App Privacy Policy

Quobo Labs, LLC (“Quobo”, “we”) makes the app and the software your travel agency runs its trips on.

Your travel agency decides what is collected about your trip and why. For your traveler record — your details, bookings, payments, documents and messages — your agency is the one responsible (the “controller”). Quobo stores and handles that information for the agency, on its instructions, as its service provider (its “processor”), under the agreement every agency accepts when it joins Quobo. Your agency has its own privacy policy on its website, at /privacy.

The app itself works the same way. Your sign-in, your phone’s notification token and the app’s own account data exist so that you can reach your agency’s trips, and Quobo handles them for the agencies you travel with. One sign-in can open your trips at more than one agency, so we look after the sign-in itself: you can delete it in the app, or ask us at hello@quobo.co.

So: for anything about a booking, ask your agency first. For anything about the app, ask us. We pass on to your agency any request that is theirs to answer.

What you or your agency enter

• Who you are and how to reach you — your name (and the name you go by), email address, phone number and mailing address.
• Travel details — date of birth, citizenship, state or country of residence, passport expiry date, a passport number if your agency records one (stored encrypted), and cruise-line loyalty numbers. The same details for the other travelers on your booking.
• Trip preferences and needs — cabin, bedding and dining preferences, who you are traveling or dining with, arrival details (flight, airport, hotel, arrival time), and a free-text “special needs” note. People use that note for dietary, mobility and medical needs, so it can contain health information. Share only what your agency needs to look after you.
• Documents — files you upload to your booking (for example an insurance certificate or a photo of a document) and files your agency keeps for your booking, which can include passport copies, payment authorization forms and insurance papers. A photo can carry hidden details from your camera, such as the time and place it was taken. Photos in the usual formats (JPEG, PNG, WebP and GIF) are stored without them; we keep only which way up the photo goes. Other files, such as PDFs, are stored exactly as they were uploaded, and so are files uploaded before September 24, 2026.
• Messages — what you and your agency write to each other in the app, by email and, if used, by text message, with any attachments.
• Bookings and payments — your trips, cabin, prices, add-ons, insurance details (such as policy number, travelers’ ages and trip cost), what you have paid and what is due, how you paid, and for a card the brand and last four digits. If you ask for a refund by Zelle or Venmo, the payout details you give. Your agency can also keep its own notes on your record.
• Roommate matching — only if your agency offers it and you join: a first name to show, age range, gender, who you would share with, cabin preferences, daily and sleep habits, a short note about yourself and a contact phone number. A proposed roommate sees that profile without your surname or contact details. Your name, email address and phone number are shared with them only after you have both said yes.
• Trip feedback — your answers, if your agency asks for feedback after a trip and you reply.
• Your choices — whether you receive your agency’s marketing emails, and, if you opted in to text messages, when and how you agreed, the wording you agreed to and the IP address you agreed from.

What is collected automatically

• Sign-in — an account ID tied to your email address, one-time sign-in codes, and cookies that keep you signed in to each agency’s pages.
• A notification token — only if you turn notifications on. Apple gives the app a token for your phone. We store it with the agency you turned notifications on for, together with your email address, your choices (payment reminders, messages) and when the phone was last seen. Version 1.0 of the app does not send notifications and does not offer to turn them on; the option appears in My Profile once we switch sending on. Turning notifications off stops the token being used; the token itself stays stored until you delete your sign-in.
• Email opens and clicks — emails your agency sends through Quobo record when they are opened and which links are clicked, with the IP address and the browser or device type at that moment. These are recorded by us, not by an outside tracking company, and your agency sees them on your record.
• Logs and abuse protection — like any website, our hosting logs record your IP address, browser type and the address requested. We also count sign-in and form attempts by IP address or email address to block abuse.
• Error reports — if something breaks, a technical report can be sent with personal details removed (see Sentry below).
• Phone calls — only if your agency uses the AI phone assistant and you call that line: your phone number, a recording and a transcript of the call.
• Cookies and how you arrived — the sign-in cookies above. On an agency’s public pages, a cookie can also remember for up to 30 days which partner link or campaign page brought you there, and your record can note the link or campaign you first came from. There are no advertising cookies.

What stays only on your phone

The app keeps a few things in its own storage on your phone: the email address you last signed in with, the agency you last opened (its name, logo and web address), whether you have been asked about notifications, the notification token, and — so your trip works with no signal — a summary of your trip (itinerary, dates, cabin, confirmation numbers, travelers’ names and your agency’s contact details) and any documents you chose with “Save documents for offline”. These offline copies are made on your phone from what your agency already holds; saving them sends us nothing new. “Remove from this phone” deletes the saved documents. Deleting the app from your phone removes everything it stored.

• To sign you in and show you your trips, documents, balance and messages.
• To let your agency arrange and manage your booking, take payments and send you notices about it.
• To send reminders and, if you turn them on, notifications.
• To keep the service secure, find faults and stop abuse.
• Your agency may also use your contact details to send you its own news and offers, if you agreed to that. Every marketing email has an unsubscribe link, and you can reply STOP to any text message.

• No advertising, and no advertising or analytics software from other companies in the app.
• We do not sell your information or share it with data brokers.
• We do not track you across other companies’ apps or websites.
• The app never reads your location or your contacts. It opens your camera, microphone or photo library only when you choose to take or pick a picture, video or file to send to your agency.

When you pay toward a trip by card or bank account, you are paying your travel agency. The payment page is run by Stripe, on your agency’s own Stripe account. Your card or bank details go to Stripe and never to us. Quobo does not sell anything to travelers. If your agency also accepts other ways to pay, such as Zelle, Venmo or a check, the app shows your agency’s instructions and lets you tell the agency you have paid; that payment happens outside the app.

We use the companies below to run the app. For each one we say what it does and what it receives. We do not give your information to anyone for their advertising.

For everyone

• Supabase — Database, sign-in and file storage. Everything the app and your agency store about you: your sign-in, your traveler and booking records, messages and uploaded documents. Stored in the United States (Oregon).
• Vercel — Hosting. Every page and request passes through Vercel's servers, so it handles the same information in transit, and its logs record your IP address, browser type and the address requested. Our servers run in the United States (Oregon).
• Resend — Sending and receiving email. Your email address and the content of the emails sent to you — sign-in codes, booking and payment notices, messages from your agency — and any reply you send to one of those emails.
• Stripe — Card and bank payments, on your agency's own Stripe account. When you pay: your name, email address and phone number, the booking the payment is for and the amount, from us; and the card or bank details you type on Stripe's own payment page, from you. We never see or store your full card number — only the card brand and last four digits that Stripe reports back.

Only while the feature is switched on

• Sentry — Error reports. Only while error reporting is switched on. A technical report when something breaks. Before a report is sent it is stripped of cookies, request contents, IP addresses, email addresses, passport and birth-date fields and database values; your browser type is kept. A report from your browser goes straight to Sentry, so Sentry's servers see the connection it arrives on, as any web server does.
• Upstash — Counting sign-in and form attempts, to block abuse. Only while we use it for rate limiting. Your IP address, or the email address you typed, as the label on a short-lived counter. While it is switched off, the same counters are kept in our own database in scrambled (hashed) form.
• Apple — Delivering push notifications (Apple Push Notification service). Only if you turn notifications on, and only once we switch notification sending on (it is off in version 1.0). Your phone's notification token and the notification itself: your agency's name and a short line such as a payment reminder naming your trip. A notification about a message never contains the message.

Only if your agency uses the feature

• Anthropic — AI assistance for your agency's staff (Claude). Only when your agency's staff use the AI features. What a staff member asks the AI to work with: for a suggested reply, your name, email address, a summary of your booking (trip, cabin, status, balance, the names of the travelers on it) and your message; for the back-office assistant, the records it looks up or updates — names, contact details, dates of birth, bookings, payments and message summaries; for reading a document or screenshot, the file's text or image, which can include special-needs notes; for the staff's daily briefing, names, amounts and dates; and for feedback summaries, the comments travelers wrote, without names.
• Twilio — Text messages (SMS). Only if your agency uses text messaging and you have opted in to texts. Your mobile number and the text of each message sent to you or received from you.
• Vapi — An AI phone assistant that can answer your agency's phone line. Only if your agency has switched on the phone assistant and you call that line. Your phone number, the audio of the call, its recording and transcript. During the call the assistant can look up your record by name, email or phone and read back booking details — travelers, cabin, payments and balance — and can take down booking details you give it. As we set it up, Vapi passes the call to Deepgram (speech to text), ElevenLabs (the voice) and Anthropic (the language model).
• Cal.com — Scheduling a call with your agency. Only if your agency offers call scheduling and you book a call. What you type on Cal.com's own booking page (such as your name and email address) and the time you chose. Cal.com then tells your agency about the appointment, and your agency's records keep it.
• Travelex — Travel insurance quotes. Only if your agency offers Travelex insurance. For a quote: each traveler's age, your state of residence, the trip dates and the trip cost — no names, email addresses or dates of birth. If you buy a policy, your agency gives Travelex the traveler details the policy requires.
• Skyvern — Automated entry of a booking on a cruise line's or supplier's website. Only if your agency's staff use automated booking entry. The passenger details that the website asks for: names, dates of birth, citizenship, state of residence, email address, phone number, mailing address and loyalty number.

Agencies can also use AI to write marketing copy and make marketing images (Anthropic, and Google’s Gemini for images). Those tools are given the agency’s trip details and marketing material, not traveler records.

Others your agency shares with

To make your booking, your agency gives the cruise line, other travel suppliers and, if you buy cover, the insurer the traveler details they require. If roommate matching introduces you to another traveler, they receive your name, email address and phone number once you have both agreed. An agency may publish photos or videos from a past trip on its own pages; ask your agency if you want one taken down. We or your agency may also disclose information when the law requires it.

The database, files and servers are in the United States (Oregon). If you use the app from another country, your information is transferred to, stored and handled in the United States, and some of the companies above may handle it in other countries; privacy laws there may differ from the laws where you live.

• Your traveler record — details, bookings, payments, documents, messages, and the email open and click records — is kept for as long as your agency keeps your booking records. We do not delete it on a timer.
• When an agency closes its Quobo account, all of its records and files are permanently deleted after a 30-day waiting period, along with the sign-ins of travelers no other agency knows.
• Your sign-in and notification tokens are kept until you delete your sign-in or the agency is deleted.
• One-time codes expire soon after they are sent. Attempt counters are cleared once their time window (an hour at most) has passed and the next clean-up runs.

In the app: My Profile → Delete my account. The same page is on your agency’s website. This deletes your sign-in for every agency you use it with: the account, its links to your traveler records, the phones registered for notifications and any unused one-time codes. In the app it also removes the trip and documents saved on your phone for that agency, the remembered agency and the notification token. The email address you last typed stays in the app’s sign-in box, and a trip you saved from a different agency stays on the phone until you remove it; deleting the app from your phone clears everything. Each agency gets a note in its records that you deleted your sign-in.

It does not erase your booking records. Your bookings, payments, documents and messages stay with each travel agency, because the agency has legal and contractual reasons to keep them — tax and accounting records, the contract for your trip, and the passenger lists it gives the cruise line. Deleting your sign-in does not cancel a trip or refund a payment.

To have the rest erased, ask your agency. Its contact details are on its website and on the Delete my account page. An agency can delete a traveler record that has no bookings, and can remove the passport number, date of birth, loyalty number and street address from a record it has to keep. If you cannot reach your agency, write to hello@quobo.co and we will pass your request on to it.

Depending on where you live, you may have the right to see the information held about you, to have it corrected or erased, to receive a copy, and to object to or limit some uses. Because your agency is responsible for your traveler record, send those requests to your agency; you can also send them to hello@quobo.co and we will pass them on to the agency. You can also complain to the privacy regulator where you live.

Things you can do yourself:

• See and correct your details and your travelers’ details in My Profile and on your booking. To change your email address, ask your agency.
• Once notifications are offered, turn them on or off in My Profile or in your phone’s Settings.
• Unsubscribe from marketing emails with the link in any of them; reply STOP to stop text messages.
• Remove saved documents from your phone, or delete your sign-in, as described above.

The app is not directed at children under 13. A child travels as a guest on an adult’s booking, and the adult or the agency enters the child’s travel details. If you believe a child under 13 is using the app on their own, write to hello@quobo.co or tell the agency.

Each agency’s records are kept apart from every other agency’s by the database itself, passport numbers are encrypted with a key that belongs to that agency alone, and uploaded documents are private and open only through links that expire after a few minutes. No system is perfectly secure, and we cannot promise that yours will never be breached.

When the app or the companies we use change, we update this page and its effective date. The current version is always at this address.

Quobo Labs, LLC — hello@quobo.co. For anything about a booking, contact your travel agency first. For help using the app, see Support.