Your passport
Passport details are never requested and never stored. Not the number, the image, the printed name, or the expiry date. No screen asks for them and no column accepts them.
What is stored is two letters: the country code of your passport, such as SA. The column holding them has no room for a third character.
Those two letters serve one purpose: working out visa requirements, and how many countries you may enter without a visa. Only the account holder sees them. Change or clear them from Settings at any time.
Your location
It leaves your device the moment you ask for what is nearest to you, and comes back as results sorted by distance. It is not stored afterwards. There is no row and no column for it in the database.
Deny the location permission and everything works except distance sorting.
Your email and name
Your email is for signing in and for password recovery. Your display name appears next to any review you write, and whoever reads the review sees it.
Your password
Stored as a scrypt hash with a per-account salt. Nobody can read it: not you after typing it, and not the server operator. The hash cannot be reversed.
Forgot it? A code is sent to your email and expires after its window or on first use.
Signing in with Apple or Google
When you sign in with either, the provider sends your identifier there, your email, and your name.
If you chose Hide My Email with Apple, a relay address from Apple arrives instead of your address, and it works the same.
When you delete your account, an unlink request is sent to Apple, so the app does not linger in your device settings after you leave.
Your searches
Search history lives on your device only. Six entries, and the oldest drops. It never reaches the server, and one button in the search screen clears all of it.
Saved items, visited countries, added places
Your saved items, the countries you marked as visited, and the places you added are stored with your account so you find them on a second device.
A note you write on a country you visited is yours alone.
A place you add may be shown publicly if it is accepted. You are told before it is published.
For a city you download for offline reading, the stored data is its name, the size of its pack, and when you last opened it, so you can see what is taking up space. Delete it from the same screen.
Your itinerary
An itinerary you build is stored with your account: its title, city, dates, your daily budget if you entered one, and your pace. Two fields are yours: how you get around, and whether you want a step-free route. They are used to order stops that suit you.
While it is a draft, it is yours alone.
Publish it and it becomes public. People read its title, dates, budget, and the two fields describing how you get around, and they may copy it for themselves. Publish it when you are content for it to be read. Until then keep it a draft.
What you write for others
Your review, your stars, and your comment on a fact are all public, along with your display name. Write them as published, because they are.
Your vote on a fact appears in the count only, without your name, and so does your confirmation that a fact still holds.
When you report that a fact has changed, the app owner reads your note and your evidence link in order to correct the information.
Your report about violating content is read by the app owner. The reported person does not learn who reported them, and someone you hide is not told that you hid them.
Enquiries to a provider
When you send an enquiry to a service provider, they read your text, your destination, and your travel date. Write what you are content for a business owner to read.
Notifications
Your device obtains a token from Google, and it is stored with your account. The token passes through Google servers so the notification reaches you, and the notification title and body pass with it. Your email and name do not.
What arrives is kept in your in-app notification inbox: its title, body, where it leads, and when you read it. Turn off any type from Settings, except the new-device sign-in alert, which concerns the security of your account.
Signing out revokes the token, so nothing reaches that device afterwards.
Payment and subscription
Your card is entered on the payment gateway page, not in the app. Your card number does not pass through the server and is not stored there. There is no card field in the app at all.
The gateway receives the order number, the amount, and a reference that does not reveal your email.
The order record stays: what you bought, for how much, in which currency, whether it completed, and whether it is refundable. It is a financial record and it remains after account deletion, as an invoice remains.
An in-app subscription is managed by Apple or Google, and its status and identifier come from them.
If you are a provider
Your profile, display name, bio, contact link, and phone are public by your own choice, so travellers can find you. Your verification request is read by the app owner alone.
Device fingerprint
A random number generated once by the app on your device, stored hashed.
It is not derived from anything on your device: not the serial number, not the advertising identifier, and not any number the manufacturer knows.
It serves two things: one session per device, so you are alerted if someone else signs in; and stopping a single voice being counted twice when you vote on a fact or confirm one.
Clearing app data generates a new number unrelated to the first.
Usage counting
Actions with a quota in your plan are counted with their timestamp, so the remaining balance is known. A count, not content: the action and its date, without what you did inside it.
What is never collected
- Passport, national ID, date of birth, or gender.
- A phone number for an ordinary user. The phone field belongs to providers alone, who publish it themselves.
- Card numbers.
- Your network address in the database. It lives for a minute in server memory to block repeated requests, then is discarded.
- The advertising identifier. It is explicitly removed from the app.
- Analytics, usage tracking, and crash reporting tools. Not one of them is in the app.
- Your address book, photos, microphone, or calendar. No permission is requested for any of them.
Your data is not sold and not shared for advertising purposes. No path in the app does that.
Who receives anything
Every party here is operational: without it, something in the app does not work.
- Apple: your identifier and email when you sign in with Apple, and an unlink request on deletion.
- Google: your identifier, email, and name when you sign in with Google.
- Google notifications: your device token and the notification text.
- The Apple and Google stores: your subscription status and identifier, if you purchased in-app.
- The payment gateway: the order number, the amount, and an anonymous reference, if you paid by card.
- The mail server: your email and the message text, for password recovery only.
- OpenStreetMap: the map tile area you are looking at, if you chose a map other than the built-in one. The built-in map comes from the app server and nothing leaves with it.
- The image service: the image file name, without your account identifier.
How long it stays
- Your account and its contents: until you ask for deletion.
- After a deletion request: thirty days during which any sign-in cancels the request.
- After the thirty days: your email, name, and password are erased, your Apple and Google identities are deleted, and all your sessions are revoked.
- A hash of a deleted account's email remains, so the same account cannot be reopened with the same address. The address itself does not remain.
- Your session: until you sign out.
- Your notification token: until you sign out or the provider rejects it.
- Your location: the duration of the request only.
- The audit log recording who changed what and when: one year, then erased.
What remains after deletion
Deleting your account erases who you are, and does not erase what you wrote for others.
Your email, name, and password are erased, your Apple and Google identities are deleted, and all your sessions are revoked.
What you published remains: your review, your comment, your published itinerary, your vote, your report, and your financial order record. They remain without your name, because the name is erased, so whoever reads them afterwards does not know who wrote them.
The reason is that a deleted review leaves the reader after you facing information that is short of what it was. The facts stay; the identity goes.
Want a specific post removed? Delete it before you delete your account, or write to [email protected].
Age
The app is for all ages. There is nothing in it to keep a child from reading it, no minimum age for browsing destinations, cities, and places, and no account required for that. With no account, no email, no name, and nothing else is stored about the reader.
If you are a guardian and you found an account for your child here, or data from them you do not want, write to [email protected] and the account and everything in it will be deleted.
Your rights
- Read: everything about you is shown in your profile and in Settings.
- Correct: change your passport, airport, appearance, and name whenever you wish.
- Delete: request account deletion from Settings. Three steps, and a thirty-day window in which you may return.
- Object: turn off notifications, deny location, and clear your search history.
Changes to this document
Each version carries a number and a date, written at the end of this page. Your agreement is recorded against the version you actually read, not the one after it. When the version changes, it is presented to you again.
Behind the app
My Next Destination is one of the projects of ZeroType, a Saudi software studio founded in 2013 in Riyadh. zety.net
Contact
Write to [email protected] with any question about your data.
Version 4 · 2026-09-04