Legal

Privacy Policy

Last updated: 25 September 2026

This Privacy Policy explains how JOSTE (“we”, “us”) handles information in connection with the JOSTE mobile app and the JOSTE website (together, the “Service”). JOSTE is operated by a solo developer based in Serbia. It is a travel-search app that looks up flights and hotels together and shows you one list ranked by price.

1. Who we are & how to contact us

JOSTE is operated by a solo developer based in Serbia. For any privacy question or request, email jovancode511@gmail.com. For data-protection purposes, we are the “controller” of the limited information described below.

2. Information we process

Trip details you enter

To run a search, you provide trip details in the app. These are used to fetch results and are not tied to your name or any account (there isn’t one):

• Origin and destination airports (or a chosen region, in “Surprise Me” mode)
• Departure and return dates, and any date flexibility (±3/7/15 days)
• Number of travellers, children, and infants
• Your budget range and currency

The traveller/children/infant counts are simply passenger numbers for pricing a trip - JOSTE is a general-audience travel app and does not ask for anyone’s age or identity.

Technical & connection data

When your app or browser contacts our servers, our hosting provider processes standard technical data (such as your IP address and request time) transiently to deliver and secure the Service. We don’t use this to identify you or build a profile, and we keep only minimal, short-lived operational logs.

Subscriptions & purchases

JOSTE offers an optional paid subscription (“JOSTE Unlimited”). Purchases are handled by Apple — Apple is the seller, takes your payment, and issues any refunds; your card details go to Apple and never reach us. To unlock and restore your subscription across your devices we use a subscription-management provider, which validates the App Store receipt and tracks whether your subscription is active. By default this is tied only to an anonymous, app-generated identifier — not your name, email, or Apple ID — so your purchase history isn’t linked to your identity. We receive your subscription status (active or not), never your payment information.

Ad measurement (iOS, only with your permission)

We run ads for JOSTE on TikTok and want to know which ads actually bring new users, so we can spend less on the ones that don’t. For this the app includes the TikTok App Events SDK. On iOS, the first time you open the app it shows Apple’s standard App Tracking Transparency prompt.

• If you allow tracking, the SDK sends TikTok your device’s advertising identifier (IDFA), basic device information (model, iOS version, IP address, language) and two events: that the app was installed/opened and, if you subscribe, that a subscription was bought (product and price - never your name, card, Apple ID, or what you searched for). TikTok uses this to match the install to the ad you saw and to improve our ad delivery.
• If you decline (“Ask App Not to Track”), the app does not read your IDFA and iOS blocks the SDK from contacting TikTok’s servers. Apple may still report to TikTok, on its own and without any identifier, an anonymous, aggregated count of installs that came from an ad (Apple’s “SKAdNetwork”). This can’t identify you.
• You can change your answer at any time in iOS Settings → Privacy & Security → Tracking.

TikTok processes this data under its own privacy policy. We don’t use the SDK for anything else: no analytics of how you use the app, no ads shown inside JOSTE, no audiences built from your searches.

What we do not collect

• No account, name, email address, phone number, or password
• No payment or card details — subscription payments go to Apple, and any booking payments go to the travel partner; neither reaches us
• No device or precise location, contacts, photos, microphone, or health data
• No advertising identifier (IDFA) unless you explicitly allow it in Apple’s tracking prompt (see “Ad measurement” above) - and never for anything other than ad measurement
• No product-analytics or crash-reporting SDKs. The only third-party SDKs in the app are for subscription management and, on iOS, TikTok ad measurement

3. How we use information

• To perform the flight/hotel search you request and show you results, prices, and travel options
• To show indicative “from” prices, destination photos, and weather on browse cards
• To provide, unlock, and restore your subscription (via Apple and our subscription-management provider) and to prevent purchase fraud
• To operate, secure, debug, and improve the reliability of the Service
• With your permission only: to measure which TikTok ads lead to installs and subscriptions, so we can run better ads (see “Ad measurement” in section 2)

For users in the EEA/UK, our legal basis for processing your trip details and for providing your subscription is to take steps at your request and to perform our agreement to give you the search and subscription you asked for (Art. 6(1)(b) GDPR); for minimal technical/security data and fraud prevention, our basis is our legitimate interest (Art. 6(1)(f)) in running a safe, working service; for ad measurement, our basis is your consent (Art. 6(1)(a)), given in Apple’s tracking prompt and withdrawable at any time in iOS Settings. We don’t carry out automated decision-making that produces legal or similarly significant effects, and providing your data is not a statutory requirement — it’s simply needed to run a search.

4. Providers we send your search to

JOSTE doesn’t hold its own flight and hotel inventory. To return your results, the trip details above are sent to the categories of providers below - each an independent company that handles data under its own privacy policy:

JOSTE is a search tool, not a travel agency — it doesn’t sell flights or hotels and isn’t the organiser or seller of your trip. When you choose to book, JOSTE opens a third party’s checkout in your browser: flights via Skyscanner redirect links (which hand you on to the airline or travel agency), and hotels via a JOSTE-branded checkout operated by our hotel-booking partner Nuitée, which collects your guest details and takes the payment (your card statement shows “Nuitée Travel Limited”). JOSTE is not the seller of the hotel and never receives your card details; the booking is a separate contract between you and the provider, under the provider’s own terms.

5. No selling; ad measurement only with your permission

We do not sell or rent your information and do not share it with data brokers. We show no ads inside JOSTE and never use your searches to target ads. The one exception to “no tracking” is ad measurement: only if you allow it in Apple’s App Tracking Transparency prompt, the TikTok SDK links your device’s advertising identifier with TikTok’s data to work out whether one of our ads led to your install or subscription. This is “tracking” as Apple defines it, which is why the app asks first. Decline, and it doesn’t happen.

6. Retention

Your search details are used to fulfil your request and are not stored against your identity (we don’t have one for you). Our servers keep short-lived caches of prices by route (typically hours) to speed up browsing and reduce calls to providers - these are keyed to routes/places, not to you - and only minimal, short-lived technical logs. Subscription records (whether your subscription is active) are kept by Apple and our subscription-management provider for as long as needed to provide and support your subscription and to meet legal/accounting duties. Ad-measurement events (if you allowed tracking) are retained by TikTok under its own policy; we don’t keep a copy. We don’t build search histories or user profiles.

7. Security

Traffic is encrypted in transit (HTTPS), and our provider keys and secrets are kept server-side. Because we don’t collect accounts or payment data, there is no such store to be compromised.

8. International transfers

We are based in Serbia, which is outside the EU/EEA and is not covered by an EU “adequacy” decision. The providers above and our hosting may also process data on servers outside your country, including in the United States. Where personal data is transferred out of the EEA/UK, we rely on an appropriate safeguard: for US recipients certified under the EU–US Data Privacy Framework, that framework; otherwise the European Commission’s Standard Contractual Clauses (or the UK equivalent), or another lawful mechanism. You can ask us which safeguard applies to a particular provider.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal data, to object to processing, and — where we rely on consent — to withdraw it at any time (EEA/UK GDPR), as well as rights regarding the sale/sharing of personal information (California/CCPA). We do not sell personal information. The only “sharing” for advertising purposes is the TikTok ad measurement described in section 2, which happens solely with your permission; you can opt out or withdraw at any time in iOS Settings → Privacy & Security → Tracking. Because JOSTE has no accounts and does not store your searches against your identity, in practice we usually hold no personal data tied to you to retrieve or erase. You can still contact us at jovancode511@gmail.com with any request or question. You also have the right to lodge a complaint with a data-protection authority — in the EEA/UK your local authority, or (for our establishment in Serbia) the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik).

10. Children’s privacy

JOSTE is a general-audience travel app and is not directed to children, and we do not knowingly collect personal information from children. The traveller/children/infant fields are passenger counts entered by the adult planning the trip, not information about the user.

11. Changes to this policy

We may update this policy as the app evolves. We’ll change the “Last updated” date above, and material changes will be reflected on this page.

12. Contact

For privacy questions or data requests, email jovancode511@gmail.com.