Privacy Policy

Last updated: June 1, 2026 · Operated by Stephen Fabiani, Philadelphia, PA

1. What we collect

Nothing.

VadoVado does not collect, store, transmit, or have any access to:

• Your trips, days, travelers, locations, costs, notes, or any other content you enter into the app.
• Your name, email address, phone number, or any other identifier.
• Your IP address, device identifier, or location.
• Usage analytics, telemetry, crash reports, or feature-engagement metrics.

There is no VadoVado account to create. There is no VadoVado sign-in. There are no VadoVado servers that hold your data — because there are no VadoVado servers.

2. Where your trip data lives

Your entire trip — every itinerary, every reservation, every cost line — lives in a single file on your device with the .vado extension. The file is encrypted at rest.

You choose where the file lives on your device:

• On iPhone / iPad, you pick a location through the standard Files picker when you create a new vault. Common choices: iCloud Drive, On My iPhone, Google Drive (via the Drive iOS app), Dropbox, or any other Files provider you have installed.
• On Mac, you pick a folder through the standard macOS save dialog.

Because the .vado file is just a regular file, you can move, copy, back up, AirDrop, email, or delete it like any other document. If you sync it through iCloud Drive (or any other cloud-syncing folder), the sync provider sees only the encrypted bytes — they cannot read your trip contents, and neither can we.

If you delete the file (or uninstall VadoVado without first backing it up), your trip data is gone. We have no ability to recover it.

3. Encryption

Every .vado file is encrypted on disk using authenticated encryption (libsodium XChaCha20-Poly1305 AEAD). VadoVado offers two security tiers, chosen when you create the vault:

• Basic — the file is locked with an encryption key baked into the VadoVado app itself. Any VadoVado install on any platform can open the file. This is the right tier if losing the encryption key on device loss is your main worry, not protecting the file against someone who steals it.
• Advanced — the file is locked with a passphrase you choose. The passphrase is stretched into a key using Argon2id and never leaves your device. We cannot read your passphrase, recover it, or unlock your vault on your behalf. When you set up an Advanced vault, you are shown a one-time 12-word recovery phrase that you must save somewhere safe; if you lose both the passphrase and the recovery phrase, your file becomes permanently unrecoverable.

In both tiers, the encryption key never leaves your device. There is no key escrow, no recovery server, no "forgot password" link.

4. Third-party services VadoVado talks to

VadoVado contacts the following third-party services only when you use the specific feature noted. Each is governed by its own privacy policy.

• Nominatim (OpenStreetMap Foundation). When you add a location and request geocoding (looking up its coordinates), the location name you typed is sent to Nominatim. No trip context is sent — just the place name. Privacy policy
• OpenStreetMap tile servers. When you view the in-app map, standard map-tile requests (latitude, longitude, zoom level) go to OpenStreetMap. No trip contents are sent. Privacy policy
• Booking.com. When you tap "Find a hotel" inside the app, VadoVado opens Booking.com in your system browser (or in an in-app Safari view on iOS) with your destination and dates pre-filled. We append our Booking.com affiliate ID to the URL so Booking can attribute the click to VadoVado. If you book a hotel through that link, Booking may pay VadoVado a referral commission, at no cost to you. Once you're on Booking.com, Booking's own privacy policy and tracking practices apply; VadoVado does not see what you book or whether you book at all. Privacy policy

Tapping any of those links is a deliberate action on your part — the app does not make outbound network requests on its own.

5. What VadoVado does NOT do

• No accounts. No sign-in. No password to forget.
• No cloud syncing operated by us. If you put your .vado file in iCloud or another cloud folder, that's your choice and your sync provider.
• No analytics. No telemetry. No crash reports.
• No advertising. No ad networks. No tracking SDKs.
• No third-party data brokers. We don't sell or share your data — because we don't have it.

The one exception, called out for completeness:

Pre-release builds. Builds distributed for testing (Apple TestFlight; or any other beta channel we explicitly identify as a beta) may collect minimal anonymized telemetry to find and fix problems before public release. Testers are made aware of this when they accept a beta invitation. Pre-release telemetry never includes the contents of your .vado files. Production App Store builds do not include this telemetry.

6. Children

VadoVado is intended for users 13 years of age or older. The app does not knowingly collect any information from children under 13. (Since the app collects nothing from anyone, this is straightforward.) If you believe a child under 13 has used the app and that we should be aware of it, contact us at fabiani@stevefabiani.com.

7. Your choices

You're in control of everything VadoVado does because everything VadoVado does happens on your device:

• Move your data — copy or move the .vado file like any other file.
• Back up your data — copy the .vado file anywhere you keep backups.
• Delete your data — delete the .vado file. If it's the only copy, the trip is gone.
• Change security tier — VadoVado lets you switch from Basic to Advanced (or vice versa) inside the app at any time. We never see the keys involved.
• Affiliate links — you can simply not tap "Find a hotel" if you'd rather not visit Booking.com.

8. Future features

If VadoVado adds a feature that involves sending data anywhere beyond what's described above — for example, optional AI-assisted trip suggestions, optional sharing of a trip with another person, or optional cloud-backed synchronization — we will update this policy first, the feature will be off by default, and you will have the choice to opt in. We will never enable such features silently.

9. Changes to this policy

If we change this policy, we will update the Last updated date at the top and the policy will go live at https://vadovado.com/privacy/. Material changes will be called out in the app's release notes.

10. Contact

Questions about VadoVado's privacy practices: fabiani@stevefabiani.com.

Stephen Fabiani
Philadelphia, PA, USA