Privacy

Privacy at Cordelle

Effective September 30, 2026

How Cordelle works, and whose data this is

Cordelle is a companion app that tour companies license and run for their own trips. If you are a traveler or a guide, you were invited by a tour company: they built the trip, entered the roster, and sent you a join code. The details in the app are the ones you gave them when you booked.

That shapes everything below. Your tour company decides what goes into Cordelle and can correct or remove it from their dashboard at any time. Cordelle stores and moves that data on the tour company's behalf so the app works — we don't use it for anything of our own.

What your tour company puts in

• About each traveler: name, email address, phone number, traveling party, dietary notes, mobility or medical notes, and an emergency contact's name and phone number — whatever of these the traveler gave the tour company when booking. Guides see these care notes so they can look after the group; on a guide's phone that screen sits behind a PIN.
• The trip itself: the itinerary, hotels (addresses, phone numbers, Wi‑Fi codes, booking confirmation numbers), flights (with their confirmation codes), a short list of documents and confirmations the operator types in (insurance policy numbers, transfer vouchers, an emergency line), packing list, and country basics. This is trip information, shared with everyone on the departure.
• Guides: the guide's name and phone number, shown to the group as the person to call.
• The tour company’s guest book: tour companies keep their own record of the people who travel with them, and Cordelle now holds that record for them — your name, email address and phone number, any labels they file you under, a “do not contact” flag if you have asked to be left alone, the trips you have taken with them (including past seasons they bring in from their own spreadsheets), and, where a group organizer brought you, who that was. It is the company’s address book, visible to their office only — never to other travelers, never to guides, never in the app.
• Office notes and records about you: the tour company you booked with can keep notes about you (for example “prefers a ground-floor room”), a checklist of paperwork they are waiting on, and their own bookkeeping of what you have paid them and what is still due. These live in the company’s dashboard only: your app never shows them, they are not in your trip download, and Cordelle neither collects your money nor sees your card — any payment happens with the tour company directly, their way. What you may notice: a reminder email from the company, sent by a person in their office, listing what they still need or what is still due, with their own payment instructions. Replies to it go to the company, not to Cordelle. These emails have no tracking pixels and no images that report back.
• Tour company staff: office staff sign in with an email address and a password. Passwords are stored only as salted hashes — we cannot read them. Subscription billing runs through Stripe, and card numbers go straight to Stripe; they never touch our servers. Travelers never pay Cordelle anything.

Health and medical notes

Two of those fields deserve their own heading, because glossing over them would be dishonest. Dietary notes and mobility notes are health information about you. A tour company's spreadsheet often calls that column “Medical”, “Allergies” or “Accessibility needs”, and Cordelle deliberately accepts those headings, because that is what the information really is. On a guide's phone the two appear together as Dietary & medical notes. In Europe and the UK this is special-category data under Article 9 of the GDPR, and it is treated that way here.

• Your tour company decides what goes in. They collected it when you booked, and it is theirs to correct or remove at any time. If you would rather something wasn't there, ask them — and they can take it out in seconds.
• Who sees it: your tour company's own office staff, and the guides assigned to your departure. Not other travelers — the notes your tour company holds are never shown to them. (What you choose to write about yourself in the trip’s group is a different matter: everyone on the trip reads the group, which is why its rules ask you not to post medical details. See Group messages.) Not us, for any purpose of our own. Never any advertiser, insurer or third party.
• Where it is protected: on a guide's phone the roster sits behind a PIN that locks again after the app has been closed a while, so a phone left on a coach seat doesn't hand it over.
• What we do with it: nothing. It is stored, shown to the people above, carried inside the offline copy of the trip, and included in our nightly backups. It is not analyzed, not used to train anything, and not sent to any other company.

What the app keeps on your phone

Before departure the app downloads your whole trip as one bundle and reads every screen from that copy — that is what makes it work with no signal. Your phone also holds your join session, the message inbox, a copy of the trip’s group messages if your tour company has turned the group on, and a small outbound queue (read acknowledgements, any location pings you chose to send, sync confirmations, any quick status you tapped, and any group message of yours waiting to go) that is delivered the next time you are online. Every screen shows when it last synced, so you always know how fresh it is.

• Some things never leave your phone. Packing-list checkmarks stay on the device — nobody else sees them. A guide's headcounts are kept on the guide's phone only.
• Leaving a trip erases the app's data. "Leave trip" clears the bundle, the inbox, the group, the queue and the session from the device.

Location sharing

Location sharing exists so a guide can find the two people who wandered off — not to follow anyone around. It works like this, and only like this:

• Off by default, for every traveler, on every trip.
• You start it, and it ends itself. A session runs for a short time you choose — the app today offers one hour, and a session can never exceed four hours — and expires on its own. However you share, you can stop early at any time: your phone stops sending the moment you tap, and a "stop sharing" tapped with no signal is queued and honored the moment you reconnect.
• Trip sharing is the only background mode, and you build it yourself. By default the app sends your position only while you are using it. If you choose “Share for my whole trip” — and then also grant your phone’s own “allow all the time” permission — the app sends your position in the background: roughly every 15 minutes, and only after you have moved about 500 meters, never more often and never as a live track. The end time is set by our servers from your tour’s final day in the tour’s own timezone — the app cannot extend it. It switches itself off then, or the moment you tap “Stop sharing now”. While it is on, the app always shows it (on Android, a permanent notification; on iPhone, the system location indicator). There is still no continuous tracking: the cadence above is a ceiling we have written down as a rule, not a dial.
• SOS is the one exception. An SOS, or a deliberate "send my location once", sends a single position even with sharing off. The tap itself is the consent, and it covers that one position only.
• What the guide sees is a last known position with its time — never a live track. Anyone not sharing simply shows as not sharing.
• Every ping is erased after 30 days — with one honest qualification. A daily sweep on our servers deletes location pings once they are more than 30 days old, counted from when the server received them. We also take a nightly backup of the whole database and keep 14 days of those, so a ping can still sit inside a backup file for up to about two weeks after it left the live system — 44 days at the very outside — before it is gone everywhere. Backups exist to recover from a disaster and are never used to bring back something that was deleted.

Push notifications

If you allow notifications, the app registers your device's push token so a guide's message can reach you promptly. A push is only the doorbell — the message itself lives in the app's inbox, so nothing important exists only as a notification. The token is removed when you leave the trip, and swept automatically once your departure ended more than 30 days ago.

Group messages

A tour company can turn on a group for a trip: one text-only thread where the travelers who have the app, the guides and the company’s office write to each other. It is off for every trip until the company turns it on. If your trip has no Group tab, nothing below applies to you. Before you write for the first time, the app asks you to accept the group rules.

• Who can read what you write: every traveler on that trip who has the app, the guides on it, and your tour company’s office staff. If the company has connected its own booking system to Cordelle, that system can read it too. Not travelers on other trips, and not other tour companies. Your name in the group is your first name and last initial. Cordelle’s own staff read a message only when handling a report, a support request, or a closure, never for any purpose of our own.
• What we store: each message, with your name as shown, the time, whether you marked it a question and what it replied to. Any report made about a message: who reported it, the reason, and the text as it read. What your guide or the office did about that report. And your own membership record: when you accepted the rules, how far you have read, your notification choice, any quiet period, whether you left, and which people you have blocked. The last of these is shown to nobody, your tour company included.
• Reporting and blocking: you can report any message with one of four reasons. Your tour company sees who reported it. The person you reported never does. A message two people report is hidden until the office decides. You can block a person, which hides their messages from you alone and tells nobody. Your guide and the office can remove a message or pause someone’s posting; the office can also remove someone from the group. Cordelle can close a group to meet its obligations to the app stores.
• Deleting a message: you can delete your own at any time. It is removed from every phone at its next sync and "Message removed" stands in its place. If someone reported it first, the report keeps its text for the office until the group is deleted.
• Notifications about the group carry a count and nothing else: "Group: 3 new messages". By default they come at most once every two hours, and never between 9 pm and 7 am trip time. You can change that in the app’s Settings, or switch the group’s notifications off.
• How long: the group is read-only from the day after the trip’s grace day — two days after the trip’s end date. Everything in it — messages, reports and memberships — is deleted 30 days after the trip’s end date. Nothing from the group goes into the printed packet or the trip download on your phone. As with everything else, a nightly backup can hold a copy for up to 14 days after that.
• Words that are not allowed: a message containing one of a short list of slurs and the strongest profanity is refused before it is stored, and you are asked to reword it. The list is ours, in the software. No outside company screens your messages.

What we don't do

• No advertising. There are no ads anywhere in Cordelle.
• No selling or renting data. To anyone, for any purpose, ever.
• No tracking across apps or websites. The traveler app — the one you carry on your trip — holds no advertising or cross-app tracking identifiers at all. Our two websites do carry a Google Ads conversion tag, which — once it is switched on — sets a cookie remembering that you arrived from one of our ads, so we can count the trial signup or enquiry it led to. On cordelle.io it is not loaded at all unless you accept it. It is described under This website below. We build no remarketing audiences from it.
• No analytics SDKs in the app. The traveler app — the one you carry on your trip — ships with no analytics or tracking library at all. Our two websites are a different matter: they use Google Analytics and a Google Ads conversion tag, and both set cookies. On cordelle.io they are switched on only if you accept them. Exactly how that works, and what we have switched off, is under This website below.
• No marketing to travelers. The only email a traveler ever gets from Cordelle is the join code their tour company asked us to send.
• Not for children. Cordelle isn't directed at children; you can only join a trip with a code from a tour company.

The companies that help us run it

Cordelle runs on a small set of well-known services. Each one holds only what its job needs, and none of them may use the data for their own purposes.

How long things are kept

• Location pings: deleted by a daily sweep once more than 30 days old.
• Push tokens: removed when you leave a trip, and deleted automatically once the departure ended more than 30 days ago.
• Quick statuses: if you tap On my way, Running late or Sitting this one out, your guide and your tour company see that choice, with the time you tapped, for 12 hours. It is one of three fixed choices — there is nothing to type — and the record is deleted by the daily sweep once more than 30 days old.
• Group messages: read-only from the day after the trip’s grace day; messages, reports and memberships deleted by the daily sweep once 30 days have passed since the trip’s end date. A message you delete yourself is removed from every phone at its next sync.
• Sign-in sessions: traveler and guide sessions last 180 days so the app never demands anything mid-trip; staff sessions last 30 days. Expired sessions are deleted daily.
• Join codes: a code stops opening a trip 90 days after that departure's end date, even if the record is still there.
• The guest book: kept by the tour company for as long as they keep their account. Their dashboard deletes any guest’s record in one action — and can export it — so asking them is enough.
• Office notes, checklists and money records: kept by the tour company for as long as they keep your record, like the rest of their guest book. Ask the company to see or delete them — their per-guest export includes notes, and their delete removes the notes with the record.
• Website inquiries: if you send the inquiry form on a tour company’s catalog site, what you typed is kept for that company until their office deletes it — their dashboard deletes inquiries row by row. Ask the company, or write to us and we will take it up with them.
• Trip and roster data: kept for as long as the tour company keeps it. When an operator deletes a departure, its travelers, join codes, sessions, messages, group, location pings, push tokens and published bundles are deleted with it. When an operator deletes a traveler, every group message of theirs is blanked on every phone before the record goes.
• Backups: a full copy of the database is taken nightly and kept for 14 days, then deleted. Anything erased from the live system can therefore linger in a backup file for up to that long afterwards. This is the one place where “deleted” isn't instant, and we would rather say so than let you assume otherwise.

Keeping it safe

Everything travels over HTTPS. Passwords are stored only as salted hashes. Sign-in tokens are opaque, stored hashed, and revocable — a tour company can rotate a guide's access with one click, and every session for that code ends immediately. On a guide's phone, the screens holding the group's care notes sit behind a PIN that is never stored, only a salted hash of it. Office staff can turn on two-step verification, and repeated wrong passwords lock that one account rather than the whole company. One tour company's data is never visible to another: every request is filtered by the account behind the token that made it.

Tour companies who need the detail — what we hold, where it sits, who else touches it and what happens on a breach — will find it in the Data Processing Addendum, alongside the Terms of Service.

Corrections and deletion

Your tour company is the right first call: they entered your details, and their dashboard lets them correct or delete any traveler's information, or an entire departure, at any time. If you'd rather ask us directly — or you're not sure who to ask — write to [email protected] and we'll take care of it with them.

This website

Two Google products can run on cordelle.io: Google Analytics, which counts visits so we can see which pages bring tour companies to us, and a Google Ads conversion tag, which remembers that you arrived from one of our ads for long enough to count the trial signup or enquiry it led to. Both store cookies. Neither is loaded unless you say so.

We ask first, and asking is a gate rather than a label. This is exactly what happens on this site:

• On your first visit a bar appears along the bottom of the screen with two buttons, Accept cookies and Decline cookies, styled identically so that neither is the easy one. The page is padded so the bar never sits on top of the content, and it traps neither your keyboard nor your scrolling.
• Until you press Accept, nothing from Google Analytics or Google Ads is fetched at all — not the script, not a request, not a pixel. So no _ga, no _ga_…, no _gcl_au: there is no Google cookie in your browser to find, because the code that would set one was never downloaded. This is the part most banners get wrong, and it is the part we care about.
• Ignoring the bar means no. You do not have to interact with it. Reading the site and leaving is a declined visit, and the same is true of every page you open afterwards.
• If you arrived from one of our ads, Google puts a click id in the address bar. We carry that id onto the Start your free trial links for the rest of your tab — nothing is downloaded from Google and no cookie is set — so that if you later accept cookies in the dashboard, your signup can be credited to the ad. Press Decline here and the links are stripped of it.
• Declining also cleans up. Earlier versions of this site did set those cookies on arrival. On any visit where you have not accepted, we actively expire any _ga, _gid, _gat, _gcl_ or _gac_ cookie left over from back then, so a Decline governs the past as well as the future.
• If your browser sends a “do not track” signal and you have not answered yet, we treat that as a Decline and do not show you the bar at all. It is a default, not a veto: if you go and press Accept, that wins.
• You can change your mind at any time with Cookie choices in the footer at the bottom of the page. It reopens the same bar, tells you what is set right now, and lets you close it again without deciding.
• Your answer is remembered in your browser’s own storage, on that browser, and is never sent to us or to Google. Clearing your site data forgets it, and we will ask again.

When you do accept, Google Analytics records the page you are on, where you arrived from, and the usual coarse technical facts (country, browser, whether you are on a phone), and the Ads tag reads the marker on your ad click. Google Signals is off, and so is the account setting that would share your visit with Google’s other products for its own purposes; we build no remarketing audiences. Three narrower account settings are left on — the ones that let Google produce modeled and benchmarked figures from de-identified data, let its support staff look at the account when we ask for help, and let it suggest changes to our own setup. These visits are counted, not used to follow you around other companies’ websites.

Join-code pages load nothing from Google, whatever you answer. The cordelle.io/j/… links in traveler invites carry the code that opens a trip, so those pages show no cookie bar, load nothing from Google, and are served with a security policy that does not permit Google’s script to run even if something tried. They are also kept out of search results and out of referrer headers. The one thing that does see them is Cloudflare’s cookieless page counter, described below, which records that the page was opened and not who opened it.

The operator dashboard is different, and it is only for tour-company staff. app.cordelle.io is where an office signs in; travelers and guides never use it. It carries the same Google Analytics measurement, and it now asks there too, with its own bar on every screen of that site, its sign-in page included. Nothing is fetched from Google until an operator accepts; ignoring the bar means no, and a browser that sends “do not track” is treated as no without being asked. Your answer on this website does not carry over to that one — the two addresses store their answers separately, so staff are asked once in each place. What the dashboard is never told is as tight as it was: anything identifying a trip — the identifiers in the address bar are replaced before reporting, so Google is told that someone opened a departure’s traveler list, never which departure, which company, or which traveler — and anything in a link’s query string, such as the single-use token in an invite or password-reset link, which is discarded before anything is sent. The Ads tag there is switched on for one moment only, when an account has finished being created, and is kept off every screen that shows a roster.

Three things run whatever you choose, because none of them sets a cookie. This website serves its own typefaces; the operator dashboard’s load from Google Fonts, so a staff member’s browser requests those font files from Google’s servers on every visit. Cloudflare Web Analytics counts page views on this website, the operator dashboard and the join-code pages — the page address, where you came from and coarse facts about the device, with no cookie and no identifier that follows a person from one visit to the next, which is why it is not behind the cookie question. And the operator dashboard keeps a few things in your browser’s own storage: the sign-in token, the name of the account and agency it belongs to, and your answer to the cookie question — nothing about any traveler.

If you send the interest form, we use what you typed to reply to you and for nothing else — no list, no newsletter.

Tour companies’ own catalog sites

A tour company can run a simple public page of its tours through Cordelle, at an address like cordelle.io/s/their-name. Those pages are the company’s shop window, not part of any trip: they show only what the company wrote for the public — tour descriptions, a day-by-day outline, hotel names and cities, packing lists, country basics, and the company’s own price line and booking link. Nothing about any traveler, past or present, can appear there.

• The pages run no scripts and set no cookies. No Google Analytics, no Google Ads tag, no cookie bar — there is nothing to ask about. Cloudflare serves the pages, as it serves the rest of our sites.
• If you send the inquiry form — your name, email address, phone number if you give one, party size and message — it goes to that tour company: a row in their dashboard and an email to their office, which they reply to directly. Cordelle stores it for them and does nothing else with it — no list, no newsletter, nothing shared. To see it corrected or deleted, ask the company, or write to [email protected] and we will take it up with them.
• These pages are kept out of search engines while the feature is young, so a company’s catalog is reached by the address the company hands out, not by being crawled.

Changes to this policy

If this policy changes, the new version appears here with a new effective date, and we tell tour companies about any change that matters. We won't quietly weaken it.

Contact

[email protected] — a person reads it, usually within a business day.