How your book is handled
Last updated 3 September 2026
This describes what Rewynd collects, where it goes and what it never touches. It is written against what the software actually does. Where a sentence would have been convenient but untrue, it is not here.
The short version. Your name, your stamps and anything you upload are stored on our server so your book opens on any device. Your PIN is never stored — only a hash of it. Your passport and visa details never leave your device at all. We do not sell anything to anyone, and there is no advertising.
Rewynd is operated by GV Mediatech, No. 1 Sampige Road, Mantri Greens, Malleswaram, Bengaluru 560003, India (“we”, “us”). For anything in this policy, write to concierge@rewynd.travel.
| Data | Required | Why |
|---|---|---|
| Surname and given name | Yes | Printed on your passport and shown to travellers who open your book |
| PIN | Yes | To sign you in. Stored only as a PBKDF2-SHA256 hash with a per-passport salt, never as text |
| Email address | No | Only to send a PIN reset link. Nothing else is ever sent to it |
| Home airport, year you started travelling, cabin preference, short bio | No | Shown on your passport |
| Passport photograph | No | Shown on your passport |
Your Rewynd passport number is issued by us. It is not a real passport number and we never ask for one.
Stamps (city, country, airport code, dates, your notes and titles, and coordinates where a place is known or a photograph supplied them), photographs and video you upload, journal entries and dispatches, who you follow, your wishlist, and trip costs if you record them.
If you allow location access, your approximate coordinates are used to show local time, the weather outside your window and travellers near you. We do not keep a history of where you have been physically — only the places you choose to stamp.
Our server keeps ordinary request logs (IP address, time, page) as any web server does, and a record of failed sign-in attempts against a passport number so a PIN cannot be guessed by brute force.
Your PIN. Only a hash. Nobody here can read it, recover it or tell you what it is, and nobody here will ever ask you for it.
Your passport and visa details. Expiry dates, issuing country and visa records are held in your browser's local storage on that device and are never sent to our server. There is no setting that publishes them, deliberately: an expiry date together with a name and a nationality is a social-engineering kit. The consequence is that they do not follow you to another device, and clearing your browser data deletes them.
Your recovery code. Shown once, stored as a hash.
On Postgres hosted by Vercel, in Mumbai, India (Vercel's bom1 region). Photographs and video
are stored as data in that database rather than on a separate image service.
Backups are kept by the database provider under their own retention schedule.
We keep this list short on purpose. Every entry is a company that can see something about you.
| Who | What they get | Why |
|---|---|---|
| Vercel | Hosting, the database, and cookieless page-view analytics | To run the site |
| Open-Meteo | Your approximate coordinates, if you allow location | The weather shown in the window |
| BigDataCloud | Your approximate coordinates, if you allow location | To turn coordinates into a place name |
| Hostinger | Your email address, if you ask for a reset link | To deliver that one message |
| Meta / Instagram | Whatever you choose to send | Only if you message us for support. Their privacy policy applies to that conversation, not ours |
We do not sell personal data, we do not share it for advertising, and there are no advertising or tracking scripts on the site.
Rewynd is a social network, so some of your book is visible by design:
You can close your book to everyone in Settings → Who can see your book.
No system is perfectly secure, and we will not pretend otherwise. If you find a vulnerability, tell us at concierge@rewynd.travel before telling anyone else and we will work with you.
No one can promise a breach will never happen, and a policy that implies it can is not worth reading. What we can set out is what we would do.
If personal data here is lost, exposed or reached by somebody who should not have reached it, we will investigate immediately and contain it first. Where the law requires it or where the breach is likely to put you at real risk, we will tell you directly — by email to the address on your passport, and by a notice on the site if we cannot reach you. We will say what happened, what data was involved, what we have done, and what you should do, in plain words rather than a legal notice. We will not wait for certainty about every detail before telling you something that affects you.
We will report to the Data Protection Board of India as the DPDP Act requires, and to the relevant supervisory authority within 72 hours where the GDPR applies. Nothing in this section is a reason for us to delay telling you.
Your book is kept while your passport exists. Delete it and the passport, its stamps, uploads, posts and connections are removed from our live database within 30 days, and from backups as those expire. Failed sign-in records are discarded after 15 minutes. Request logs are kept for 30 days.
Wherever you live you may ask us to show you what we hold, correct it, delete it, or give you a copy in a portable form. Settings → Your data → Download everything does the last of those immediately and without asking us.
If you are in India, the Digital Personal Data Protection Act, 2023 gives you these rights and the right to nominate someone to exercise them if you cannot. If you are in the EEA or the UK, the GDPR gives you these rights plus the right to object to processing and to complain to your data protection authority. To exercise any of them, write to concierge@rewynd.travel.
If you are in California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to delete it, to correct it, and to receive it in a portable form — all of which are above and none of which require a reason. Two further rights are worth stating plainly because of how often they are dressed up elsewhere: the right to opt out of the sale or sharing of personal information, and the right to limit the use of sensitive personal information. We sell nothing and share nothing for advertising, we run no cross-context behavioural advertising, and we have no “Do Not Sell” button because there is nothing for it to switch off. You have the right not to be discriminated against for exercising any of this; Rewynd has one tier and it does not change based on what you ask us for. An authorised agent may act for you if they can show you asked them to. Write to concierge@rewynd.travel and we will answer within 45 days, or tell you why we need the further 45 the statute allows.
Rewynd sets no tracking cookies and no advertising cookies. Vercel's analytics is cookieless and counts page views without profiling you.
We do use your browser's local storage, which is not shared with anyone:
rewynd.token.v1 — your sign-in token, so you stay signed in.rewynd.passport.v1 — your book, so it opens offline, and your
passport and visa details, which live only here.rewynd.prefs.v1 — your settings, such as units and whether the
sky follows the clock.A service worker also keeps a copy of the page so Rewynd opens with no signal. Clearing site data removes all of it, including your documents.
Rewynd is not for children under 16. We do not knowingly collect anything from them. If you believe a child has created a passport, write to concierge@rewynd.travel and we will remove it.
If we change this in a way that matters, we will say so on the site before it takes effect. The date at the top always reflects the current version.
Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023:
Grievance Officer: Nivedith G
Email: nivedithg@nivedithg.com
Address: No. 1 Sampige Road, Mantri Greens, Malleswaram, Bengaluru 560003, India
We acknowledge complaints within 24 hours and resolve them within 15 days.