Privacy Policy

100% Local-First Architecture

1. Summary

LOMO Passport is built with a zero-knowledge, local-first privacy architecture. We have no user accounts and no backend servers of our own. We do not collect, receive, store, or sell your personal data. Your passport details, travel ledgers, stay records, preferences, and diagnostic events never leave your device without your explicit action.

2. What is stored on your device

• Travel Ledger & Stay Records: Country codes, entry dates, exit dates, and immigration status.
• Passport & Visa Details: Nationality, display name, passport validity dates, and visa permissions.
• Local Diagnostics Buffer: A strictly capped local ring buffer of at most 100 app events, used only for your on-device troubleshooting. Never transmitted.

All on-device data is encrypted with AES-256. The cryptographic key is generated on your device and held securely in the operating system hardware keychain (iOS Keychain / Android Keystore). Oruvena never receives or holds the key.

3. Location & Arrival Detection

If you enable arrival detection, the app reads your approximate location strictly while the app is actively open in the foreground. Background location tracking is permanently disabled. Geographic coordinates are never stored to persistent disk and are never sent to external servers; they are processed in volatile memory only to suggest a country candidate, and nothing is written to your ledger until you manually confirm it.

4. Outbound Network Requests

The app is architected local-first and works offline. External network requests occur strictly in three transparent cases:

• Exchange Rates: The currency calculator queries current benchmark rates from https://open.er-api.com/v6/latest/USD. The request is anonymous and contains no identifiers, no accounts, and zero travel data. If offline, the app uses bundled baseline rates.
• Weather & Air Quality (AQI): Destination guides query current weather and US AQI from https://api.open-meteo.com and https://air-quality-api.open-meteo.com. Requests contain only public city coordinates with zero personal identifiers.
• AI Assistant (Optional, BYOK only): Operates strictly if you choose to enter your own API key (Bring Your Own Key) for Google Gemini, OpenAI, or Anthropic. Your key is stored in your hardware keychain. Before any request is sent, the app presents an explicit consent confirmation dialog (Guideline 5.1.2(i)). When confirmed, only your query text and local stay summary figures (nationality, current country, Schengen rolling days) are sent directly to your chosen provider. Passport numbers and identity credentials are never transmitted.

5. Data Deletion (Nuclear Reset)

You have absolute control over your data. You can permanently and irrevocably erase all data at any time directly within the app: Passport → Data & Privacy → Advanced → Nuclear Reset. This immediately purges the local database, deletes keychain keys, and cancels scheduled notifications.

6. Contact

If you have any questions about this Privacy Policy, please contact Oruvena:

Email: [email protected]