Privacy policy

Updated October 14, 2026 · Private beta

Forway helps you organize trips and bookings, see an itinerary and calendar, and view travel places and approximate routes on a map. This policy explains the private beta's data handling. For privacy questions or account-deletion requests, contact forwayDev@outlook.com.

Account and travel information

Forway uses your name, email address and account identifiers to provide an account, sign-in, verification and password recovery. It keeps the trips and bookings you add, including their travel dates, places, providers, references, prices and supported ticket codes. These details support the itinerary, calendar, map and offline access. Authentication credentials are handled through Amazon Cognito.

Forway does not ask for access to your whole mailbox. You choose which booking confirmations to forward to your private Forway address, and Forway accepts them only from senders you have verified. It processes the email and supported attachments to extract booking facts. When automated model extraction is enabled, confirmation content is sent to the configured cloud model service for that purpose. Imported details can be incomplete or uncertain and remain available for your review and correction. Extracted booking facts and protected ticket codes are stored in your account even while awaiting review or assignment to a trip.

Services, maps and sharing

Forway uses Amazon Web Services to receive, process, authenticate and store information, including Amazon Bedrock for enabled model extraction and Amazon Location Service for location lookup. They operate the product; Forway does not sell travel information or provide it to advertisers or data brokers. The private beta does not activate billing or Sentry crash reporting.

Location lookup sends a place name and available city or transport code to the configured cloud location service. It does not send the full email, account email, booking reference or price for that lookup. Approximate route processing sends mapped endpoint coordinates and transport mode to Forway's backend route worker. Map tiles are downloaded for the area you view, so the map service receives normal network requests for that area. Booking locations describe your trip; this does not mean Forway tracks your device's GPS location.

If you confirm an external directions action, your selected map app or website receives the destination coordinates or place query. Forway excludes booking references, ticket codes and account details from that handoff. OpenFreeMap is the default map provider; the configured map service receives normal requests for the displayed area. When a supported confirmation link is retrieved for an import, the booking website receives that link request. Retrieved page content is used for the import rather than being shared with other travelers.

When you share a trip, the invited traveler can view the shared itinerary, map and ticket codes. The trip owner controls access and can revoke it. Copies another traveler has already saved may remain after access is removed. The camera is used to read invitation QR codes. Import notifications are optional and scheduled on this device; they are generic and do not include booking details. Security and operational diagnostics support reliable operation without recording raw emails, booking facts, ticket values, authentication tokens or model content in that diagnostic boundary.

Storage and retention

Accepted trip and booking information stays in your Forway account until you remove it or delete the account. Downloaded trips and approximate route lines are kept in encrypted account-specific storage on your device for offline use. Signing out removes that account's downloaded travel data from the device.

The original forwarded email is temporary. Forway deletes its exact raw version immediately after successful processing. Pending or failed raw messages remain recoverable for 14 days, then a separate cleanup job targets removal. Asynchronous cloud-storage expiry is a backup: a noncurrent raw version can remain for a further 14 days, roughly 28 days from original creation. Service delays can extend removal; these are cleanup targets, not guaranteed 14-day or 28-day byte-deletion deadlines.

Email subjects remain in import history until you delete your account, even after the original email is deleted.

Account deletion removes active Forway account/travel data and forwarding setup. Cloud identity deletion has a durable retry if interrupted. Automated database backups are encrypted and currently have a seven-day retention setting; deletion does not immediately erase those backups. Separately retained beta recovery database copies have no scheduled expiry and require manual review and handling when an account-deletion request is fulfilled. Deleting an account in the app does not automatically erase those recovery copies.

Limited security, operations and financial-usage audit records can remain for legitimate operational and security purposes; they exclude raw emails, booking facts, tokens and model content. Identifiers needed to finish identity deletion remain until that work completes, followed by a hashed deletion record. Different log/audit classes can have different retention periods; Forway does not promise that all records disappear with the active account.

Your controls

You can correct or delete bookings and trips, change or disable forwarding, remove verified senders, replace a private forwarding address and control notifications. Signing out clears downloaded data. In Account > Delete account and data, you can request permanent deletion after confirmation and password verification.

If you cannot sign in or no longer have the app, email forwayDev@outlook.com to request deletion. You do not need to reinstall Forway. Forway will verify that you control the affected account before acting; never send your password, verification code, ticket code or full booking confirmation in a deletion request.

Forway protects cloud processing and device storage with the implemented encryption and account-access controls. Security controls reduce risk but do not make data collection disappear. If beta data handling changes, this policy must be updated to describe the actual behavior.

Processing locations

Forway uses AWS services in Canada and the United States. The configured booking-extraction service is Amazon Bedrock using the Kimi K2.5 model in US East (N. Virginia). Forwarded confirmation content and supported attachments needed for extraction may therefore be processed in the United States. Map and other external service requests are handled by the relevant provider.

This website

This public website is delivered through Amazon CloudFront and Amazon S3. AWS processes technical request information such as your IP address, requested page and browser request headers to deliver and protect the site. These pages do not set advertising or analytics cookies, contain tracking scripts, or collect booking details through a web form. If you contact support by email, your message and the information needed to handle it are processed through the support mailbox.

Changes and contact

The date above identifies this version of the policy. We will update the policy when data handling changes. For privacy questions, requests about your information, or questions about retained recovery copies, contact forwayDev@outlook.com. For account-deletion instructions, use the Delete your account link below.