Privacy

Yondo (formerly Ajar) · effective 19 October 2026

You do not need an account to use Yondo. Planning a day, downloading cities and check-ins all work without one, and Yondo never asks your date of birth or a password. An account is optional, and exists only for the things that have to belong to a person, such as reviews and badges. Most of what the app knows never leaves your phone.

This page explains the exceptions — the things that do reach a server — and what happens to them. It is written to be read, not to be defended.

What stays on your phone

Downloaded cities, the days you plan, the places you save, and how long you actually spend at things so the planner can learn your pace. If you let Yondo use your location to suggest where you are staying, that reading is used on the device and is not sent anywhere.

What reaches the server

1. An anonymous id. When the app first runs it generates a random 16-byte identifier. It is not derived from your phone, your account or anything about you, and it is the only thing tying your contributions together. You can replace it with a new one at any time, which severs the link, or delete everything it has sent.

2. Corrections you choose to send. If you report that a place was shut, or that its hours are wrong, the app sends the city, the place, what was wrong and the date — with your anonymous id, so one person cannot outvote everybody else. Reports are fixed options, not free text. These are kept, because they are the shared knowledge the app runs on, and they say nothing about you.

3. A count of days used. Once per day, if the app is opened: your anonymous id, the date, and whether you planned a day. That is the entire record. It deliberately does not include the city, because a daily list of which city you are in is a travel diary, and Yondo does not want to hold one. It is never linked to an account, if you have one. You can turn this off in the app, and turning it off means you are not counted.

4. A place you tell us about. If Yondo has missed somewhere and you add it, the name you type is sent, with the city and roughly where you were. This is the only free text Yondo holds, and it is treated as a search term rather than as something you have written: it is looked up in OpenStreetMap and Wikipedia, and if a place of that name really is there, what other travellers see is the name those sources give back — never your words. If nothing matches, it is marked as such and shared with nobody.

So nobody can put text on a stranger's phone by typing it here. If you ask to be deleted, anything still unchecked goes, and for anything already confirmed the words you typed and the link to you are erased — what is left is a fact about a city rather than anything about you.

5. Check-ins, if you arm one. This is the only personal information Yondo holds, and only while a check-in exists:

One coordinate, chosen by you. Yondo does not follow you, has no live tracking and cannot see where you go. This is held on the server rather than the phone for the obvious reason: the phone is the thing that might be dead, stolen or out of signal, and a deadline that only exists on the handset cannot fire in the situation it exists for.

Check-ins are deleted after 30 days, automatically, whether used or not. A trip's details stop being useful the moment the trip ends, so keeping them would be risk with nothing to show for it.

6. Anything you write as feedback. If you send feedback from inside the app, what you write is sent, along with the version you are running and the city you had open — so a problem can be found without a conversation about which build it was. This goes to the person who makes Yondo and to nobody else: it is never shown to other travellers and never published. It is deleted, in full, if you ask to be deleted.

7. Your subscription, if you buy one. Yondo in full is sold through the App Store, so Apple takes the payment and holds your billing details; Yondo never sees them. To know whether a subscription is active, the app uses RevenueCat, a subscription service. RevenueCat receives the purchase record from Apple — what was bought, when, the price and currency, and when it renews or lapses — under a random id of its own, separate from the anonymous id above. It uses that record to confirm the subscription and to give Yondo totals such as how many people subscribe. It is not linked to your name, email or anything else about you, and it is not used for advertising. Deleting your data in the app does not reach RevenueCat or Apple; email the address below and the RevenueCat record will be deleted. Cancelling is done in your Apple ID settings.

8. An account, if you make one. You sign in with Apple or with Google; Yondo never sees or stores a password. What is held:

Badges. While you are signed in, your account also keeps a list of the cities you open, the places you mark as seen and the problems you report (which place, what kind, and the date), so it can award badges. When you first sign in, the same from before you had an account is added, so it counts too. Your best badge is shown next to your reviews; the list itself is shown to nobody.

Your account is not linked to the anonymous id above, to the daily count or to your subscription. Your email address is not shown to anyone and is not used to send you marketing.

9. Ratings and reviews, if you write them. A rating (one to five stars) and anything you write with it are public: anyone using Yondo can read them, shown with your display name and the date. One review per place, which you can edit or delete at any time. Ratings are also averaged into how the planner ranks places. If somebody reports a review, the report (who made it and why) is kept with it so it can be checked; if you block someone, that is recorded so their reviews stay hidden from you. Reviews follow the community rules, and ones that break them are removed.

Deleting your account is one action in the app, under your account in the library. It removes the account, your name, your email address, every sign-in, every review, report and block you made, and your badges, at once, with no copy kept.

Advertising

Yondo in full has no ads, and on a phone with it none of what follows happens: no consent form, no tracking question, no ad service started.

The free version shows an occasional full-screen ad after you download a city — never after your first, and never more than once every few minutes. These come from Google AdMob. To show them, Google receives your IP address, the kind of phone and its settings, and how you respond to the ad, under Google's privacy policy. In the UK and EU, Google's consent form asks you first, and no ad is requested unless it allows one. Apple then asks whether Yondo may track you across other companies' apps; if you say yes, Google may use your phone's advertising identifier to show ads that suit you. If you say no, ads still appear but are not personalised, and nothing identifies your phone to advertisers. You can change either answer at any time in your iPhone's settings. Yondo itself never sees any of this, and the ads are never linked to your account, your plans or where you are.

Somewhere to stay. The "Find somewhere to stay" buttons open Booking.com, already searching your city and dates. Where marked "Sponsored", Booking.com pays Yondo a commission if you book; it learns that you came from Yondo, and Yondo learns only totals of bookings, never who made them. What you do on Booking.com is covered by its own privacy policy.

Someone else's phone number

If you nominate a contact, you are handing over another person's number, and they have not agreed to anything. So: they get one message when you first name them, saying what they have been set as and how to opt out, and one message if you miss a check-in. Nothing else is ever sent to them, and their number is deleted with the check-in.

Please tell them before you nominate them. It is their number.

What Yondo never does

Other services the app talks to

To build a city, your phone requests data directly from OpenStreetMap (Overpass), Wikipedia, a geocoder (Photon) and a weather service (Open-Meteo). Those requests go from your device to them, so they see your IP address and what you asked for, under their own privacy policies. Yondo does not proxy them and does not log them.

Subscriptions go through Apple and RevenueCat, as described in point 7.

If you sign in, Apple or Google confirms who you are, so they know you signed in to Yondo, under their own privacy policies. Yondo receives only what is listed in point 8.

Yondo's own server runs on Fly.io in London. Missed check-in alerts are delivered through a notification service, which necessarily sees the alert — the contact's number and the last known position — in order to deliver it.

Your rights

Under UK and EU data protection law you can ask for a copy of what is held, ask for it to be corrected, ask for it to be deleted, or object to it being held at all.

Deletion does not require asking. In the app it is one action, and it removes everything associated with your id — corrections, counts and any check-in — across every table. Deleting an account is a separate action that removes the account, as described in point 8. There is no soft delete and no copy kept.

Without an account, nobody can be identified from what is stored, so there is a limit to what a request for “your data” can return: an anonymous id is only meaningful on the device that generated it. With an account, you can see your name and how you sign in from inside the app, and email the address below for anything else.

Cookies

The app uses no cookies. These web pages set no cookies, use no analytics and load nothing from other sites, so there is nothing to consent to. Inside the app, ads on the free version only run after Google's consent form (in the UK and EU) and Apple's tracking question, as described above.

Children

Yondo is not directed at children under 13 and does not knowingly hold their information.

If this changes

The date at the top changes with it. Anything that would mean collecting more than is described here will be asked for in the app first, not quietly added.