Data and privacy

Dyme's privacy policy covers everything here: dyme.earth/privacy-policy.

What the server sees

The signed-in traveller's Dyme account id and email.
Their Dyme trips, Miles balance and price watches, when they ask about them.
The search details they ask for: places, dates, the number of travellers, and children's ages when given.
The name of the assistant they connected from, read from the connection.

It does not read the assistant's memory, other conversations or files.

A search's results are held in memory for about 30 minutes.
A trip_id lets a follow-up question re-run the same search for 12 hours. It is encrypted, and only the same traveller's connection can use it.
Server logs record a one-way code in place of the account id, and never the email or a child's age.
Requests to the Dyme team (price match, call-back, change, cancellation) are emails to the team, with the details needed to act on them. The traveller's account address is the reply-to.

Searches, prices and bookings go to Dyme's own booking platform, travel.dyme.earth.
A price comparison sends the hotel or route and the dates, never the traveller's identity, to a search data provider that reads public prices.
Booking links carry the choice and the account they belong to, encrypted.

Tool results contain text from hotels, reviews and other sites. The server marks it as information, and the assistant is told never to act on it as an instruction.
Before a tool that sends something (an email to the Dyme team, a price watch), the assistant is told to say what it will send and wait for the traveller to agree.
Payment details never pass through the assistant or this server.