Our website statistics record only the country Cloudflare works out from your connection (section 6).

Your account

• Your email address, which is how you sign in and how we reach you.
• Sign-in codes and sign-in links. We store only a one-way code made from each, never the code or the link itself. Each is valid for ten minutes and can be used once.
• Sessions. We store only a one-way hash of the session token, never the token itself, with when it was created, when it expires and when it was last used. We do not record your IP address or your browser against a session.
• Which version of our terms you accepted, and when. We record it when you create your account, when a purchase completes and when you start an upgrade from Plus to Pro.
• The day you last used your account, so that a free account left unused can be deleted (section 9).
• Feature counts: which features your account used on which day, on which plan and where (website, apps or the Relo2France portal), as section 6A describes. Never what you entered.
• If you add a passkey, we keep its public key, a name for it (such as "iPhone"), and when it was added and last used. Your fingerprint, face or screen lock never leaves your device; we never receive them.
• Your display name, language and time zone, if you set them.
• Your alert settings: at what point you want to be warned, and whether you want alerts by email.
• If you give someone in your household their own sign-in: the email address you enter for them. We send that address one invitation. If they accept, they sign in with it and can do what you can in the account: see and change your household's travel record and its settings, read and write your support conversations with us, download the export, add and invite people, receive its alerts, forward booking emails to an address of their own, and add a passkey of their own to sign in with. They cannot change your plan or billing, or delete or reset your account. If they do not accept, the invitation runs out after 14 days and we keep the address only until you remove the invitation. You can remove their sign-in, and they can leave, at any time.

The people and travel you record

• The people in your household: their name, their role (partner, child, other), an optional year of birth, an optional nationality and an optional home country.
• Your trips: start and end dates, country, whether it was business or personal, your notes, the entry and exit points, how you traveled, and the flight, train or booking reference. Please leave document numbers out of your notes.
• Your long-stay visas and residence permits: country, kind, validity dates and notes.
• Your travel documents: kind, issuing country, a label you choose, validity dates and notes. The form takes at most the last four characters of the document number, and the database refuses anything longer. The notes turn away anything that looks like a document number.
• Your EES checks: the date you checked, what the EU tool said, a note, what our own count said at that moment, and a screenshot of the EU tool's answer if you attach one. If you tell us you sent a request to correct your EES record, we also keep the date you sent it, the country you sent it to and, if you note it, what kind of reply came and when. We never see the letter or the reply.
• Reports you make: when you make a PDF report we keep its fingerprint (a SHA-256 code worked out from the file), the time it was made and a scrambled copy of the verification code printed on it. We don't keep the report. Anyone you give the report to can use the code at mytravelstatus.com/verify to confirm that we made that file and that it hasn't been changed; they are shown the time it was made and the fingerprint, nothing about you or what the report says, and the file they check stays in their browser.
• Day limits you set: if you choose a number of days to stay under in a country, we keep the person, the country and your number, and the legal day number for that country as we showed it to you, so we can tell you if it changes.
• Planner share links: if you make a link to send someone a what-if answer, we keep the trips on that list, the answer as it stood that day, a scrambled copy of the link and the time it was made. The page the link opens shows those trips and that answer and no name; anyone who has the link can read it. A link opens for 7 days, and you can withdraw it sooner.
• Your calendar feed, if you turn it on: a one-way hash of its secret link, whether it shows names, and when it was last fetched. The calendar app you subscribe with (Google, Apple, Microsoft or another) fetches the feed and keeps its own copy of what is in it, under its own privacy policy.

Things you add on the paid plans

• Evidence files (Pro): the boarding passes, receipts and other PDFs and photos you upload. We keep each file exactly as you sent it, with its fingerprint (SHA-256), size, type, the name you gave it, a description and a document date.
• Forwarded booking emails (Plus and Pro): who sent it, the subject, a fingerprint of the original, a one-line summary of what we found, and the trip suggestions we drew from it. We keep the original email itself for 30 days, or for as long as you like if you choose to keep it as evidence.
• Your private forwarding address (Plus and Pro): a random address only you know, which you can replace at any time from the forwarded-bookings page.
• UK Statutory Residence Test answers (Pro): your answers to the questionnaire, per person and per tax year, including any short note about exceptional circumstances.

Support, notifications and billing

• Support conversations: your messages, our replies, the topic you chose, your email address, whether you agreed to let us see your plan and usage while we help you, and when you last read each one. Our staff may add internal notes to a conversation; only staff see them.
• In-app notifications: the alerts and reminders we created for you, and whether you read them.
• Billing: your Stripe customer id, the subscription id and its status, which plan you bought, when it started, when the current period began and ends, when you last changed plan, and whether and when you bought the lifetime purchase. We never see or store your card number, expiry date or billing address. Those go straight to Link (Stripe).

The change history

Every create, change and delete of a trip, person, permit, document, evidence file, EES check, UK residence answer or setting is written to a hash-chained history, so an altered or missing entry can be spotted later. That history keeps a snapshot of what changed, which means it also keeps the details of trips you have since deleted. It is deleted when your account is. Resetting your account (section 10) does not empty this history: it adds one entry that says the account was reset and names what was removed, and everything recorded before stays in it.

Sample data you can add

To see how the service looks with travel in it, you can add sample data to your account: three invented people with invented trips, permits and travel documents. We make it up; it describes nobody, and adding it sends us nothing new about you. It is tagged “sample” wherever it appears and can't be edited. Someone with their own sign-in to your household sees the sample people too. It never changes your own day counts or anyone else's in your household: a sample trip belongs to the sample people only. It is left out of your reports, your Article 52 letter, your CSV file, your calendar subscription, your alerts and reminders, and every statistic we keep. Your data export includes it, marked as sample. You can remove it at any time in Settings, which deletes it at once; your change history records each sample record added, and its removal, until you delete your account.

The free calculator

The free calculator on our website sends the trips you enter to our server to count them; we don't keep them.

Abuse prevention

To stop someone flooding the sign-in form, the public calculator, the report check, the support address, the website statistics or the calendar feed, we keep short-lived counters. A counter is a number next to a key. Where the key would be an IP address or an email address, we store a one-way keyed code made from it instead, never the address itself. Counters for a signed-in account are keyed on the account id, and the website statistics also keep one keyed on the day's visitor code described in section 6. They hold nothing else (no name, no page) and are deleted automatically within two days. When you delete your account, the counters keyed on your account id and on your sign-in address go at once; any other expires within those two days.

One record works differently. If wrong sign-in codes are entered for your email address, we keep two counts, each under a one-way code rather than the address itself: one for the connection the codes came from, which pauses codes from that connection after ten wrong codes in a day, and one for the address everywhere, which pauses codes everywhere after fifty. The sign-in link in our email still works. These rows are deleted seven days after the last wrong code, or when any pause ends if that is later, and with your account.

2A. Our phone and tablet apps

The MyTravelStatus apps for iPhone, iPad and Android hold the same account and the same data as the website. They are being tested and are not yet in the App Store or Google Play. This section says what they add.

Automatic tracking (Plus, off unless you turn it on)

If you turn it on, the app notes which country your phone or tablet is in, including when the app is closed: about every four hours on Android, and on an iPhone or iPad when you have moved or arrived somewhere. It asks your device for an approximate location only. It works out the country on your device, using a map of country borders built into the app (on Android it also looks at the country of the mobile network you are connected to), and throws the location away straight after. For each day it sends us only: the country, the first and last hour it saw you there, how many times it checked, and whether the reading was clear, near a border, or from the mobile network alone. It never sends us your location, an address, a place name or times to the minute, and no map service is asked where you are.

We use these records only to add trips to your count and to warn you before a limit. Days your device records count straight away and are marked for you to review: you can confirm, change or delete each one. Near a border, a day is recorded with every country it could be, and counts in each until you confirm it. A day with no record is never filled in.

You choose which traveler in your household the device belongs to, and only one device records a person's days at a time. You can turn tracking off at any time in the app or in your device's settings; when you do, the app offers to delete what it recorded (trips you have confirmed or changed are kept). The records are kept until you delete them or delete your account. In a demo account (section 2B) automatic tracking works the same way, so that it can be tried; what it records there is deleted with the demo account, at the latest about two days after the account was opened.

Signing in on a phone or tablet

The app signs you in with the same emailed code. It creates a key on your device that never leaves it; we keep only the public part, to recognize your device, and store only one-way codes made from the app's session tokens. For each device we record: whether it is an iPhone or iPad or an Android device, whether it is a phone or a tablet, the app version, when it was linked and last used, whose device you said it is, and whether tracking is on. We never record its name, its model or a phone number. You can see and remove your devices in Settings, on the website and in the app.

Things the app reads on your device and never sends

• Finding trips in your calendar (only if you ask): the app reads the last and next 12 months of the calendars you choose, on your device, to suggest trips (a country and dates). Your calendar is never sent to us or anyone else. Only the trips you choose to add are sent, exactly as if you had typed them, with a note naming the calendar items each came from (such as “Flight TP 433 CDG → LIS”), which you can edit or delete. If you turn on “Look again each week”, the app does the same again when you open it, at most once a week, and tells you if it finds a trip that isn't in your list. It still reads your calendar only on your device.
• Finding trips in your photos (only if you ask): the app reads where and on which day your photos of the last 12 months were taken, on your device, to suggest trips. On an iPhone or iPad it looks at the photos you allow it to see; on Android, at the photos you pick. Your photos and their locations are never sent to us or anyone else. Only the trips you choose to add are sent, with a note saying how many photos on how many days each came from, which you can edit or delete.
• Finding trips in a calendar file (the website too, only if you choose one): your browser, or the app, reads the calendar file (.ics) you choose to suggest trips. The file is never uploaded to us or anyone else. Only the trips you choose to add are sent, with a note naming the calendar items each came from.
• Scanning a boarding pass (only if you ask): the app reads the barcode on a boarding pass with your camera, or in a photo or screenshot you choose, on your device, to fill in a trip (the country you flew to, the day and the flight number) for you to check and save. It takes only the airports, the flight and the day from the barcode. Your name and booking reference are in the barcode too; the app does not use, keep or send them. No picture is taken or kept, and the pass is never sent to us or anyone else. Only the trip you save is sent, exactly as if you had typed it.
• App lock (only if you turn it on): the app asks for Face ID, Touch ID, your fingerprint or your passcode through your device. We never receive them.

Reminders, widgets and Siri

Reminders (only if you turn them on) are scheduled on your device from dates we send it, such as days left, leave-by dates and document expiry; no notification service carries your data, and they may show on your lock screen like any app's notifications. Widgets and Siri answers show the summary already on your device (days left, the next day you get back). When you ask Siri, Apple processes the spoken request under its own terms.

What the app keeps on your device

So that it opens at once and still shows something with no connection, the app keeps on your device the last answers it showed you (your status, trips and account), the last PDF report you fetched, and any trip you added with no connection, until it has been sent. They stay inside the app, behind the app lock if you use it, and are removed when you sign out. If you are signed out without choosing to be (for example by “Sign out everywhere” on another device), trips still waiting to be sent are kept until you sign in again, and are deleted if someone else signs in on that device.

What the apps don't do

The apps contain no advertising, no analytics software from anyone else and no tracking code, and use no advertising identifiers. Like the website, our own servers count which features are used (section 6A); nothing is added to the app for that, and you can switch it off in Settings. Scanning a travel document works in the apps as it does on the website, and sends the photo you choose to Anthropic (section 5); the app says so before you choose one. Once the apps are in the App Store and Google Play, downloading them is covered by Apple's or Google's own terms and privacy policies, and Apple or Google may show us anonymous crash reports if you allow that in your device's settings.

2B. Trying the service with sample data

You can try MyTravelStatus without an account. “Try with sample data” on the sign-in screen opens a demo account: a household we invented, with made-up trips, permits and travel documents. We do not ask for your email address, your name or anything else to open it, and we send it no email.

Only the browser or device that opened a demo account can reach it. Nothing in it is yours, and nothing in it is copied to an account of yours.

If you type real details into a demo account, or turn on automatic tracking there, we store them exactly as we would in a real account (sections 2 and 2A), against that demo account and nothing that identifies you. They are deleted with it.

In our apps, opening a demo account links your phone or tablet to it as a sign-in does (section 2A); that record is deleted with the demo account.

A demo account stops working 24 hours after it is opened, and we delete it, with everything in it, within a day after that. We cannot warn you first, because we have no address for it. You can delete it sooner: “Sign in with your own account” and “Delete account” both delete it at once.

A few things are switched off in a demo account: buying a plan, inviting someone, writing to us from inside it, the forwarding address, the calendar subscription, passkeys and sign-in by text, and uploading files. A photo you choose under “Scan your document” there is not read and is not sent to anyone.

To stop someone opening demo accounts in bulk, we count how many are opened from one network. As with our other counters (section 2), we keep a one-way keyed code made from the IP address, never the address, for up to two days.

What you do in a demo account is left out of all our statistics: it is not counted as a new account (section 6) and its use is not in the feature counts (section 6A). Your visits to our public pages are counted like anyone else's (section 6).

3. Why we use it, and our legal basis

Under the GDPR we need a lawful basis for each use. Ours are these.

Your email address is needed to run an account of your own, and your trips are needed to count days. A demo account (section 2B) needs neither. Everything else is optional; without it, only that feature won't work.

We make no decision about you that has a legal or similar effect by automated means. The counts are arithmetic you can check, and people make the decisions that matter.

We send only emails about your account: sign-in codes, the alerts you set, a welcome email when you subscribe (Link (Stripe) sends your receipt) and renewal reminders, a warning before we delete an unused free account, replies to your questions, and messages and announcements from us about the service. The one exception is at your request: if you give someone in your household their own sign-in, we send the address you enter a single invitation, and nothing more unless they accept. You can switch off messages and announcements in Settings, and every one of them carries a link that stops them in one click; replies to a question you asked us always come by email. We send no marketing email. If that ever changes, we will ask first, and every such email will let you stop them.

Health, religion and disability

Some things you give us can reveal health, religion or disability. Examples: a note about an exceptional stay in the UK, a hospital letter you upload as evidence, or a meal or wheelchair request in a booking email you forward. We use them only to keep your record and count your days, as you asked, and never for anything else. You can delete them at any time.

The UK Statutory Residence Test lets you leave out days you spent in the UK because of exceptional circumstances, and asks for a short note saying what happened. The form asks you not to write medical details (“Flights grounded” is enough), and the note is shown only to you.

4. Who else touches your data

We do not sell your data and we do not share it for anyone else's marketing. These are the only other companies that handle it, and only to run the service.

We may disclose data when the law requires it, such as a valid court order. We may also disclose it to protect someone's safety, or to stop fraud or abuse of the service. We ask for a lawful basis, disclose only what is needed, and tell you unless the law forbids it or telling you would put someone at risk.

If our business is merged, sold or reorganized, your data may pass to the new owner, under confidentiality while a deal is examined. The new owner must honor this policy. We will tell you before your data is used under a different one.

5. When Claude (Anthropic) sees your data

Two features send your data to an AI model. Both are optional, both only run when you start them, and neither replaces your judgment: the model proposes, you confirm.

Forwarding a booking email (Plus and Pro)

If you forward a booking confirmation to your private forwarding address, we send the sender's address, the subject, the text of the email (up to 60,000 characters) and up to five PDF attachments to Anthropic's API, so Claude can pull out the dates and countries. What comes back is checked as untrusted input and becomes a suggestion, which you confirm or discard. We keep the original email for 30 days, and for longer only if you choose to keep it as evidence.

Scanning a travel document (all plans)

If you photograph a passport, visa or permit to fill in the form, your browser first redraws the photo, which strips the metadata including any GPS location. The photo is then sent to Anthropic's API. It is held in memory for that one request and dropped. It is never written to our database, never written to file storage and never written to a log. Claude is told to return at most the last four characters of the document number, and anything longer is thrown away rather than trimmed. Nothing is saved until you check the values and save them yourself.

A photo shows the whole document, so for that one request the model sees everything printed on it, including the full number, the date of birth and the portrait. Claude also reads the holder's name, only so we can warn you if the document seems to belong to someone other than the person you picked; we do not save it from the scan.

Under its commercial terms, Anthropic does not use what we send through its API to train its models. Anthropic says it deletes what is sent through its API within 30 days. It keeps content longer only if its safety systems flag it (up to two years) or if the law requires it. Those periods are Anthropic's, not ours. We do not send your trips, your household, your change history or your evidence files to any AI model.

6. Website statistics

We count visits to the public pages so we know which guides are worth writing, which pages are slow or broken, and where new accounts come from. We built this ourselves rather than adding Google Analytics or a similar service. There is no third-party script, no cookie and no profile.

• We respect Global Privacy Control and Do Not Track. If your browser sends either, your visit is not counted at all: nothing is sent from the page.
• We never store your IP address, and we never store your user agent. We store a device class (mobile, tablet or desktop) and a browser family (for example “Chrome”). The abuse counter described in section 2 keeps a one-way code made from the IP address for up to two days; it is not linked to these statistics.
• To tell one visitor from another within a single day, we compute a one-way code from a random salt that changes every day, your IP address, your browser string and our host name. We use the same code once more if you create an account that day, to count which source the account came from (see below). The salt is deleted after two days, so after that nobody, including us, can work the code back to an IP address. It also means the same person gets a completely different code tomorrow: our “unique visitors” figure is per day, and we say so on our own dashboard.
• We store the page path with any ids replaced, no query string, the host name of the site that referred you (never the full URL), any utm_source, utm_medium and utm_campaign in the link you followed, the country Cloudflare reports, and how long the page was visible, capped at 30 minutes.
• How far down each page was read, as the deepest quarter of the page reached.
• How quickly the page worked in your browser: four measurements the browser itself makes (when the main content appeared, how fast the page reacted to a tap, how much the layout moved, and how long our server took to answer), rounded before they are stored.
• When you follow a link to another website, the host name of that website (for example “gov.uk”), never the address of the page. When you open one of our files, the file's name.
• When an address doesn't exist on our site, that the page was not found, and whether the link came from another website (its host name only), from one of our own pages, or from nowhere we can see.
• To leave out robots, the page checks three things about the browser (whether it is automated, whether it lists any plugins, and whether its window has a size) and sends only a yes or no for each.
• These website statistics never count the pages inside your account, the Relo2France embed or our own admin sessions. Once you are signed in and using the tracker, your browser sends nothing for them. What members do inside their account is counted separately and differently, on our servers, as section 6A describes.
• We also count how many accounts are created and how many checkouts are started each day. These are totals with no visitor code and no page, recorded on our servers whatever your browser settings. For a new account we also count where the visit that led to it came from. When the account is created, our server works out that day's visitor code for your browser and looks up the source of its visit (for example “a search engine”, or the campaign in the link you followed). It adds one to a weekly count for that source and does not keep the code. Nothing about the source is stored against your account, and a weekly count holds no visitor code, no account, no day and no page. If your browser sends Global Privacy Control or Do Not Track, or your visits aren't counted, the account is counted as “source not known”.
• Raw rows are deleted after 90 days. Daily totals, which contain no visitor codes at all, are kept for 25 months so we can compare a year with the year before. Weekly counts of new accounts by source are kept for 25 months too.

You can also switch this off yourself, without changing any browser setting. The choice is kept in this browser only (one entry in its local storage), so it needs no account and tells us nothing. You will find the same switch at the bottom of every page.

6A. How the product is used (feature counts)

To decide what to build and what to fix, we count which features members use. We built this ourselves. No other company receives it, and we never sell it.

• When you use a feature while signed in, our server notes the feature's name from a fixed list (for example “added a trip” or “opened the calendar”), the day, your plan, whether you were on the website, in our apps or in the Relo2France portal, the week your account was created, and whether the request worked, was refused or failed.
• It never notes what you entered or looked at: no trips, countries, dates, documents, names or notes. No IP address and no user agent.
• It is kept against a one-way keyed code made from your account id, not the id itself, so the rows cannot be read alongside your trips or your details.
• Nothing is added to the page or the app for this, and nothing is stored on or read from your device. Our server counts requests it already receives to do what you asked.
• Our own admin sessions are not counted.
• If your browser sends Global Privacy Control or Do Not Track, your use is not counted.
• You can switch it off in Settings (“Don't include my activity”). What we had counted for your account is deleted at once, and nothing more is counted.
• Rows for your account are deleted after 90 days. After that only totals remain (“212 members added a trip this week”), which contain no code and identify nobody; we keep those for 25 months.
• Your own rows are included in your data export (section 10) and are deleted when you delete your account.

7. Cookies and what your browser stores

We set exactly one cookie, and only after you sign in or open a demo account (section 2B).

There are no advertising cookies, no analytics cookies and no third-party cookies. Inside the Relo2France portal we use no cookie at all: the tracker holds a one-hour token in memory. If Cloudflare's protection ever challenges your browser during an attack, Cloudflare may set its own short-lived security cookie.

The app also keeps a few preferences in your browser's own storage, which never reach us: whether you dismissed the “install the app” banner, whether the sidebar is collapsed, whether you have finished the walkthrough and, only if you switch it on, your “Don't count my visits” choice. None of them identifies you or your account. To load quickly and show an offline page, your browser also keeps a copy of the site's own program files and icons. This never includes your data, and it happens on your first visit, whether or not you install the app.

8. Where your data is, and international transfers

We are a US company using Cloudflare's EU jurisdiction for storage. The database, your evidence files and your forwarded emails are all held there, so your records are stored in the EU. Cloudflare runs our code at the location nearest to you, so a request is handled in memory wherever you happen to be, and Cloudflare keeps our operational logs and its backups (section 9).

Some processing happens in the United States. Anthropic, a US company, reads the forwarded emails and document photos you send it. Cloudflare, also a US company, runs the service. We are a US company. The people who run it can see support conversations and account-level details.

Where the law treats any of this as a transfer of personal data out of the EU or the UK, it must rest on a recognized safeguard: the EU-US Data Privacy Framework and its UK extension, for a company certified under it, or the Standard Contractual Clauses approved for that purpose. For Cloudflare and Anthropic this is the EU-US Data Privacy Framework and its UK extension where the company is certified under it, and otherwise the Standard Contractual Clauses in its data processing terms. Proton is in Switzerland, which the European Commission recognizes as giving adequate protection. Link (Stripe) handles your payment as a separate business, under its own privacy policy, and is responsible for its own transfers.

9. How long we keep things

Most of what we hold is your travel record, and the point of a travel record is that it lasts. So we keep it until you delete it, or until you delete your account. A demo account (section 2B) is the exception: it is deleted automatically. We do not keep data we no longer need: a free account nobody has signed in to or used for three years is deleted, after warning emails 60 and 14 days before. These are the things that go automatically.

“Reset my account” in Settings deletes all of these at once and keeps your account: your trips, the other people in your household, permits, documents, evidence files, EES checks, UK residence answers, day limits, share links from the planner, the days your devices recorded, forwarded emails and notifications. It does not delete the change history, which goes only when the account does. It keeps the fingerprints of reports you have made, which hold none of your travel. Backups can hold what a reset removed for up to 30 days, as for anything you delete.

10. Your rights

If you are in the EU, the UK or another place with similar law, you have the rights below. They apply to everyone: we do not think it is worth running two standards.

• See and take a copy of your data. Settings has an export button that gives you a spreadsheet straight away (an Excel file that also opens in Numbers and Google Sheets), or the same data as a JSON file for other software, with everything listed under “What the export includes” below.
• Correct anything wrong. You can edit your trips, people, permits and documents yourself. Write to us for anything you can't reach.
• Delete everything. Settings has a delete account button. It cancels any subscription, deletes your files and removes your data from our systems, apart from the few records section 9 lists. It cannot be undone, so export first.
• Start again without deleting your account. “Reset my account” in Settings removes the travel record you have built: your trips, the other people in your household, permits, documents, evidence files, EES checks, UK residence answers, day limits, share links from the planner, days your devices recorded, forwarded emails, notifications and any sample data. It also ends a household partner's sign-in and turns automatic tracking off on your devices. It keeps your account and your own details (name, nationality, home country), the ways you sign in, your plan and payments, your time zone, your forwarding address, your calendar link and your support conversations. If you had switched off alert emails, emails from us or feature counts, they stay off. Warning levels and the monthly summary go back to how a new account starts. It keeps the fingerprints of reports you have made, which hold none of your travel. Your change history is kept, with one new entry recording the reset, so your data export still lists what was removed. To remove the history as well, delete your account. A reset cannot be undone, so export first.
• Ask us to restrict what we do. For example while we check a correction you asked for.
• Ask for your data in a portable form. That is what the export is for.
• Withdraw your consent where we asked for it, without affecting what we did before. Today that is only the tick that lets support see your plan and usage: tell us in the conversation and we will stop.
• Complain to a supervisory authority. In the EU that is the data protection authority where you live or work; in the UK it is the Information Commissioner's Office. We would rather you told us first, but you don't have to.

To exercise any of these, email support@mytravelstatus.com from the address on your account. If you have no sign-in address with us (someone in another person's household, or a Relo2France member), write from any address and we will ask you to confirm who you are. We reply within one month, and tell you if we need longer, which the law allows for complicated requests. We do not charge for this.

If you live in the United States

We don't sell your personal information, and we don't share it for cross-context advertising. We never have. The kinds of data we hold are in section 2, and why we use them is in section 3. The rights above are yours wherever you live. If we turn down a request, you can ask us to look again by replying “appeal”, and we will answer within 45 days. You may use an authorized agent; we will ask them for your signed permission. We honor Global Privacy Control and Do Not Track as sections 6 and 6A describe: with either signal on, neither your visits nor your use of features are counted.

11. How we protect it

• There are no passwords to steal: you sign in with a code or a link emailed to you, and we store only a one-way code made from it.
• We store only hashes of session tokens and of the calendar feed's secret link, never the values themselves.
• Once a day, a single fingerprint of the change histories that grew that day (a hash, from which nothing can be read back) is stamped by DigiCert's public timestamp service, so you can prove when your records existed. No data about you is sent.
• Every request you make can reach only your own account. A request for someone else's record gets “not found”, and our automated tests check this.
• Every input is validated against a strict schema before it reaches the database, and every database query uses bound parameters.
• The change history is signed with a key held outside the database, so access to the database alone is not enough to forge it.
• Evidence files are stored exactly as received, verified by fingerprint, and can never be edited in place. They are only ever sent back to you as a download, never rendered in the page.
• Your PDF report is rendered with JavaScript switched off and all network access blocked.
• In the apps, your sign-in is tied to a key that can't leave your device, the session is kept in the device's secure storage and can't be copied to another device, and you can lock the app with Face ID, Touch ID or your fingerprint.

No system is perfect, and we don't claim ours is. We keep a written record of every control we rely on, and we test the ones that matter automatically on every change.

12. Children

MyTravelStatus is not for children. You must be at least 16 to have an account, and at least 18 (or the age of majority where you live, if that is higher) to buy a paid plan. We do not knowingly collect data directly from anyone under 16. If we learn an account belongs to someone under 16, we will close it and delete its data. A parent may record a child's trips and documents as part of their household; that data is the parent's to see, correct and delete, like everything else in their account. If you link a phone or tablet used by a child in your household to the app, you are responsible for that choice; the app shows on that device when automatic tracking is on.

13. If you came from Relo2France

Some people use MyTravelStatus inside the Relo2France member portal rather than on this site. If that is you, here is who is responsible for your data and exactly what moves between the two.

Relo2France and MyTravelStatus are both run by The Burrowbridge Group, LLC, so the same company is responsible for your data (the controller) whichever way you came in. The tracker uses what Relo2France sends only to count your days and keep your records, as this page describes, and every promise on this page applies to your data.

What Relo2France sends us

• A signed token identifying you as a member. We key your account on that identifier, never on your email address, so an email match can never take over an account.
• Your display name, and your email address as a contact address only. It is used for display and receipts. It can never be used to sign in here, and we never use it for marketing.
• The people in your household: their id, name, role and optional year of birth.
• Whether you hold a French long-stay visa or residence permit, and from when. That is what makes your days in France stop counting.
• Your language and time zone.

What we send back

• A short status summary for your household: days used, days left, when your window ends and whether you are safe, near the limit or over it. Nothing else — no trips, no notes, no documents.
• Inside the portal page, the same summary so the portal can show it in its own style.

The rest

• The people and the French residence dates that come from Relo2France are read-only here. Change them in Relo2France.
• We never send you marketing email, and partner-only accounts are never emailed alerts: you get them in the app.
• If your membership ends, we keep your data for 90 days and then delete it automatically. If Relo2France tells us your membership was deleted, we delete it straight away, unless you also hold a paid plan with us under your own sign-in. Then we remove only the Relo2France link, and your own account stays.
• Your use of the tracker inside the portal is counted the same way as on this site (section 6A): feature names, never what you entered. You can switch it off in the tracker's Settings tab. Nothing from these counts is sent to the Relo2France portal.
• Your Relo2France membership itself is governed by Relo2France's own terms and privacy notice.

13A. The link with HyperActives

HyperActives is another app operated by the same company. If you have an account with both under the same verified email address, the two link by themselves, and both apps tell you when they do. Neither app sends the other your email address: each turns it into a code that only the two apps can work out, and compares codes. When the codes match, HyperActives learns that you have a MyTravelStatus account and which plan you are on (Free, Plus or Pro), so it can show you the right features. HyperActives then sends us the countries and dates of the trips you book there, never airlines, hotels, booking references or costs, so we can count your days. On Plus and Pro, those trips are added to your record, marked as coming from HyperActives, and you can change or remove them. On the free plan, we work out the answer and keep nothing. We send HyperActives how many days you have left for each of those trips and, on Pro, what each trip does to the day limits you have set. You can turn the link off at any time in Settings in either app; while it is off nothing moves either way. Trips already added stay here until you remove them.

14. Changes to this policy

The date at the top says when this page last changed. If we change something that matters — a new processor, a new use of your data, a shorter or longer retention — we will email account holders at least 30 days before it takes effect, and ask Relo2France to tell members who have no email address with us. Smaller corrections, like fixing a wrong number, we just make.

15. How to reach us

Email support@mytravelstatus.com, or use the support page when you are signed in. The terms of service cover the rest of the agreement between us.