Your information. Your control.

Privacy notice - September 12, 2026

Records on this device

Cards, family labels, photos and uploaded documents are encrypted in this browser's IndexedDB. A key derived from your card password protects these records. Passwords require 8–128 characters and are not stored in recoverable form. Use a unique password or passphrase. Someone who obtains copied browser storage can attempt offline password guessing; local screen timeouts do not prevent those attempts. Device and browser security remain important.

Initial unsaved entries and attachments stay in memory until password setup completes. Locking clears application-held keys, signing-secret references and sensitive views. JavaScript cannot guarantee physical erasure of browser memory. The previous biometric shortcut is disabled because it stored a recoverable PIN; use password unlock. Existing PIN-protected records require the old PIN once, followed by a new password. Migration replaces stored records only after the new password is saved successfully.

Backups and recovery

Version 4 backups encrypt and authenticate the complete backup, including attachments and personal metadata, using the backup password. Older backups did not authenticate or encrypt all attachments; only restore older files from a trusted source. Replace those copies with new backups. A valid backup and its password can restore records under a new local password without the forgotten old password. Without a usable password or backup/password, recovery cannot be guaranteed.

Public QR information

The QR intentionally shares card fields, including name, passport details, insurance, medical information and emergency contacts, without requiring a password. Anyone with the QR or link can read or copy those fields. Information is self-reported, not an authenticated medical record. New QR links use a URL fragment rather than a query string; normal HTTP requests do not include the fragment, but page scripts and anyone with the link can read it. Old query-based links may already appear in server logs or browser history.

Uploaded documents remain on the owner's device and in backups. They cannot be retrieved on a different phone from this local-only QR. No remote document-sharing service is provided. Printed cards, PDFs and shared QR links are readable copies outside the encrypted vault and cannot be recalled by changing the website. On-device private emergency records require unlocking; the printed QR remains publicly readable.

Connections and wallet operations

The hosting provider receives normal website requests and connection information, such as IP addresses. Site libraries and fonts are served from the same origin. The application does not intentionally send private vault contents, card passwords or backup passwords to the host. Hosting logs and retention depend on the operator's configuration. Online loading is required; this release does not promise offline website availability.

Wallet features connect to XRP Mainnet services at xrplcluster.com, s1.ripple.com, s2.ripple.com and xrpl.link. Public addresses, requests and signed transactions go to these services. Wallet secrets are used in browser memory and not persisted. Explicitly enabled automatic anchoring keeps a secret reference until locking, hiding the tab or leaving the page. Submitted ledger transactions cannot be cancelled by locking.

Anchoring publishes a fingerprint of card fields in a public, durable transaction. Verification checks transaction success, validation, wallet and fingerprint. It does not certify identity, exchange KYC, uploaded documents or medical accuracy. XRP operations incur network fees. Planned partner credentials are not issued by this implementation.

External services

Insurance, travel resources and exchanges operate independently under their own policies. The embedded insurance quote form is hosted by Allianz; loading it connects your browser to Allianz, and trip details entered there are submitted directly to Allianz. TravelMedID does not automatically share your saved medical card with the form. Optional location lookup asks for consent and browser permission before sending coordinates to BigDataCloud. Manual country selection remains available. Clicking an insurance link is not proof of coverage.

Removal

Clearing site data removes local records. It does not remove backups, printed cards, shared QR links or public ledger entries. Keep a tested backup before clearing data. This notice is a technical description, not a legal compliance certification.

Contact: traveler@travelmedid.com. Do not email medical files, wallet keys or passwords.