ShipTrip

ShipTrip

Privacy

Updated: October 21, 2026

1. Controller and contact

The controller for the ShipTrip app and for the website shiptrip.jahaus.de is:

AppManufaktur
Inh. André Jaszka
Rebhuhnweg 12
59227 Ahlen-Vorhelm
Germany
Email: info@jaszka.com
Phone: +49 160 948 13 420

2. Summary

  • The ShipTrip app requires no user account and uses no developer-owned servers. Only this website runs on a developer-owned server.
  • Travel data is stored on your device and, when iCloud is available, in the private CloudKit area of your Apple Account.
  • ShipTrip contains no advertising, tracking, or third-party analytics SDKs.
  • Calendar sync, local reminders, photo selection, export/import, and AI import through Google Gemini are optional features.
  • Gemini import works only with a Google Gemini API key supplied by you. When used, the text you paste is transmitted directly to Google.

3. Data processed in ShipTrip

Depending on how you use the app, ShipTrip processes:

  • cruise titles, travel dates, cruise lines, and ships
  • cabin and booking details
  • routes, ports, port times, sea days, and excursions
  • notes, ratings, expenses, and journal entries (including mood)
  • travel, port, and journal photos selected by you
  • wish-list trips and custom cruise lines or ships
  • app settings, calendar selection, and mappings for calendar events created by ShipTrip
  • an optional Gemini API key

4. Local storage and private iCloud/CloudKit

ShipTrip stores app data locally using SwiftData. If you are signed in to iCloud and iCloud is available for ShipTrip, Apple synchronizes this data, including photos you add, through the private CloudKit area of your Apple Account. The developer operates no server for this purpose and cannot access your private CloudKit area.

Apple’s processing is governed by the Apple Privacy Policy.

5. Optional AI import with Google Gemini

AI import is not configured by default. It becomes available only after you store your own Gemini API key in Settings.

  • The API key is stored in the iOS Keychain using the ThisDeviceOnly accessibility setting.
  • When validating the key, ShipTrip sends a short test prompt and the key directly to the Gemini API.
  • Each time you initiate an AI import, ShipTrip sends the complete text you pasted into the import field, together with extraction instructions, directly to Google. Photos and other files are not sent automatically.
  • ShipTrip does not receive your API key, booking text, or Google’s response on any developer-owned server.

Google states that prompts, context, and outputs are retained for 55 days for abuse monitoring. For unpaid services, Google may also use inputs and outputs to improve its products, and authorized human reviewers may process content. For users in the EEA, Switzerland, and the United Kingdom, Google states that the Paid Services data-use terms apply even to unpaid quota. For Paid Services, Google states that prompts and responses are not used for product improvement, but abuse monitoring and legal retention obligations still apply.

Do not submit sensitive, confidential, or unnecessary personal information. Use is governed by the Gemini API Additional Terms, Abuse monitoring documentation, and Google Privacy Policy. Google requires API users to be at least 18 years old and requires a Paid Service for API clients made available in the European Economic Area, Switzerland, or the United Kingdom. Use the Gemini feature only if you meet these requirements.

6. Optional calendar sync and reminders

If you enable calendar sync, ShipTrip requests full access to calendar events. The app displays writable system calendars and creates, updates, or removes ShipTrip events containing travel titles, dates, port/location details, and app-related notes. Depending on the calendar you select, the operating system may synchronize these events with Apple or another calendar provider you have configured. That provider’s terms apply. ShipTrip does not transmit calendar data to developer-owned servers.

Travel reminders are scheduled as local iOS notifications on your device. ShipTrip uses no developer-owned push server.

7. Photos

ShipTrip receives only photos you deliberately select through the iOS photo picker. They become part of your app data and may be synchronized through your private CloudKit area or included in an export you create. The app stores the selected image data without generally removing embedded metadata; originals may therefore contain a capture location (GPS) or time. A full ZIP backup includes the original image data. When you share a single cruise, images are re-encoded as JPEGs without the source metadata instead.

8. Export and import

You can export your data, including related photos and journal entries, as a ZIP archive and import ZIP or supported JSON files. You can also share a single cruise as a .shiptrip file and import a cruise file you receive. An export is created only at your request and passed through the iOS share sheet to a destination you select. A shared cruise may include its route, expenses, and photos. From that point, you and the selected recipient determine further processing. The temporary export file is removed after the share sheet closes; you must delete copies outside the app yourself.

9. Recipients and diagnostics

Depending on feature use, data may be provided to:

  • Apple iCloud/CloudKit: app data including selected photos for private device sync.
  • The calendar provider you select: ShipTrip calendar events, only when you enable calendar sync.
  • Google Gemini API: API key, test prompt or pasted booking text, and model response, only when you configure and actively use AI import.
  • The export destination you select: contents of the ZIP export, only when you initiate an export.
  • The recipient you select for a shared cruise: contents of the .shiptrip file, only when you initiate sharing.

ShipTrip integrates no third-party advertising, tracking, or usage analytics services. Depending on your device and App Store settings, Apple may process diagnostic and crash data and make it available to the developer.

10. Retention and deletion

  • App data remains locally and in your private CloudKit area until you delete it. Deletions synchronize through CloudKit; Apple’s terms govern backups and technical retention.
  • “Delete All Data” removes travel and catalog data stored by ShipTrip and pending local notifications. If a Gemini key exists, you can explicitly choose whether to delete it as well. It can also be removed separately in Settings.
  • Calendar events managed by ShipTrip can be removed by disabling calendar sync while calendar access remains granted. Otherwise, delete them in the relevant calendar or temporarily grant access again.
  • Exported files and copies stored by calendar or cloud providers may need to be deleted there.
  • Uninstalling the app alone may not remove data from iCloud or the iOS Keychain. Use the relevant deletion controls before uninstalling if you want those items removed.
  • Google’s published retention periods apply to Gemini processing.

11. Your rights

Where personal data is processed by a controller, you may have rights including access, correction, deletion, restriction, portability, and the right to lodge a complaint with a data protection authority. Because the developer cannot access your private local or CloudKit data, you manage that data directly in the app or through your Apple Account.

You may object to processing based on Art. 6(1)(f) GDPR (see section 12) on grounds relating to your particular situation (Art. 21 GDPR). For any request, an email to info@jaszka.com is sufficient. I reply within one month (Art. 12(3) GDPR). You can lodge a complaint, for example, with the data protection supervisory authority where you live (Art. 77 GDPR).

12. Website and email contact

Website shiptrip.jahaus.de

The website provides product, support, and legal information about ShipTrip. It runs on my own server in Germany (a container on a Proxmox server). The web server there writes no access logs.

The server is reachable via a tunnel and the network of Cloudflare (Cloudflare, Inc., USA). Cloudflare forwards the connection and keeps cached copies of the website’s images and other files (CDN). The encrypted connection ends at Cloudflare and is forwarded from there to the server. In doing so, Cloudflare processes your IP address, the time, the paths requested, the browser or device identifier and, technically, also the content transmitted. The legal basis for using Cloudflare is Art. 6(1)(f) GDPR; my legitimate interest is a secure, available website.

Cloudflare acts in two roles here:

  • As my processor, Cloudflare delivers the website via tunnel and CDN, on my instructions and under the Cloudflare Data Processing Addendum. This covers the content transmitted and the logs Cloudflare provides to me for my website.
  • As a controller in its own right, Cloudflare also processes connection data for its own purposes, for example to operate, secure and improve its services and to prevent fraud, unauthorized access and other illegal activities. Cloudflare itself is responsible for this. Details are in the Cloudflare Privacy Policy, especially sections 3 and 6.

Cloudflare is based in the USA. The transfer there is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, under which Cloudflare is certified, and additionally on the Cloudflare Data Processing Addendum with EU Standard Contractual Clauses. You can obtain a copy of these safeguards on request at info@jaszka.com. Cloudflare keeps the data as long as the respective purposes or legal obligations require. Cloudflare does not state a fixed period.

The website sets no cookies, stores nothing in browser storage, uses no analytics or tracking tools, contains no forms, and loads no content from other providers, not even external fonts. The home page loads the images of its picture sequence from the same server, sized to your screen width. Links to the App Store only lead to Apple when you click them.

Contact by email

If you send me an email at info@jaszka.com, I process your email address, your name if you give it, the content of your message and the time. I use this only to reply to you and to handle your request, including requests about your data protection rights. Please avoid sending unnecessary travel or booking information.

  • Legal basis: If it concerns the use of the app, Art. 6(1)(b) GDPR. Otherwise Art. 6(1)(f) GDPR; my legitimate interest is being able to answer requests. For requests about your rights, Art. 6(1)(c) GDPR in conjunction with Art. 12 GDPR.
  • Storage period: I delete your email once your request has been dealt with, unless statutory retention periods require me to keep it. I keep requests about your rights as proof for up to three years after they are closed (Art. 5(2) GDPR, limitation period under Section 195 of the German Civil Code, BGB).
  • Recipient: My mailbox is hosted by netcup (netcup GmbH, Karlsruhe, Germany), as a processor. Your email does not leave the EU for this.

13. Changes

This policy may be updated when the app or participating services change. The current version will be published on this page.