Sojourn, last updated 13 September 2026
Plain-language summary: Sojourn helps you track where you spend your nights so your tax residence stays clear. We collect the data you enter, plus three things you have to switch on yourself: your device's location, a read-only scan of your mailbox that looks for your travel bookings, and the emails you forward to your personal Sojourn address. Your data is yours, you can export it or delete your account at any time, and we never sell it.
Sojourn ("we", "us") is operated by an individual established in Zurich, Switzerland, trading as Sojourn, who is the data controller for the personal data described below. Postal address: Sojourn, Hammerstrasse 103, 8032 Zurich, Switzerland. The controller's identity is given on request at [email protected]. There is no company behind Sojourn today. If one is set up, this page will name it as the controller before it takes over. For any privacy question, or to exercise the rights in section 7, write to [email protected]. Because the controller is established in Switzerland, the Swiss Federal Act on Data Protection (FADP, revised, in force since 1 September 2023) applies. The EU and UK GDPR apply as well to users in those territories, and this policy is written to meet both. Sojourn is operated from Switzerland and has no establishment in the European Union. We have not appointed a representative in the Union under art. 27 GDPR at this stage of the product; if you are in the EU or the UK and want to reach us about your data, write to [email protected] and we answer you directly, in English or in French.
| Account | Email address and name you provide when creating an account. |
| Residence & travel data | The countries, regions, nights, trips, worked days and targets you enter to use the tracker, and the free-text notes you may write on a day or on a trip. Those notes are stored on your device and backed up to your account with the rest of your travel data, so that you can read them back after a reinstall. They are yours to write: nothing in the app analyses them, they change no count and no verdict, and as with proofs we do not ask for special categories of data in them. The only way they leave your device beyond that backup is if you tick “Your notes” in an export, a box that starts unticked, and share the file yourself. |
| Location (optional) | If you enable location tracking, the app receives your device's position whenever you move a significant distance (roughly 800 metres), including while it is in the background or closed, plus one check each night so that a day spent at home is still recorded. Each position is immediately turned into a country, region and city, and only those place names are written down, never the coordinates themselves. This log stays on your device: it is not uploaded to our servers, and it is kept there, for as long as you use the app on that device, so that you can see how a night was attributed and correct it. It is erased when you sign a different account into the app or uninstall it. What does leave your device is the resulting nightly attribution, one country and region per night, which is backed up to your account so that reinstalling the app does not lose your calendar. Two anonymous counts also leave your device each time a batch of positions is processed: how many readings were turned into a place, and how many had to be discarded because that lookup failed. They are numbers only, with no place and no coordinates, recorded with a timestamp under the random device identifier described in section 8, and they exist so that we know how often the lookup fails. The only way the log itself can leave your device is if you include the GPS journal in an export and share that file yourself. The purpose is to attribute each night to a place without asking you to type it. You can turn tracking off at any time in Settings, and iOS or Android will also let you revoke the permission directly. |
| Inbox scan (optional) | If you connect a mailbox, you grant Sojourn read-only access to it through your provider's standard sign-in screen: Google's for a Gmail mailbox (scope gmail.readonly), Microsoft's for an Outlook mailbox (scope Mail.Read). Your access tokens are kept in your device's secure keychain and never reach our servers. The app then searches your mailbox from your device, looking for two things: messages from known travel and lodging senders, and subject lines typical of a booking confirmation, whoever sent them. In a Gmail mailbox these are two targeted queries, and only the messages they return are downloaded. In an Outlook mailbox the app reads the headers (sender, subject, date) of the messages received in the period it tracks and applies the same two criteria on your device; only the messages that match are downloaded. The search runs when you ask for it, and once a day in the background so that a new booking is picked up without you opening the app. The content of those messages is sent to our parse-email function and analysed automatically (see section 4) to extract trip details (dates, cities, countries, booking reference). When the text alone is not enough, a rendered image or PDF of the message, or a PDF attachment, is analysed the same way. Two things are then stored: the extracted trip fields plus the message's subject, sender and provider message id, as a suggestion you accept or reject; and the original message, with its attachments, copied into your own proof storage, because the raw email carries the headers that prove it is genuine. That copy is made as soon as a trip is detected, before you decide. Rejecting the suggestion does not remove it: you delete it yourself in Proofs, like any other document. You can disconnect a mailbox at any time in Settings. For a Gmail mailbox this also revokes our access at Google. For an Outlook mailbox it deletes the tokens from your device, so nothing on it can read the mailbox any more, but Microsoft offers no revocation for this kind of access: the permission itself is withdrawn from your Microsoft account permissions page. |
| Forwarded travel emails (optional) | Your account has a personal forwarding address at hellosojourn.com, shown in the app. That address is built from your first and last name plus six random characters, so it is readable but not guessable; it appears in the headers of anything you forward. Nothing reaches it unless you send it there, either by forwarding a single email or by setting your mailbox to forward all your email. Every message sent to that address is received by Cloudflare (see section 4), which passes our inbound-email function its sender, subject, date, message id and the beginning of its body, cut to at most 12,000 bytes of text and 12,000 bytes of formatted text. Attachments are never passed on. If you forward your whole mailbox rather than single bookings, that means the beginning of every message reaches our server before anything is looked at, including messages that have nothing to do with travel. We do not want them, we do not keep them, and the next sentences say exactly what happens to them. We never ask for special categories of data this way, and a message we drop leaves nothing behind whatever it contained. The time of the last message received is recorded against your account, even for a message that goes no further, so that the app can show you that your forwarding works. The function then looks at two things only, the same two as the inbox scan: whether the sender is a known travel or lodging company, and whether the subject line reads like a booking confirmation. A message that matches neither is dropped at once, and we store nothing else of it. A message that matches is analysed automatically (see section 4), from its subject, sender, date and that beginning of its body, to extract trip details (dates, cities, countries, booking reference). If the analysis finds no trip booking, nothing more is stored. If it finds one, two things are stored: the extracted trip fields plus the message's subject, sender and message id, as a suggestion you accept or reject; and a copy of the body of the message, limited to the same excerpt, with its subject and sender at the top, in your own proof storage. That copy is made only once a trip is found, and rejecting the suggestion does not remove it: you delete it yourself in Proofs, like any other document. To stop, remove the forwarding rule from your mailbox. Deleting your Sojourn account does not remove that rule for you; anything still forwarded afterwards is discarded without being analysed or stored. |
| Website waitlist | If you join the waitlist on hellosojourn.com, we store your email address to send you your invitation. Each new sign-up is also emailed to our own team address (see section 4), so that we see the request and can reply to you at that address; the alert carries your email address and, if you asked from the app, the country you selected, and nothing else. It is deleted on request and not used for anything else. For cookies on the website, see section 8. |
| Proofs | Documents and files you upload or import as evidence (e.g. transport tickets, lodging invoices). We do not ask for special categories of data, and Sojourn does not look for any. If a document or a scanned message you keep happens to reveal something of that kind, it is stored only as your own proof and you can delete it at any time. |
| Feedback | The category and the message you send from Settings, Send feedback, together with up to three screenshots you choose yourself from your photo library, and a short technical context: the app version, the build number, the over-the-air update id, your device model and your operating system version. The screen shows you that context, in full and read-only, before you send. It carries nothing about your countries, nights or trips, and no screenshot is ever taken by the app: only the images you pick are sent. All of it is stored with your account so that we can answer you at your account email address, it is emailed to us with the screenshots attached (see section 4), and it is read by us. |
| Subscription | Whether you have an active subscription, and which plan, so the app can unlock. We never see your payment details: the purchase is made on your device through the App Store, Apple takes the money and holds the card, and nothing about it reaches us. The status is held by RevenueCat (see section 4) under a random identifier its software creates on your phone, not under your name, your email or your Sojourn account id. If you unlock Sojourn with an offer code, the code is redeemed at Apple and we are told only that a subscription became active. |
| Technical | The app version, and crash reports, recorded under the random device identifier described in section 8. |
| Usage & analytics (see section 8) | How you use the app and website: screens viewed, features used, crashes, and product milestones such as finishing setup, running a scan, saving a trip or exporting a report. These records carry no country, night, trip, document or free text, and no account identifier. See section 8 for which of them depend on your consent. |
Sojourn's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In plain terms, and without exception:
The access you grant is read-only (gmail.readonly) and limited to the messages our travel-related searches return. You can revoke it at any time, either by disconnecting the mailbox in Settings or from your Google Account permissions page.
We use your data for the purposes below. Where the law that applies to you requires a legal basis to process personal data, the basis we rely on is indicated:
We do not sell your personal data. We share it only with the service providers below, who act on our instructions, except where the row says otherwise:
| Supabase (USA / EU) | Database, authentication, file storage, and the functions that read your travel emails and your proofs. Your data is stored in the European Union (Frankfurt, Germany), on AWS. Supabase Inc. is a US company, so access from the United States by its staff cannot be excluded. Safeguard: EU standard contractual clauses with Swiss addendum. |
| Anthropic (USA) | Automated reading of three things, and only these three. One, the travel confirmation emails found by your inbox scan, to extract the trip details, including, where the text alone is insufficient, a rendered image or PDF of the message or of a PDF attachment. Two, the emails you forward to your Sojourn address that look like a booking (see section 2), to extract the trip details from their subject, sender, date and the beginning of their body, never from their attachments. Three, the proof documents you upload or import (tickets, invoices, receipts), when Sojourn checks that a proof matches the trip it is filed against. The content is processed by Anthropic's Claude API in the United States. Under Anthropic's commercial terms it is not used to train models, and inputs and outputs are deleted within 30 days at the latest, except where Anthropic must keep them longer to comply with the law or to investigate a breach of its usage policy. Safeguard: EU standard contractual clauses with Swiss addendum. |
| Resend (USA) | Sending the waitlist acknowledgement and the matching alert to our own team address, the account emails (sign-up code, password reset, invitation) where they are routed through our own domain, and the feedback you send from Settings, with the screenshots you attached to it, delivered to our own team address. Resend Inc. is a US company and processes email in the United States, on Amazon Web Services. Account emails that are not routed through Resend are sent by Supabase's own email service instead. Safeguard: EU standard contractual clauses with Swiss addendum. |
| Expo / EAS (USA) | Building the app and delivering its over-the-air updates. Notifications are scheduled by the app on your own device: no push token is created, sent or stored, and we cannot send you a notification remotely. Safeguard: EU standard contractual clauses. |
| Apple / Google / Microsoft (USA) | App distribution, sign-in with Apple or Google, and, for the inbox scan, the Gmail API or the Microsoft Graph API, depending on the mailbox you connect. These companies act as controllers in their own right for the account you hold with them, under their own privacy policies. |
| Cloudflare (USA) | Hosting and delivery of the hellosojourn.com website, including the waitlist form, and the address that serves your proof files to the app. Cloudflare also receives all email sent to hellosojourn.com: the emails you forward to your Sojourn address, which it passes to our function as described in section 2, without their attachments; and the emails sent to our contact addresses, such as [email protected], which it relays as they are to our own mailbox. Safeguard: EU standard contractual clauses. |
| Google (USA), our team mailbox | The mailbox that receives what you send us: messages to our contact addresses, including [email protected], the alert we get when someone joins the waitlist, and the feedback you send from Settings with the screenshots attached to it. Cloudflare relays those messages to it. This is separate from the Google account you may hold yourself, and from the Gmail API used by the inbox scan, both of which are covered by the row below. |
| RevenueCat (USA) | Managing your subscription: it records that a subscription exists and whether it is active, so the app can unlock. It receives no account identifier of yours (no name, no email, no Sojourn account id), only a random identifier its software creates on your phone. The link between a subscription and a person exists at Apple, not here. Safeguard: EU standard contractual clauses. |
| PostHog (EU) | Product analytics, on EU-hosted infrastructure, and only if you enable the "Anonymous usage" setting (see section 8). It receives which screens you open and which features you use, never your countries, nights, trips or documents. |
| Advertising partners | Only if we run advertising campaigns, and only with your consent (see section 8): advertising platforms such as Meta or Google may process identifiers to measure campaigns. None are active unless the cookie banner or in-app prompt says so. |
We may also disclose data where required by law.
Your data is stored in the European Union: your account, nights, trips, suggestions, proofs and feedback with Supabase in Frankfurt, Germany, and the analytics described in section 8 with PostHog on its EU infrastructure. Switzerland and the EU/EEA recognise each other's level of data protection, so data flows freely between them.
Some of it also reaches the United States. The content of the travel emails found by your inbox scan or forwarded to your Sojourn address, and of the proof documents Sojourn checks against a trip, is processed there by Anthropic. Our outgoing email is processed there by Resend. The emails sent to our contact addresses, the alerts we receive about a new waitlist sign-up, and the feedback you send us with its screenshots, are delivered to a team mailbox hosted there by Google. And Supabase, Cloudflare, Expo and RevenueCat are US companies, so their staff may access data from there in the course of operating their services. Two of our providers run worldwide networks rather than servers in one country: Cloudflare, which receives the email sent to hellosojourn.com and serves the website, and the network layer in front of our analytics. A message or a request is handled at whichever of their locations is closest to it, which can be outside Europe, and we cannot pin that to a single country. Every one of these transfers rests on the EU standard contractual clauses (2021) together with the Swiss addendum, under art. 16 al. 2 let. d FADP and art. 46 GDPR, whichever location handles it. You can ask for a copy at [email protected], free of charge.
We keep your data while your account is active. In addition:
Wherever you live, we offer you the following controls over your data:
We answer free of charge, within 30 days. Depending on where you live, your local law may give you further rights. Our supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC), and you may complain to it at no cost. If you are in the EU or the UK, you may instead complain to your own national authority, for example the CNIL in France; Sojourn has no establishment in the EU, so there is no lead authority and each national authority is competent for the people it protects. We do not make automated decisions producing legal effects about you: the trips found in your mailbox are proposals you accept or reject, any night the app fills in from your position can be corrected by you and never overrides what you entered yourself, and the figures Sojourn shows are indicative, not a tax assessment.
We keep tracking to the minimum the product needs, and we tell you here exactly what is active. Five categories:
When a category becomes active, we update this section (with the named providers) and, where required, ask for your consent before anything runs. Refusing non-essential cookies never blocks the website or the app.
Data is encrypted in transit and at rest. Your session credentials, and your mailbox access tokens, are stored in the device's secure keychain and never sent to our servers. Every table in our database enforces row-level security, so an account can only ever read its own rows; the proof storage is private and is opened only through links that expire within the hour. Access to the production database is limited to the controller named in section 1. No method of transmission or storage is perfectly secure, but we work to protect your data. If a breach happened, we would notify the FDPIC in Switzerland without delay where it was likely to put you at high risk, and, for users in the EU or the UK, the competent supervisory authority within 72 hours where the law requires it. We would tell you directly whenever the breach was likely to put you at high risk.
Sojourn is not intended for anyone under 18, or the minimum age required in your country. We do not knowingly collect data from children.
We may update this policy. We will post the new version here and update the date above; significant changes will be notified in-app or by email.
Questions or requests: [email protected], or by post to Sojourn, Hammerstrasse 103, 8032 Zurich, Switzerland.