Privacy

Tuur exists to watch the price of trips you already booked. To do that it reads travel confirmation emails — and as little else as possible. This page says exactly what Tuur collects, what it never does, who processes data on Tuur’s behalf, and how to delete everything.

What Tuur collects

Your name and email address from your Google account when you sign in. The travel details extracted from confirmation emails: supplier, confirmation number, dates, prices, room or seat details, traveler names, and cancellation terms. A record that each email was processed (a code derived from the message, the sender’s domain, and a reference to the message in your mailbox) — but not the email itself. If you connect Gmail, access credentials for reading it, stored encrypted. If you subscribe, a reference to your Stripe customer record and the state of your subscription; your card details go to Stripe and never touch Tuur’s servers.

How Tuur reads your inbox

Tuur does not read your whole inbox. It searches your inbox for messages from travel companies and booking sites, and for booking phrases like “reservation confirmed” or “confirmation number,” going back twelve months. Only those matches are opened. Each one is checked to see whether it is a real booking; if it is not, it is set aside and its content is discarded. If it is, Tuur pulls out the booking details listed above and keeps those. The email itself — its subject, body, and attachments — is never stored, whether it turned out to be a booking or not. Mail that does not match those searches is never opened at all.

Gmail through Google’s permission screen

If you connect Gmail by tapping Allow on Google’s own permission screen, Tuur receives one permission: to read your email, and only read it (Google calls it gmail.readonly). Tuur uses it for the travel-confirmation searches described above and nothing else. It cannot send, change, label or delete anything. You can take the permission back at any time, from Settings in Tuur or from your Google Account’s security page, and Tuur can no longer read anything from that moment.

Gmail with a code

You connect Gmail with a one-time code, called an app password, that you create on your own Google Account page and can remove there at any time. With it, Tuur’s servers read your mailbox the way a mail app does, using the same travel-confirmation searches described above, and only in read-only mode: the connection is opened so that nothing can be marked, moved or deleted, reading a message does not mark it as read, and Tuur has no way to send email with the code because it contains no sending software. The code is stored encrypted with a key kept outside the database, is used only while reading, and is deleted when you disconnect. Google’s Limited Use rules do not formally cover this connection, so Tuur applies them anyway, word for word.

What Tuur never does

Tuur never stores your emails. It never sends email from your account: every inbox connection is read-only. It never sells or shares your data for advertising, shows no ads, and never uses anything from your inbox to target advertising anywhere. It never logs into your hotel, airline, or loyalty accounts. The one exception: for airlines whose confirmation email carries a single total, a person at Tuur may open the airline’s public receipt page with your confirmation number and last name to read the itemized receipt, so the fare is tracked accurately. Nothing about the booking can change from that page.

Google data

Tuur’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: Gmail data is used only to find and watch your trips, is never sold, never used for advertising, and is read by a person only with your permission, for support or security. Tuur does not use Gmail data, or any other data from Google, to develop, improve or train generalized AI or machine-learning models, and the AI service that reads confirmations for Tuur (Anthropic) is barred by its terms from training on it.

How Tuur protects your data

Everything sent between your device and Tuur, and between Tuur and the services below, is encrypted in transit; a visit over a plain connection is sent straight to the encrypted one. The keys that let Tuur read your mailbox (Google’s access tokens, or your app password) are encrypted with AES-256 before they are stored, using a key kept outside the database. The database is encrypted at rest by its host. Email content is read in memory while a confirmation is processed and is never written to storage. Only Tuur’s founder can reach Tuur’s internal tools, through a Google sign-in, and logs leave out email content. If Tuur ever learns that your data was exposed, you will be told by email without delay.

Who processes data on Tuur’s behalf

Tuur runs on a small set of services, each receiving only what its job needs: Google (reading travel confirmations you’ve authorized from your Gmail), Anthropic (email content you forward, and the content of a connected inbox, is processed by the Anthropic API to extract trip details, under terms that prohibit using it to train their models), Postmark (sends Tuur’s emails and receives emails you forward to your Tuur address; Postmark retains inbound messages for up to 45 days on its systems),Stripe (your subscription payment and card), LiteAPI and Nuitée, the company behind it (hotel prices for the rooms you booked; if you book a room through Tuur, Nuitée receives the guest’s name and email to make the booking and takes the payment itself), Vercel (hosting and cookieless page analytics), Neon (the database), and Inngest (background jobs; raw email content never persists there). If Tuur runs ads, the ad platform learns that a page was viewed, that “Start for free” was tapped, that an account was set up (an inbox connected or a first trip added), or that a subscription was bought or a room was booked through Tuur, never anything from your inbox. That platform is Meta; their pixels run only on the public pages and the purchase confirmation, and automatic matching of your details is off on both. Tuur’s server also tells Meta about the tap, the account being set up, and any purchase directly, with only what Meta needs to tell whether an ad led to it: the ad’s click code, Meta’s own browser cookie, and your IP address and browser type. Never your name, your email, or anything from your inbox.

Emails from Tuur

Tuur emails you about your trips and your plan. If you sign up and haven’t added a trip yet, Tuur also sends a few short emails about how it works, then about one a month. Each has an unsubscribe link, and they stop once you add a trip.

Retention and deletion

Trip details are kept while your account exists so your history and the money Tuur found stay accurate. You can disconnect your inbox at any time in Settings — Tuur gives back its access immediately and can no longer read anything. You can also delete your account in Settings: that permanently removes your trips, price history, notifications, and inbox access, revokes Tuur’s Google permissions, and cancels any subscription. Stripe keeps the payment records the law requires it to. Operational logs that contain no email content are kept briefly for reliability and safety.

Questions

Email support@tuur.ai and a human answers. If this page ever changes in a way that matters, you’ll be told plainly — no silent edits.