TravAI Analytics Android
This policy describes data processing for package com.travai.nordic. Effective 27 July 2026.
TravAI Analytics is a read-only harness-racing analytics app operated under the TravAI name. It displays race information and probabilistic estimates. It does not place bets, accept stakes, process payments, log in to betting operators, or upload betting files. Predictions are estimates, never guarantees.
The internal test is intended for adults aged 18 or older.
The app creates a random installation identifier. When a tester enrolls for TravAI predictions, the app sends that identifier, the selected market, and a one-time enrollment code over HTTPS. The server stores the installation identifier, market, token hash, scopes, issue time, and revocation state in a mode-0600 registry. The bearer token itself is not stored in plaintext on the server. Consumed enrollment-code records are retained in the protected registry.
The web boundary records standard request information including IP address, timestamp, method, path, status, and user agent. Nginx access logs rotate daily and retain up to 14 rotations. Operational service messages are kept in the host journal with a maximum retention of 30 days. Authorization headers and bearer-token values are not intentionally logged.
The app requests race-day information and, after enrollment, a TravAI prediction overlay for the selected Nordic market and date. These requests reveal the selected market and date to the relevant services. The racing-domain information concerns races and participants, not the app user's contacts, location, or communications.
Market and language choices, optional favorites and private notes, the installation identifier, and a bounded last-good race-data cache are stored in app-private storage. Notes and favorites are not sent to TravAI or racing operators. The bearer token is encrypted with Android Keystore. Android backup is disabled, and the cache contains no bearer token or prediction overlay.
The release requests only the Android INTERNET permission. It does not request location, contacts, phone, SMS, camera, microphone, storage, advertising ID, or notification access. It contains no ads, analytics SDK, attribution SDK, social-login SDK, or third-party tracking SDK. Release network traffic is HTTPS-only.
Local data can be removed by deleting individual notes and favorites, clearing app data, or uninstalling the app. Clearing app data or uninstalling removes the local token and installation data because Android backup is disabled.
The protected server enrollment record has no automatic expiry in this internal-test release. It is retained until the installation is revoked or its record is deleted. Revocation immediately prevents further authenticated prediction access; registry records can then be removed through the controlled server procedure.
Internal testers can request backend revocation or deletion through the same monitored invitation or test-coordination channel that supplied their enrollment access. TravAI will verify the request against that test enrollment before removing the server record. A public monitored privacy contact address is being established before any wider release.
TravAI does not sell app-user data and does not share favorites or private notes. Infrastructure providers used to deliver the website and API may process network metadata as part of secure delivery and abuse prevention. Access credentials are scoped per installation, stored encrypted on Android, hash-stored on the server, rate-limited, and revocable.
The app displays Nordic harness-racing programme, participant, market, result, and derived prediction information. Source names and operator trademarks belong to their respective owners. TravAI does not claim sponsorship, endorsement, or operator affiliation. Legal confirmation of redistribution and trademark rights has not yet been documented; this remains a gate before distribution beyond the controlled internal test.
Material changes will be published at this URL with an updated effective date. During the controlled internal test, privacy, access, revocation, and deletion requests must be sent through the invitation or test-coordination channel used to provide enrollment access.