Privacy policy

Updated October 16, 2026 · Private beta

Who is responsible

Forway is operated by Matthias Larcher, based in Quebec, Canada. Matthias Larcher is the controller of the personal information processed to operate Forway and the person responsible for its protection. Contact the privacy officer at forwayDev@outlook.com for privacy questions, complaints or requests to exercise your rights.

Forway helps you organize trips and bookings, see an itinerary and calendar, and view travel places and approximate routes on a map. This policy explains the private beta's data handling. For privacy questions or account-deletion requests, contact forwayDev@outlook.com.

Account and travel information

Forway uses your name, email address and account identifiers to provide an account, sign-in, verification and password recovery. It keeps the trips and bookings you add, including their travel dates, places, providers, references, prices and supported ticket codes. These details support the itinerary, calendar, map and offline access. Authentication credentials are handled through Amazon Cognito.

Forway does not ask for access to your whole mailbox. You choose which booking confirmations to forward to your private Forway address, and Forway accepts them only from senders you have verified. It processes the email and supported attachments to extract booking facts. When automated model extraction is enabled, confirmation content is sent to the configured cloud model service for that purpose. Imported details can be incomplete or uncertain and remain available for your review and correction. Extracted booking facts and protected ticket codes are stored in your account even while awaiting review or assignment to a trip.

Services, maps and sharing

Forway uses Amazon Web Services to receive, process, authenticate and store information, including Amazon Bedrock for enabled model extraction and Amazon Location Service for location lookup. They operate the product; Forway does not sell travel information or provide it to advertisers or data brokers. The private beta does not activate billing or Sentry crash reporting.

Location lookup sends a place name and available city or transport code to the configured cloud location service. It does not send the full email, account email, booking reference or price for that lookup. Approximate route processing sends mapped endpoint coordinates and transport mode to Forway's backend route worker. Map tiles are downloaded for the area you view, so the map service receives normal network requests for that area. Booking locations describe your trip; this does not mean Forway tracks your device's GPS location.

If you confirm an external directions action, your selected map app or website receives the destination coordinates or place query. Forway excludes booking references, ticket codes and account details from that handoff. OpenFreeMap is the default map provider; the configured map service receives normal requests for the displayed area. When a supported confirmation link is retrieved for an import, the booking website receives that link request. Retrieved page content is used for the import rather than being shared with other travelers.

When you share a trip, the invited traveler can view the shared itinerary, map and ticket codes. The trip owner controls access and can revoke it. Copies another traveler has already saved may remain after access is removed. The camera is used to read invitation QR codes. Import notifications are optional and scheduled on this device; they are generic and do not include booking details. Security and operational diagnostics support reliable operation without recording raw emails, booking facts, ticket values, authentication tokens or model content in that diagnostic boundary.

Storage and retention

Accepted trip and booking information stays in your Forway account until you remove it or delete the account. Downloaded trips and approximate route lines are kept in encrypted account-specific storage on your device for offline use. Signing out removes that account's downloaded travel data from the device.

The original forwarded email is temporary. Forway deletes its exact raw version immediately after successful processing. Pending or failed raw messages remain recoverable for 14 days, then a separate cleanup job targets removal. Asynchronous cloud-storage expiry is a backup: a noncurrent raw version can remain for a further 14 days, roughly 28 days from original creation. Service delays can extend removal; these are cleanup targets, not guaranteed 14-day or 28-day byte-deletion deadlines.

Email subjects remain in import history until you delete your account, even after the original email is deleted.

Account deletion removes active Forway account/travel data and forwarding setup. Cloud identity deletion has a durable retry if interrupted. The active database is encrypted and has a seven-day automated-backup retention setting; deletion does not immediately erase those backups. Separate manual recovery snapshots from earlier beta migrations remain, including older snapshots that are not encrypted at rest. Manual snapshots have no automatic expiry. Deleting an account in the app does not automatically erase those snapshots. Recovery-copy retention and any erasure request require separate handling by the privacy officer; contact us about information retained in recovery copies.

Limited security, operations and financial-usage audit records can remain for legitimate operational and security purposes; they exclude raw emails, booking facts, tokens and model content. Identifiers needed to finish identity deletion remain until that work completes, followed by a hashed deletion record. Different log/audit classes can have different retention periods; Forway does not promise that all records disappear with the active account.

Your controls

You can correct or delete bookings and trips, change or disable forwarding, remove verified senders, replace a private forwarding address and control notifications. Signing out clears downloaded data. In Account > Delete account and data, you can request permanent deletion after confirmation and password verification.

If you cannot sign in or no longer have the app, email forwayDev@outlook.com to request deletion. You do not need to reinstall Forway. Forway will verify that you control the affected account before acting; never send your password, verification code, ticket code or full booking confirmation in a deletion request.

Forway protects cloud processing and device storage with the implemented encryption and account-access controls. Security controls reduce risk but do not make data collection disappear. If beta data handling changes, this policy must be updated to describe the actual behavior.

Processing locations

Forway uses AWS services in Canada and the United States. The configured booking-extraction service is Amazon Bedrock using the Kimi K2.5 model in US East (N. Virginia). Forwarded confirmation content and supported attachments needed for extraction may therefore be processed in the United States. Map and other external service requests are handled by the relevant provider.

Processing outside Quebec or the European Economic Area can involve different laws and access by public authorities. AWS publishes a GDPR data-processing addendum and international-transfer safeguards. Forway's assessment of the applicable safeguards for each provider and processing location is being completed; the availability of a provider's contract does not by itself establish Forway's compliance. Contact the privacy officer for information about the safeguards applicable to your information.

Purposes and legal grounds

Where GDPR applies, processing necessary to provide the service you request relies on performance of our agreement with you: creating and authenticating your account, storing and displaying your trips, and importing confirmations you choose to forward. Required account information is needed to provide an account; without booking information, the corresponding itinerary or import cannot be provided. Optional forwarding, sharing and notifications remain under your control.

Necessary security, abuse prevention and service diagnostics pursue our legitimate interests in protecting accounts and operating a reliable service, subject to your rights and a necessity and balancing assessment. Where a specific law requires us to retain or disclose information, that processing relies on that legal obligation. If we ask for consent for a separate purpose, we will explain that purpose and how to withdraw consent; withdrawal does not affect the lawfulness of earlier processing. Choosing a feature is not blanket consent to unrelated uses. The legal requirements applicable in Quebec and Canada also apply independently.

Information can concern other travelers named in a confirmation or shared trip, and can come from the person who forwards or shares it. Only provide information you are entitled to provide and that is needed to organize the journey. Contact us if information about you was supplied by another person. Forway uses automated extraction to suggest booking details; this is not intended to make decisions with legal or similarly significant effects about you.

Your privacy rights and requests

Depending on the law and circumstances, you can request access to and a copy of your personal information, correction, erasure, restriction of processing, and a structured, commonly used, machine-readable portable copy. Under GDPR, portability applies to qualifying information you provided that we process automatically on consent or contract grounds. You may object to processing based on legitimate interests, and withdraw consent where processing relies on consent. These rights have legal limits, including protecting information and rights of other people.

Email forwayDev@outlook.com with your request and account email. You do not need to install or sign into the app. We may request proportionate information to verify your identity; do not send passwords, verification codes, ticket codes or identity documents unsolicited. Requests are normally free. We will explain any lawful limitation or refusal and available complaint options.

For GDPR requests, the legal response period is without undue delay and normally within one month of receipt. Where legally permitted because of complexity or number of requests, an extension of up to two further months requires notice and reasons within the first month. Quebec access and rectification requests have a separate 30-calendar-day response requirement; a GDPR extension does not extend that Quebec requirement.

You may complain to the Commission d'accès à l'information du Québec. Where GDPR applies, you may also complain to the relevant European data-protection authority, particularly in the country of your habitual residence, workplace or the alleged infringement. You do not have to contact us first.

This website

This public website is delivered through Amazon CloudFront and Amazon S3. AWS processes technical request information such as your IP address, requested page and browser request headers to deliver and protect the site. These pages do not set advertising or analytics cookies, contain tracking scripts, or collect booking details through a web form. If you contact support by email, your message and the information needed to handle it are processed through the support mailbox.

Changes and contact

The date above identifies this version of the policy. We will update the policy when data handling changes. For privacy questions, requests about your information, or questions about retained recovery copies, contact forwayDev@outlook.com. For account-deletion instructions, use the Delete your account link below.