Privacy policy
Last updated September 18, 2026 · Applies to all LNR Games apps
On this page
1. Who this covers
LNR Games (« we »)
is the data controller for the personal data described here. This policy applies to
our mobile applications — today Travel Bag
(com.lnr.travelbag) — and to this website.
Contact: lnr.devstudio@gmail.com
2. What we collect
Account data
When you create an account we store your e-mail address, a display name and, if you set one, a profile picture. You can sign in with Google, with Apple or with an e-mail address and a password — in every case, authentication is handled by Firebase Authentication and we never see your password. If you sign in with Apple and choose to hide your e-mail address, we only ever receive Apple's relay address.
What you put in the app
The content you create: trips, their dates and destinations, the steps of an itinerary and the places they point to, expenses and who paid them, notes, the photos you upload, and the documents you attach (tickets, bookings, PDFs). This content is stored so the app can show it back to you and to the people you share a trip with.
Technical data
- Usage measurement — Firebase Analytics records which screens are opened and which features are used, along with a device identifier, the device model, the operating system version, the app version and an approximate country derived from the IP address. It tells us which parts of the app are actually used; it is not used to profile you individually.
- Crash reports — when the app crashes, Firebase Crashlytics sends the technical state at that moment (stack trace, device model, OS version) so the bug can be fixed.
- Anti-abuse — Firebase App Check verifies that requests come from a genuine copy of the app and not from a script.
Purchases
Gold Bag is sold through Google Play or the App Store. We never see your payment details: the store handles the payment and sends us a receipt, which is validated on our server so the purchase can be linked to your account. What we keep is the fact that the purchase is valid, not how you paid for it.
What we do not collect
- No advertising, no advertising identifiers, no data sold or shared with brokers.
- No background location tracking. The map shows the places you added yourself, and if you use the app's search to turn an address into coordinates, that lookup is performed by your device's own operating system.
- No push notifications. The reminders you set are scheduled locally on your device and never leave it.
3. Why we collect it, and on what legal basis
| What | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Account data | Create your account, sign you in, show your name to your travel companions | Performance of the contract |
| Your trips, photos and documents | Provide the service — storing and displaying them is what the app does | Performance of the contract |
| Purchase receipts | Unlock Gold Bag, handle disputes and refunds, meet accounting obligations | Contract, then legal obligation |
| Crash reports | Find and fix the bugs that break the app | Legitimate interest in a working app |
| Usage measurement | Understand which features are used, so effort goes where it matters | Legitimate interest — objectable at any time (see §9) |
4. What other people can see
A trip is private by default: only you can see it. It becomes visible to others only through a choice you make.
- Participants you invite see the whole trip and can add steps, photos and expenses to it. They see your display name and profile picture.
- Viewers you invite see the trip and its photos, and can change nothing.
- Private steps stay hidden from viewers.
- Public trips — if you publish a trip, its itinerary becomes visible to every user of the app, along with your display name and profile picture. Your photos only follow if you say so, and expenses never do. You can make a trip private again at any time.
5. AI assistants
Travel Bag can be connected to an AI assistant such as Claude or ChatGPT, so that you can ask it to fill in a trip. This connection does not exist until you set it up yourself and authorise it by signing in.
While it is connected, the assistant can read and write the trips of your account on your instructions. The data it reads passes through the assistant's own provider, which processes it under its privacy policy, not ours — read that policy before connecting. You can revoke the authorisation at any time, and the assistant loses its access immediately.
6. Who else processes your data
| Service | What for | What reaches it |
|---|---|---|
| Google — Firebase (Authentication, Firestore, Storage, Cloud Functions, Analytics, Crashlytics, App Check, Remote Config) | Hosting, storage, sign-in, measurement | Account data, your trip content, technical data |
| Google Play · Apple App Store | In-app purchase and receipt validation | A purchase receipt. The payment itself never reaches us. |
| Apple · Google (sign-in) | Signing you in, if you use those buttons | Your e-mail address and name, as they choose to pass them to us |
| OpenStreetMap | Map tiles | The coordinates of the area displayed, and your IP address |
| Wikivoyage (Wikimedia) | Destination content in the Discover tab | The name of the destination you searched, and your IP address |
| Your AI assistant's provider, if you connect one | Reading and writing trips on your instructions | The trips the assistant reads or writes |
7. Where your data is stored
Our Firebase services run in Google's European region. Some of the providers listed above are established in the United States, so a transfer outside the European Union may occur; those transfers are covered by the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.
8. How long we keep it
- Your account and its content — for as long as the account exists. Deleting your account deletes them.
- Purchase receipts — up to ten years, because accounting rules require it.
- Crash reports — 90 days, then Crashlytics deletes them.
- Usage measurement — 14 months.
9. Your rights
Under the GDPR you have the right to access your data, correct it, delete it, take it with you, object to processing based on legitimate interest, and ask that processing be restricted.
- Delete everything — Settings › delete my account, inside the app. Your account, your trips, your photos and your documents go with it. It cannot be undone.
- Correct your data — your name and profile picture are editable in the app at any time.
- Anything else — write to lnr.devstudio@gmail.com; we answer within one month.
- Complain — if you think we handled your data badly, you can lodge a complaint with your national data protection authority. In France, that is the CNIL.
10. Security
Access to your data is enforced on the server, not only in the app: the rules that guard the database and the file storage let each request read exactly what its author is entitled to. Traffic is encrypted in transit, and the stores' authentication systems keep your password out of our hands entirely. No system is perfect, but a breach that affects you will be reported to you and to the supervisory authority as the law requires.
11. Children
Our apps are not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.
12. Changes to this policy
We may update this policy. The date at the top always says when it last changed, and a change that materially affects you will be announced in the app before it takes effect.
13. Contact
Questions about this policy, or about your data: lnr.devstudio@gmail.com.