Why your trip stays on your phone
Travel asks you to carry your whole self in one place. We built Ruta so that none of it ends up on a server it should not.
Your trip is a lot of you in one place: your passport number and the day it expires, the nights your home will sit empty, the hotel where you will be asleep, the person in the seat next to you. Booking a trip means handing pieces of that to airlines, agencies, apps, and the layer of data brokers behind them. Most of the tools meant to help you travel are, underneath, also in the business of knowing you. We built Ruta to sit on the other side of that line.
We made one decision early and built everything else around it: your information stays on your device. You do not create an account to use Ruta, and we do not build a profile of you. There is no version of you sitting on our servers waiting to be sold or leaked, because we chose never to create one.
Your device is the safe, not our servers
The things that make travel personal live only on your phone: your trips, your preferences, the history of where you have been. Your travel documents, the passport, visa, Known Traveler and Global Entry numbers you would never want loose, are encrypted in your device's secure Keychain, the same protected store your phone uses for its own most sensitive data, and they are never transmitted to us. We cannot read them, and we could not hand them over if we were asked, because they were never ours to hold.
That is a deliberate constraint, not an oversight. It would be easier, in the short run, to sync everything to a server and call it a feature. It would also mean building the exact thing we did not want to build: a central store of travelers' documents and movements, valuable to us and to anyone who ever breached it. We would rather your information stay where you can see it, on the device in your pocket, under your thumb.
When something has to leave, we send the least we can
We want to be honest rather than absolute, because the absolute claims about privacy are usually the ones that turn out to be untrue. Some features cannot work without reaching the outside world. Live flight status, maps and directions, weather, currency rates, translation, and the AI briefings all need to ask a question of a service beyond your phone.
In those moments we send the minimum needed to answer that one request, we use it only to answer it, and we do not keep it afterward. When you look for places nearby, your approximate location goes out to fetch the results and is gone once they come back. When an AI feature reads an itinerary or answers a question, the content it needs goes to the provider to generate the response, and identical requests are collapsed using a one-way hash that cannot be turned back into you. If you forward a booking email to Ruta, the pairing between that email and your device is anonymous, and we use the contents only to build your trip.
The rule underneath all of it is the same: data leaves your device to do a job, and then it is done.
Nothing on our servers is you
What does reach us is deliberately impersonal. There is a random identifier with no name, email, or location attached, used only to count how many people use a feature without knowing who they are. There are short-lived caches of results like flight status and translations, kept briefly and keyed by content rather than by person, so two travelers on the same flight do not each pay to ask the same question. When you forward a booking email, the extracted itinerary waits in an anonymous queue just long enough for your device to pick it up. And the crash diagnostics we collect are set up to leave personal information out, so we can find what breaks and fix it.
We do not keep your trips or your documents on our servers. We do not sell your personal information, and we do not run ads, so nothing in the product quietly pushes us to learn more about you than a feature needs. Payments run through Apple, so we never see your card number or billing details, and your subscription is confirmed through an anonymous identifier rather than your name.
There is a side effect to all of this that we happen to like. Because we never assembled a profile of you, there is nothing for us to sell and nothing in your name for anyone to steal from us. Delete the app and the locally stored data goes with it, Keychain included. Your information was yours the whole time.
Privacy is part of the calm
We did not treat privacy as a compliance chore or a page no one reads. We treated it as part of what the app is for. Ruta exists so a trip can feel like a trip again, so you can look up from the logistics and be where you are. That is hard to do while some part of you suspects it is all being catalogued somewhere. Knowing that your documents never left your phone, and that no one is assembling a picture of your movements, takes that worry off the table. That is the point.
There is a version of a travel app that learns everything it can about you and calls that surveillance convenience. We understand why it is so common. We think the better trip, and the more honest product, comes from the opposite promise: your trip is nobody's business but yours, and we built Ruta so we could mean it.