Effective from September 1, 2026. Last updated: October 13, 2026.
Cordel is a travel planner that works on your device. This page explains plainly what stays there, what leaves, where it goes and why.
Cordel is made and operated by Matheus Alexandre Dantas, an individual based in Brazil. Under Brazil’s General Data Protection Law (LGPD, Law 13,709/2018), this person is the controller of your data.
For anything covered on this page, including exercising your rights, contact contact@usecordel.com.
These features run on your iPhone. Content you choose to send and online services are explained separately below:
The app creates an anonymous session when connected and may sync data associated with that identifier. Providing credentials lets you recover access on another device and share trips. We store the following on a server:
This is stored in Appwrite Cloud, our database and authentication provider, on servers in the United States.
Appwrite also keeps security and authentication records associated with your account, such as access events, network addresses and approximate locations derived from them. Retention of these records and backups depends on the service and its configuration; we do not promise immediate removal of backup copies. See Appwrite’s information on audit logs and backups.
In the updated version, before sending content to online AI for the first time, the app explains the data and providers involved and asks for your permission. Your choice applies to your account on this device. You can decline or stop future sharing in Account & settings → Privacy & data. Without permission, you can still edit your itinerary manually and use on-device AI on compatible devices. This does not turn off Appwrite sync or delete content already sent. Earlier beta versions sent online requests when you used the assistant.
When you use online AI, your question goes through our service at api.usecordel.com, hosted on Cloudflare, and then to OpenAI, which generates the reply.
What is sent at that point:
To check whether a visit fits your schedule, the assistant may search the web using the place name, destination, date, time and expected duration. That specific search does not include your notes, booking codes, documents or photos. Sources appear with the suggested change. The city’s weather forecast may also be included in the context sent to the assistant, with the time it was retrieved.
The conversation and your decisions are saved on this device so you can pick up where you left off. This history is not synced with travel companions. When you chat, recent excerpts and earlier decisions may be sent to the assistant to continue the response. The three most recent images may remain in local history; an image is only sent again if you resend it. You can delete the conversation in “Chat with Cordel”. Information and constraints stored separately can be corrected or forgotten in “Cordel memory”.
What our service stores from that content: nothing. It reads the request only in memory to enforce limits on size, model and allowed tools, then forwards it and returns the response; the content is discarded afterwards. Cloudflare execution logs are deliberately disabled for this service. What it keeps is your account identifier for 60 seconds, to avoid rechecking access on every request; a count of questions asked; the total monthly cost; and, for up to two minutes, an irreversible code derived from the network address to limit abuse. No readable network address, questions, responses or trip content.
We send requests with store: false so the response is not stored for later retrieval through the API. This does not eliminate the provider’s abuse-prevention logs. OpenAI states that API data is not used for training by default and that abuse logs may be retained for up to 30 days, or longer if legally required or necessary to protect against harm. We do not promise zero retention. See OpenAI’s data controls and Cloudflare’s privacy policy.
To show a restaurant or museum photo on a suggestion card, the app queries Wikimedia (Wikipedia and Wikimedia Commons). It sends the name of the place being searched. The provider also receives network information needed to respond to the request.
The app uses Maps to find addresses and routes, Weather for destination forecasts, and Live Activities. Apple handles these requests under its privacy policy. They do not pass through us.
Cordel asks for your location only while you use the app, and only during a trip, to suggest things near you.
The app requests accuracy of about 100 meters, but iOS may provide a more precise location. That location is passed to Apple’s geocoding service to obtain the neighborhood or city. We send the assistant the place name, such as “Trastevere, Rome”, rather than GPS coordinates. You can decline permission and keep using the app.
The app keeps a limited technical log on the device and receives iOS crash and performance diagnostics through MetricKit. This process does not automatically send reports to our server. In Account → Diagnostics, you can inspect and share a report. Apple reports sent according to your system sharing settings follow a separate process.
If you send us an email or report, we receive the sender’s address and the content you choose to send so we can provide support. Avoid including passwords, personal documents or real booking confirmations in a support request.
Messages and attachments sent to support are used to answer and follow up on your issue. We do not promise automatic deletion after a fixed period; you can request deletion through the same contact. Records needed to meet a legal obligation or handle an incident may need to be retained.
We want to state this explicitly:
When you invite someone to a trip, they can view and edit its content: itinerary, notes and synced cover photo. That is the purpose of the feature, and you should know exactly what it includes.
Participant names and invitation details identify who is on the trip. What is not shared: your password, conversation history and anything marked as private, including your preparation and packing checklists. Private information may still be included in the AI context you authorize. You can leave a shared trip at any time.
If you subscribe through the website, we use your email to send Cordel news and launch announcements according to the option you confirm in the form. This subscription is independent of your app account and the former beta list.
We store your email, subscription date, source, consent record and the country reported by the infrastructure, when available, in Cloudflare KV. We keep this data while your subscription is active. To unsubscribe and request deletion of this data, write to contact@usecordel.com.
If you complete the survey at /en/feedback, we store the answers you submit, the date and the consent version to understand your experience and improve Cordel. You do not need to sign in or provide your name. Free-text answers may contain personal data; avoid sending passwords, documents or booking codes.
If you agree to a conversation and provide contact details, we use them only to arrange a conversation about your experience. This does not subscribe you to news or advertising. Answers are not published or linked to your app account.
Answers are stored in Cloudflare KV and automatically expire within 90 days. Exported working copies must also be deleted within that period. The form does not record IP addresses, countries or advertising identifiers in the answers; Cloudflare infrastructure processes the network information needed to receive the submission. To request access, correction or deletion, write to contact@usecordel.com and include information that helps locate your answer. Without contact details or another reference, it may not be possible to identify a specific answer.
Under the LGPD, you may at any time confirm whether we process your data; access it; correct it; request anonymization, blocking or deletion; request portability; learn who we share it with; and withdraw consent.
You can delete your account yourself in the app, without asking anyone: Account & settings → Your account → Delete account. The updated version also lets you delete guest data from Account & settings → Delete my data. If you sign in with Apple, we store an Apple-issued token only on our server, solely to revoke that access when you delete your account. The token is deleted with your account. If automatic Apple access revocation is unavailable, the deletion confirmation explains how to remove access in your Apple Account. This does not prevent deletion of your Cordel account. For any other request, write to contact@usecordel.com and we will respond within 15 days.
If you are in the European Union, equivalent GDPR rights apply in the same way and through the same address.
As explained above, your data is processed by providers outside Brazil, including in the United States and Cloudflare’s global network. You can request more information about providers and international processing through our privacy contact. Permission to use online AI is separate from account sync.
Cordel is not intended for children under 13, and we do not knowingly collect children’s data. If you know that a child has sent us data, write to the address above and we will delete it.
If something significant changes, such as a new provider or a new type of data, the date at the top changes and the text explains what changed. We do not silently rewrite the past.
Matheus Alexandre Dantas · contact@usecordel.com
You may also file a complaint with Brazil’s National Data Protection Authority (ANPD).