AI & Data Disclosure

Finding Horizons uses two artificial-intelligence providers: OpenAI (OpenAI, L.L.C., United States) for text — extraction from captions and transcripts, and generated briefs and proposals — and Google's Gemini API(Google LLC, United States) for vision: reading the images and video of public posts you share so places visible only on screen can be found. When an AI feature runs, the request goes to the provider's API from our servers. Your device never talks to either provider directly.

Horizon, the in-app travel companion, is powered by Meta.When you talk to Horizon — type or speak a question, ask for a suggestion, or receive a day-before trip brief it writes — the request goes from our servers to Meta's Muse API (Meta Platforms, Inc., United States). Only Meta's standard Muse models are allowed, which Meta states are never trained on the data sent to them; the “contributor” models that do train are refused by our code. Horizon never falls back to another AI provider: if Meta is unavailable, Horizon answers from the app's own deterministic tools or tells you it is unavailable. When you speak to Horizon or speak a memory on an iPhone, your recording is turned into text on the phone itself by Apple's speech recognition and is not uploaded; only when your phone cannot do that for your language (or you decline Apple's speech recognition) is it turned into text by OpenAI's speech-transcription model (the same one used for shared media). The reasoning is Meta's alone. No AI vendor other than these three receives your data.

The models we call are OpenAI's general-purpose text models and speech-transcription model, and Google's Gemini vision models. Which specific model handles a given request can change as the vendors release new ones; the set of providers does not change without an update to this page. All three are used on paid API tiers whose terms exclude use of your content for model training.

This is separate from connecting your own assistant. If you connect Claude or ChatGPT to your account yourself, that assistant is your provider under your agreement with them — see section 7.

The core promise of this product is that it does not dress a guess up as a fact. Nothing on a screen is invented to fill a gap: if we do not have something, we show nothing, or we say it is unavailable. This section states which is which.

Measured — read from a source, not written by a model:

• A place's name, address, coordinates, and category, which come from Google Places
• The country you are in, which comes from reverse geocoding a coordinate — never from a model
• Weather forecasts, aurora conditions from NOAA space-weather data, and live event listings from event providers
• Your own data: your saved places, trips, itineraries, budget entries, notes, and bookings parsed from confirmations you gave us
• Visa and stay rules, which come from a scraped reference table of official sources, each row carrying its own source link

Generated — written by a model, and therefore capable of being wrong:

• Place candidates read out of something you shared — a caption, a screenshot, a spoken voiceover. A model proposes a name; that name is then looked up in Google Places, and only a place that verifies becomes a pin. An unverified guess is discarded, not shown.
• Written briefs and summaries: local-area intelligence, destination descriptions, plain-language visa explainers, and trip summaries
• Proposed changes to a day of your itinerary
• Cost-of-living figures. Every monthly-cost band shown for a city — rent, groceries, transport and the rest — is a modelled estimate, generated by a model and labelled as an estimate with its currency and the date it was produced. It is not a survey, not a measurement, and not a price anyone quoted us. Do not budget a relocation on it without checking local sources.
• Translations of generated briefs into your chosen language

Generated text is labelled where it appears, and estimates carry their own wording — “usually busy — estimate”, and similar. An estimate is never presented in the place of a measurement.

AI features are triggered by something you do. Nothing is sent to an AI provider in the background, and nothing is sent unless a feature you started — or a trip brief or reminder you switched on — needs it.

• When you share or import a link: the URL and the public post text, caption, or page content we fetched from it.
• When you share or upload an image, screenshot, or PDF: that image, so a vision model can read the place name off it.
• When you share a video or audio file from your phone: the media itself, so the spoken narration can be transcribed. This uses only the file your share sheet handed us — we do not download media from TikTok, Instagram, or anywhere else on your behalf.
• When you ask for a brief or a replan: the trip context needed for that request — place names, dates, the city, and notes attached to the stops involved.
• When you talk to Horizon:your message, the conversation so far in that thread, and what Horizon reads from your own account to answer it — your trips and their stops and times, your saved places (with their map positions), your notes on a place, and experiences you logged. It reads only your account, and it can propose a trip but never creates, books or changes anything itself. Your device's live location is not sent.
• The day before a trip starts (if you keep trip notifications on):that trip's dates, origin, destination and first stops, so Horizon can write your brief.

What is never sent: your email address, your account identifier, your name, your profile photo, your payment details, your identity-verification documents, and your device location. Requests carry the content of the task, not the identity of the traveller.

Photo library: we never scan your photo library. Only a file you pick is read.

We do not send your data to OpenAI, Google or Meta for training, and we have not opted into any programme that would.We use OpenAI's API under its business terms, which state that API inputs and outputs are not used to train its models. OpenAI's own retention of API traffic is governed by OpenAI's terms and privacy policy, not by ours; we do not control it and we do not restate a number here that we cannot verify from our own systems.

We cache generated text in our own database, deliberately. A brief about a city is generated once and served to everyone who asks about that city, which is how the product stays affordable. That cached text is about a place, not about you: it carries no account identifier and nothing personal from the request that happened to trigger it. Each cache entry records which engine and prompt version produced it, so a later fix can invalidate its own bad output rather than serving it forever.

Your own trip data is not cached for other users under any circumstance.

Your conversations with Horizon are kept for 90 days, then deleted automatically. Each conversation's title, and what Horizon has learned about your preferences (which you can pause or export in Profile), stay while your account is active. Deleting your account deletes all of it.

Language models produce text that sounds confident and is sometimes factually wrong. Generated content in Finding Horizons is informational only. It is not professional travel advice, not legal advice, not immigration advice, and not medical advice, and it may be inaccurate, incomplete, or out of date.

Before you make a decision that costs money or affects your ability to travel, verify independently:

• Opening hours, prices, and whether a place still exists
• Visa, entry, and transit requirements — always on your own government's or the destination's official portal
• Travel advisories and safety conditions issued by your government
• Transport times, connections, and booking terms
• Health and vaccination requirements
• Local laws and customs

Do not use generated content for emergency planning or any decision where an error could cause harm. The app is not a safety or emergency tool.

When AI proposes changes to an itinerary, it produces a proposal, not a change. Every proposed move is re-checked by the app's own deterministic planner, and anything that fails that check is dropped rather than shown to you. What survives is presented for you to review, and it is applied only when you accept it. This holds whether the request came from inside the app or from an assistant you connected yourself.

Finding Horizons can be connected to an AI assistant you already use, such as Claude or ChatGPT, through an MCP connector. You do this by minting a personal key in the app and pasting it into your assistant.

What this gives away: connecting an assistant gives that assistant, and the company that operates it, access to your Finding Horizons data — and it can change that data. That is the entire point of the feature, and it is a decision only you can make. Concretely, a connected assistant can read and write your saved places, trips, itineraries, bookings (read-only), budget, and progress, and it can read reference data such as visa rules and local intelligence.

• Your data goes to your assistant's provider. Whatever your assistant reads from your account is processed by Anthropic, OpenAI, or whoever operates the assistant you connected, under their terms and their privacy policy — not ours. We have no visibility into what they do with it.
• Anything you tell your assistant to do, it can do. A connected assistant acts with your authority. It can add, change, and remove your travel data.
• Your key is you.Anyone holding your connector key can act on your account. It is shown to you once and we store only a one-way hash of it, so we cannot recover it and neither can anyone who breaches our database. Never paste it anywhere except your assistant's connector field.
• It only ever reaches your own account. A connector cannot read another traveller's data.
• Scopes are narrow by default. The two capabilities that spend our AI budget — replanning a day and running an import — are withheld unless explicitly granted, and they are rate-limited and capped separately from everything else.
• Revoking. Access ends when the key is revoked. Deleting your account destroys the key with it.

The connector is optional and off until you create a key. If you never mint one, no outside assistant has any access to your account. Setup, and what each capability does, is explained at findinghorizons.ca/connect.

AI is metered. Generation is capped per import and per day, and paid lanes are escalated to rather than run by default. If a cap is reached or the provider is unreachable, the feature says so — you will see an honest unavailable state, never a fabricated result standing in for one.

Availability of AI features by plan is described in our Subscription Terms. Where a feature is limited to a paid plan, that limit is enforced on our servers, not in the app.

Generated content is not a substitute for a travel agent, a licensed tour operator, an immigration lawyer, a doctor, or emergency services. For complex international travel, consult a qualified professional or your government's travel advisory service.

If we change AI provider, or begin sending a category of data this page does not list, we will update this page and notify you of the material change. Questions about how your data is used by AI features: privacy@findinghorizons.ca.

See also our Privacy Policy and Travel & Booking Disclaimer.