Privacy Policy
Domicile keeps a record of where you have been so you can see your day counts against residency rules. This policy says what that record contains, where it is kept, who processes it and how you control it.
Draft for legal review · version 2026-10-19 · not yet in force
Who we are
Domicile is operated by Ohmic Ventures LLP (LLPIN ACX-7347), No 15, MR Garden, VNH, RT Nagar Post, Bangalore 560032 ("we", "us"). We decide why and how your personal data is processed, so we are the controller under the GDPR and UK GDPR and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023.
Privacy questions and requests: support@domicile.live. Our Grievance Officer is named under Contact and complaints.
The short version
- Your travel record lives on your phone and is synced to your private Domicile account so it survives a new phone.
- Documents you scan are kept on your phone and, unless you turn backup off, copied to private storage in your account. This includes passport images.
- Domicile never reads your mailbox. Booking emails reach us only if you forward them, and are used only to find your flights, never for advertising or to train AI.
- Location is checked on your phone. Only the country and the time are kept; coordinates are never sent to us.
- We do not sell personal data, show ads, track you across apps or use third-party analytics. Usage statistics are off unless you turn them on, and are never linked to your account.
- You can export your data and delete your account from the app at any time.
What we collect
We collect only what the features you use need. Most of it you enter or confirm yourself.
| Data | Where it comes from | Where it is kept | Why |
|---|---|---|---|
| Account: email address, password (if you use one), the Google or Apple identity you sign in with, an account ID | You, Google or Apple | Our authentication service (Supabase) | To create and secure your account |
| Profile: your name and other names you travel under, home country | You, or confirmed from a scan | Your phone and your account | To match travel records to you |
| Travel record: trips, entry and exit dates, airports, flight numbers, booking references, passenger names, planned trips | You, scans, emails you forward and Calendar imports you confirm | Your phone and your account | To count days per country |
| Residency answers: yes/no facts you give (for example, whether you have a home in a country), per-year choices | You | Your phone and your account | To apply the residency rules |
| Documents: scanned boarding passes, passport and visa pages, PDFs, tickets, with their names and expiry dates | You | Your phone; a copy in private storage in your account unless backup is off | Evidence for your record and your adviser |
| Location: country and time of each check | Your phone, if you turn location checks on | Your phone and your account | To notice when you arrive in a new country |
| Forwarded emails: the email, the flights and bookings found in it (booking reference, passengers, flights, seats, ticket numbers, status), boarding passes attached to it, and its sender's domain, subject and date | Emails you forward to your Domicile address | Our database and private storage in your account; the email itself encrypted, for 30 days | To build your flight history and suggest trips |
| Planning assistant messages | You | Your phone; sent to OpenAI to answer, not stored by us | To answer your questions |
| Subscription status and store purchase records | Apple or Google, through RevenueCat | RevenueCat | To give subscribers access |
| Codes you redeem | You | Our database | To apply each code within its limits |
| Technical: IP address, request time and route, error codes | Your device, automatically | Cloudflare logs, up to [log retention, e.g. 7] days | Security, abuse limits and fixing errors |
| Usage statistics, only if you turn them on: screens opened and time on each, setup steps, features used, error codes, app version and platform | The app, under a random code for this phone | Our database; never linked to your account | To see where the app is hard to use and fix it |
| Diagnostic reports, only when you send one: app version, phone type, switches, counts and recent error codes | You, from Profile | Our database, linked to your account | To help you with a problem |
| Push token: an address for notifications to this phone | Your phone, when alerts are on | Our database, linked to your account | To send reminders and announcements |
| Planning assistant message count per month | Automatically | Our database | To apply the monthly limit |
| Support messages | You | Our support mailbox | To answer you |
We do not collect contacts, photos you have not chosen, health data, advertising identifiers, browsing history or precise location history.
This website sets no cookies, has no analytics and loads nothing from other companies. Its host, Cloudflare, records requests for security.
Forwarded emails
Domicile does not connect to your mailbox. Booking emails reach us only when you forward them, by hand or with a forwarding rule you set up, to a private address Domicile gives you. You can replace that address at any time, which stops the old one working. Mail is accepted only if it passes its sender's SPF or DKIM check, and is matched to you only by the address it was sent to.
- What is read: each forwarded email, every email attached to it ("Forward as attachment"), and boarding passes attached to them (Apple Wallet passes and their barcodes). Our server, run by Cloudflare, reads them to find flight bookings, changes, cancellations, refunds and boarding passes.
- What is kept: the bookings and flights found (booking reference, airline, passengers, flights, airports, dates and times, cabin, seat, ticket numbers and status), the boarding pass files, and for each email its sender's domain, subject, date and whether a flight was found. The flights also wait in Trips › Review for you to confirm before they count as trips.
- The email itself: stored encrypted with a key only our server holds, for 30 days, so it can be read again if our reader improves; then deleted. Boarding pass files are stored encrypted the same way until you delete them or your account.
- AI reading (off unless you turn it on): if you turn on "Let AI read emails Domicile can't", an email our own rules cannot read is sent through our server to our AI provider to extract the flight, at most 30 a day. We ask the provider not to store it; it may keep requests for up to 30 days to detect abuse and does not use them to train its models.
- PDF tickets: a ticket that is only in an attached PDF is kept encrypted until your Android phone collects it and reads it on the phone, then deleted (at most 30 days).
- Outlook (optional): if you connect Outlook, the app on your phone uses Microsoft's permission to add two rules to your Outlook inbox that redirect booking emails to your Domicile address, to send one test email to yourself, and, if you ask, to search your past travel emails and send them to your Domicile address. Microsoft's permission is stored only on your phone, never on our server. Disconnecting removes the rules.
- Gmail's forwarding code: when you add your Domicile address in Gmail, Google emails a confirmation code to it. We show you that code in the app and in a notification so you can finish setup.
- Never: sold, used for advertising, used to train AI models, or read by a person, unless you ask us to look at a specific email for support, it is needed for security, or the law requires it.
Calendars
On iPhone, you can also import from the calendars on the phone (including Outlook and iCloud calendars added to it). Events are read on your phone; only the flights found (flight number, airports, date and time) are kept in your account, marked as coming from your calendar.
Importing from Google Calendar is optional. When you choose it, Google asks you to allow Domicile read-only access to Google Calendar (calendar.readonly). Domicile reads the events in the period you pick (three months to ten years) to find flights, and keeps only the travel details found as suggestions for you to accept or dismiss. On Android, events are read on your phone and never pass through our servers; on iPhone, our server reads them for you and stores Google's permission encrypted so later imports work. Domicile does not request access to Gmail; any Gmail permission given to an earlier version is revoked by our server.
To stop access, disconnect Google Calendar in Domicile and remove Domicile at myaccount.google.com/permissions. Deleting your account revokes any Google permission held by our server. Our full Google data statement is on Google user data.
Documents and scans
Text on a scan is read on your phone (Google ML Kit, running on the device). From a passport, only the name you confirm is used; the machine-readable text is discarded. The image or file itself is kept on your phone and, unless you turn off document backup in Profile, a copy is uploaded to private storage that only your account can read, so it is not lost with your phone. Deleting a document in the app deletes both copies.
Location
Location checks are off until you turn them on. When on, the app checks your position when you open it, works out the country on your phone, and keeps only the country and the time. Coordinates are never stored or sent to us or to a map service. On Android, if the position is unavailable, the country of the mobile network may be used instead. A change of country is shown as a suggestion; it never becomes a trip without your confirmation. You can turn checks off in Profile or in your phone's settings at any time.
Planning assistant
If you use the planning assistant, your messages, your saved yes/no answers, your home country, the country you are in today and your day count in each tracked country are sent through our server to OpenAI to produce a reply. Your trip dates, documents, emails and exact location are never sent to the assistant. When you confirm a stay to check, the day count and result are worked out on your phone, not by OpenAI. We ask OpenAI not to store the conversation; OpenAI may keep requests for up to 30 days to detect abuse and does not use them to train its models. The app asks for your agreement before your first message.
Usage statistics and diagnostics
Usage statistics are off until you turn them on (on the Welcome screen, or in Profile, Account). When on, the app records which screens you open and for how long, the setup steps you complete, which features you use and error codes, under a random code created for this phone. They never include your account, name, trips, countries, documents, emails or anything you type. We use them only to improve Domicile. Turning them off stops them and deletes what this phone sent. They are deleted after 13 months.
A diagnostic report is sent only when you tap Send in Profile, after you have seen its full contents. It is linked to your account so we can reply, and deleted after 90 days.
Notifications
If you allow alerts, your phone gives the app a push token, which we store with your account so we can send reminders and occasional announcements about Domicile. Notifications are delivered through Expo and Apple's or Google's push services. Turn alerts off in Profile or your phone's settings, or sign out, and the token is removed.
Subscriptions
Subscriptions are bought from Apple or Google, who process your payment; we never see your card details. RevenueCat confirms purchases for us and receives your Domicile account ID, store purchase records and basic device and app information. See Subscriptions and refunds.
Who processes your data
These companies process data for us under contract and only on our instructions. We do not share personal data with anyone else except when you choose to (for example, sending an export to your adviser) or when the law requires it.
| Company | What they do | What they receive |
|---|---|---|
| Supabase | Database, sign-in and file storage, hosted in [region] | Account, synced record, documents you back up, codes |
| Cloudflare | Runs our server and receives forwarded emails | All requests to our server, IP addresses, logs, emails you forward |
| OpenAI | Planning assistant replies; reading booking emails, only if you turn AI reading on; reading a visa or certificate the phone could not read, only while the planning assistant is on | Assistant messages, saved answers, home country; the text of forwarded emails our own rules could not read; the text read from a document photo, with names, birth dates, the machine-readable lines and ID numbers removed on your phone first (never the photo) |
| RevenueCat | Subscription status | Account ID, purchase records, device and app information |
| Sign-in, Calendar access, Google Play billing, on-device text recognition | What you authorise when you use these features | |
| Apple | Sign in with Apple, App Store billing, push delivery to iPhone | What you authorise when you use these features; push tokens and notification text |
| Expo (650 Industries) | Delivers push notifications | Push tokens and notification text |
Legal bases
Under the GDPR and UK GDPR we rely on: performance of our contract with you for your account, record and subscription; your consent for forwarded-email reading, AI reading of emails, Calendar import, location checks, document backup, the planning assistant, usage statistics and notifications, which you can withdraw at any time; and our legitimate interests in keeping the service secure and preventing abuse. Under India's DPDP Act we process your data on the basis of your consent, given in the app for each of these purposes, and for legitimate uses permitted by the Act.
International transfers
Our providers may process data outside your country, including in the United States. Where the law requires it we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (with the UK addendum) in our contracts with them. [Counsel to confirm transfer mechanisms per launch market.]
How long we keep it
| Data | Kept until | ||
|---|---|---|---|
| Account, synced record, backed-up documents | You delete them or your account. Account deletion is immediate. | ||
| Data on your phone | You delete it, delete your account or remove the app | ||
| Email text and passport machine-readable text | Not kept; discarded once read | ||
| Google permission held by our server | You disconnect or delete your account | ||
| Forwarded emails: the email, the flights and bookings found in it (booking reference, passengers, flights, seats, ticket numbers, status), boarding passes attached to it, and its sender's domain, subject and date | Emails you forward to your Domicile address | Our database and private storage in your account; the email itself encrypted, for 30 days | To build your flight history and suggest trips |
| Forwarded emails (encrypted) | 30 days after they arrive | ||
| PDF tickets waiting for your phone (encrypted) | Until your phone reads them, at most 30 days | ||
| Bookings, flights and boarding passes found in forwarded emails | Until you delete them or your account | ||
| Planning assistant messages | Not stored by us; up to 30 days at OpenAI | ||
| Document text sent for AI reading | Not stored by us; up to 30 days at OpenAI. The fields it reads are kept in your Travel documents | ||
| Usage statistics | 13 months, or until you turn them off | ||
| Diagnostic reports | 90 days | ||
| Push token | You turn alerts off, sign out or delete your account | ||
| Server logs | Up to [log retention, e.g. 7] days | ||
| Database backups | Overwritten within [backup retention, e.g. 7] days | ||
| Subscription records at Apple, Google | Under their own policies. We delete the RevenueCat record with your account. | ||
| Support emails | [e.g. 24 months] after the matter is closed |
Exports you have saved or shared are copies outside Domicile; deleting your account does not reach them.
Your rights
Depending on where you live you may have the right to access, correct, export or delete your data, to withdraw consent, to object to or restrict processing, and, in India, to nominate someone to exercise your rights if you die or become unable to. Most of these you can do yourself:
- Export: Profile, then Export all my data.
- Correct: edit or delete any trip, answer or document in the app.
- Delete: Profile, then Delete data, then Delete account, or follow Delete your account if you no longer have the app.
- Withdraw consent: turn off location checks, document backup, usage statistics or alerts, disconnect Google Calendar, turn off AI reading of emails, stop forwarding (or replace your address), or stop using the assistant.
For anything else, email support@domicile.live. We confirm receipt within 72 hours and reply within 30 days; we may ask you to confirm the request from the email on your account. You may complain to your data protection authority, such as the Data Protection Board of India, your EU supervisory authority or the UK Information Commissioner's Office.
Security
All connections use HTTPS. Data in our database and storage is encrypted at rest by our providers, and each account can reach only its own rows and files. Google permissions, forwarded emails and boarding pass files on our server are encrypted with keys held only by our server. Your sign-in token is kept in your phone's secure storage. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires. Domicile does not offer end-to-end encryption.
Age limit
Domicile is for people aged 18 or over. We do not knowingly collect data from children; if you believe a child has an account, contact us and we will delete it.
Changes
We will show a new version in the app and ask you to accept it before material changes apply. Earlier versions are available on request.
Contact and complaints
Privacy requests: support@domicile.live. Grievance Officer (India): Nikhil Varghese, support@domicile.live, Ohmic Ventures LLP, No 15, MR Garden, VNH, RT Nagar Post, Bangalore 560032. EU and UK representative, if required: [counsel to confirm]. Postal address: Ohmic Ventures LLP, No 15, MR Garden, VNH, RT Nagar Post, Bangalore 560032.