Legal

Privacy Policy

Last updated: [date of publication]

In short

  • We collect the data you give us (email, name, trip plans, files you upload) and basic usage info.
  • The trip planner works without an account. Your trip, the people you travel with and your travel style stay in your browser. They reach your Tripdox account only if you save a trip or switch on “Keep my travellers and travel style in my TripDox account”. They are never put in a shared link.
  • AI planning only after you say yes. The planner sends your trip to OpenAI only after you agree on the card that says what goes. It never sends names, dates of birth, passports, your home or any street address.
  • Anonymous counts and error reports help us fix the planner. They never contain your trip, places, dates, names or anything you type, and use no cookies. Switch them off under Your travel style → Help improve TripDox; they start off if your browser sends Global Privacy Control or Do Not Track.
  • Trip videos are made on your device. Your photos are never uploaded.
  • We don’t sell your data. We share only what’s needed with the services that power the app (section 4).
  • You can delete your account and all associated data at any time from Settings.
  • Questions? Reach us through Help & Support or at support@tripdox.com.

1. Who we are

Tripdox (“Tripdox”, “we”, “us”) is a travel-planning service operated under the domain tripdox.com [legal entity name and address] and distributed as a mobile application (“Tripdox”) on Android. This Privacy Policy applies to the web app, including the trip planner on tripdox.com, and to the mobile app.

2. Information we collect

We collect information in three ways:

2.1 Information you give us directly

  • Account details — email address and display name when you sign up.
  • Trip data — cities, dates, travel modes, flights and trains you pick, hotels, places and itinerary edits.
  • Uploaded documents — PDF/image files of flight, train, or hotel bookings you choose to upload so we can auto-populate your trip.
  • Home location — the city or address you optionally enter as your trip origin.
  • Support messages — content of any message you send through in-app Help & Support.
  • Who’s travelling (trip planner, optional). For each person you add, all of it optional: the name as on their passport; an age or date of birth; gender (used only to draw their figure on the map); passport country; how they get around (on foot, wheelchair, walking aid, stroller or carried) and, with it, whether they manage steps, whether a wheelchair folds and how far they can walk; a baby’s seat or lap on flights; food needs (for example vegetarian, halal, kosher, Jain, gluten-free or a nut allergy); how their figure looks; their own travel style (below); and which of them goes on each trip.
  • Your travel style (trip planner, optional). Your preferences — for example your usual wake-up time and day, walking pace and distance, luggage, how you like to fly and take trains, budget, interests, food, prayer times and fasting, motion sickness, passport, home time zone, times you call home or work, loyalty programmes and dates you celebrate — and, if you add them, each traveller’s own: their sleep and wake-up time, bedtime and nap, jet lag, motion sickness, walking, and interests.
  • Photos for a trip video (trip planner, optional). When you make a video of your trip, the photos you choose are read and cut into the video on your device. The planner reads when and where each photo was taken (date, time and time zone, and the GPS location if the photo has one), the camera’s details (make, model, lens and, where the photo records it, its serial number) and the file’s name and size, and makes a small preview. It keeps these, with your edits, in your browser (section 10). None of it — the photos, their details or the video — is uploaded to us or anyone else. The map in the video is drawn from the same map service as the planner (section 4).

2.2 Information we collect automatically

  • Device & app info (mobile app) — device model, OS version, app version, crash logs.
  • Usage data (the rest of our website and the mobile app) — pages/screens visited, features used, time spent (for product analytics).
  • Authentication tokens — session tokens issued by our authentication provider, stored securely on your device.
  • The trip planner’s anonymous counts and error reports (telemetry). When you hide or leave the planner it sends our server:
    • counts of what was used: that the planner opened (how long it took to start, and the window’s width to the nearest 100 pixels); how many stops the trip had, as a range such as “5–7”; which parts were opened (flights, hotels, costs, who’s travelling, day trips, share, save, the AI planner, trip videos); whether an AI suggestion was applied, undone, answered without AI or marked wrong, and that the page held something back instead of sending it; for a trip video, how many photos as a range, how long placing them took, how the video was made, its size in whole megabytes and whether it was downloaded or shared; that a trip was played to its end and by which main mode; and how many errors happened;
    • error reports: the error’s text with anything that could say who or where you are removed first (names of places and people, dates, times, coordinates, e-mail addresses, web addresses beyond their site, quoted text, long numbers), the planner file and line, the planner’s version, and what it was doing, such as “planning”.

    They never contain your trip, its cities, hotels, dates or times, anyone’s name, your travel style or anything you type, and carry no identifier: no cookie, no account, no device ID. Switch them off under Your travel style → Help improve TripDox; they start off if your browser sends Global Privacy Control or Do Not Track.

  • Your IP address is used to limit how many requests one visitor can make. Our web server counts the trip planner’s requests per address for a minute at a time [in our rate-limit store, Upstash, where it is used]. The planner’s own server never keeps the address: it turns your network into a one-way code, made with a secret key and replaced every day, and keeps that code only to count that day’s limits, never with a report. The same daily code goes with AI planner requests (section 4).

2.3 Information from third parties

  • If you sign in with Google, your Google account email and profile name (no password is ever shared with us).

2.4 Where the trip planner keeps things

  • On your device, by default: your trip, the people you travel with, your travel style, your trip videos’ photo details, and the answers the planner found for each trip (prices, timetables, the AI planner’s suggestions, and the questions they answered, such as how many are travelling, the children’s ages and where you sleep), so a trip reopens complete.
  • In your Tripdox account, only if you choose: a trip you Save to my trips (and its short link, if you make one); and, only with “Keep my travellers and travel style in my TripDox account” switched on (off by default), the people you travel with, your travel style, who goes on each saved trip, and each saved trip’s finished results — its cost sheet (never your budget), the amounts you enter under I paid… for that trip (each amount, its currency, whether it is for everyone, each person or a night, whether tax is included, the place and day it is for, and when you entered it — so they follow you to your other devices), and the AI planner’s suggestions for its legs. Switching it off deletes the account copy (your “I paid…” amounts stay on your device). When your account keeps them, signing out removes your saved trips’ “I paid…” amounts from the device; they come back when you sign in.

2.5 Sensitive details

Some details you can add about the people you travel with, or in your travel style, can reveal information about health or religion — a wheelchair or walking aid, an allergy or gluten-free diet, food needs such as halal, kosher or Jain, prayer times or fasting. We use them only to plan around them. They stay on your device unless you switch on keeping them in your account, and before the first copy is made there we ask for your explicit consent. The AI planner receives food needs and prayer times only if you also tick “Also my diet and prayer times” on its card. If someone travelling uses a wheelchair, a walking aid or a stroller, the AI planner is told only that the trip needs step-free routes or has a stroller — never who, or why. You can remove any detail, or a whole person, at any time.

3. How we use your information

  • To create and manage your account.
  • To generate AI-powered trip plans, itineraries, and suggestions.
  • To search for flights, trains, hotels, and directions, and return results to you.
  • To extract booking details from PDFs you upload, and match them to the correct leg of your trip.
  • To sync your trips across devices.
  • To check your plan for the people travelling — for example entry rules for each passport, child fares and age limits, step-free stations and accessible taxis, and places where everyone can eat.
  • To respond to your support requests.
  • To detect abuse, debug crashes, and improve the product. The planner’s counts and error reports are totals and error lines, not profiles: they cannot be linked to you, a trip or a device.

We do not sell your personal information. We do not use your data for third-party advertising. We do not use the people you travel with or your travel style for advertising.

4. Third parties we share data with

To deliver the service, we share the minimum necessary data with these providers:

  • Supabase — authentication, database, and file storage. Stores your account, trips, saved planner trips, and uploaded files.
  • Railway — hosts our web app and the trip planner’s server.
  • OpenAI (older features: also Anthropic and Google Gemini) — large-language-model providers. In the older pages they generate itineraries and read booking PDFs you upload.
    In the trip planner, when you ask the AI planner (“Other ways” for a leg) and say yes on its card, we send OpenAI what that question needs: the leg’s cities, dates and times, the bookings you picked (for example flight and train numbers, and your hotels’ names and where they are on the map), how many people are travelling and their ages on those days, whether the trip needs step-free routes or has a stroller, and the travel-style preferences that question uses (your food needs and prayer times only if you tick that box). If you type a question, it goes as you wrote it, with the names of the people travelling replaced by “your partner”, “your baby” and so on. We never send names, dates of birth, passports, your home or any street address. With each request our server also sends OpenAI the daily one-way code of your network described in section 2.2 (never your IP address, your account or anything that stays the same from one day to the next), which OpenAI uses to detect abuse. Nothing is sent before you say yes, and you can take it back in the planner’s settings.
    City prices: when our fare tables don’t cover a city on your trip, the cost page asks our server to look that city’s public prices up on the web with OpenAI. Only the city is sent (its name, country, a rough location and its airports), with the same fixed code for every city — never anything about you or the rest of your trip. Our server then reads the web pages cited (sometimes through the Internet Archive’s Wayback Machine) to check each price.
    OpenAI does not use this data to train its models and may keep it, the code included, for up to 30 days to detect abuse [until Zero Data Retention is confirmed in writing].
  • LiteAPI (Nuitée) — flight and hotel prices. Our server sends only what a price needs: the route, or the area where you are staying, and the dates; the number of travellers and the children’s ages; and for hotels a guest nationality, which hotels require for pricing — the lead traveller’s passport country or, without one, the country your trip starts from. Names, dates of birth and other details are never sent. A flight search’s answer is shared: our server keeps it for 3 hours (on its disk too, so a restart keeps it), filed under the route, the day, the cabin, the currency and a code made from the number of travellers and the children’s ages — never your network’s code, your address, anyone’s name or anything else that says who asked — and the next traveller who asks the same question gets it. Hotel photos in the planner load from LiteAPI’s image server, which sees your IP address like any website.
  • Google Places / Google Maps Platform — city autocomplete, place photos, driving directions and distance calculations in the older pages; in the trip planner, place search, public-transport, walking and driving times between your stops, stations, airports and hotels (including your home, if your trip starts there and you plan the ride to the airport), a city’s best sights, and opening hours. These requests carry places and times, not who is travelling.
  • Timetable service — train and bus timetables for a leg: the two places and the date. [Name the provider once the source is settled.]
  • Open map and data services, called from your browser by the trip planner — OpenFreeMap (map tiles), Photon by komoot (place, station and port search), OpenStreetMap-based routers (BRouter, OSRM and FOSSGIS, usually through our server) and OpenStreetMap’s Nominatim and Overpass (opening hours), Wikipedia, Wikidata and Wikimedia Commons (city and sight information and photos), Open-Meteo (weather), Frankfurter (the European Central Bank’s exchange rates), flagcdn (flags), GitHub (a map of sea routes), LiteAPI’s image server (hotel photos), jsDelivr, unpkg and cdnjs (program libraries) and Google Fonts (the typeface). Like any website, they receive your IP address and what the request needs — for example the map area on screen or a place name you search for — never your account or the people you travel with.
  • Analytics — Google Analytics for aggregate product usage metrics on the rest of our website. IP addresses are anonymised where supported. The trip planner does not load Google Analytics; its own counts go only to our server.
  • Crash reporting — crash stack traces may be transmitted to error-reporting services to help us fix bugs.

Shared trip links. A link you share from the trip planner contains the route, dates, stops, chosen flights or trains, and hotels by name and map position. It never contains the people you travel with, your travel style, prices, or hotel street addresses; the first city’s hotel (your home) and the way between it and the airport or station are removed entirely. A short link can be switched off at any time with Stop sharing.

We may also disclose information if required by law (subpoena, court order) or to protect the safety, rights, or property of our users or others.

5. Data retention

  • Account & trips — kept for as long as your account is active.
  • Deleted trips — a trip saved from the trip planner is purged 30 days after you delete it. A trip from the older pages or the mobile app is hidden at once and kept until you delete your account. [Once a purge job runs for these trips too: “soft-deleted and purged after 30 days” for every trip.]
  • Uploaded documents — kept while the trip exists, and deleted when you delete your account. [Once the purge job above removes them: “deleted 30 days after you delete the trip, or when you delete your account”.]
  • Support messages — kept for up to 24 months for quality and dispute handling.
  • Server logs — generally retained for up to 90 days for security and debugging [confirm against Railway’s log retention for our plan].
  • Trip planner, on your device — until you remove it or clear your browser data. The answers found for a trip are used for up to 30 days after they were checked, and deleted once the trip has not been opened for 30 days, when you choose Forget the prices kept for this trip, or (the AI planner’s) when you take back your yes. Your “I paid…” amounts stay until you remove them or delete the saved trip they belong to. Your choices on the scout’s Ways to save (at most 40) stay on your device only. A trip video’s photo details stay until you choose Forget these photos.
  • Trip planner, in your account — saved trips until you delete them (then purged after 30 days); a saved trip’s finished results and its “I paid…” amounts until the trip is deleted (they go at once), you switch off keeping your travellers, or you choose Forget the prices kept for this trip (which deletes the trip’s “I paid…” amounts from your account too; they stay on your device and, while the switch is on, go back with the trip’s next prices); an amount you change or remove on one device is changed or removed in your account, and on your other devices when they next open the trip; the people you travel with and your travel style until you switch off keeping them or delete your account.
  • Trip planner’s server — rail and cycling routes and timetables for up to 14 days, shared by everyone; road and walking routes and door-to-door directions (such as from your home or hotel) only in memory, for up to a day, and only to answer you again; flight searches for up to 3 hours, shared, kept across a restart and never with anything that says who asked; an AI planner answer for up to 3 hours, in memory only; hotel rates for up to 6 hours per hotel, without who asked; a city’s looked-up prices for up to 30 days, shared by everyone; the anonymous counts for 35 days, and an error report until 35 days after that error was last seen.
  • OpenAI — up to 30 days for abuse monitoring [until Zero Data Retention is confirmed].

6. Your rights

Depending on where you live, you may have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your account and all associated personal data.
  • Export your trip data.
  • Object to or restrict certain types of processing.
  • Withdraw consent where processing is based on consent (for example the AI planner, or keeping your travellers in your account).

Account deletion is self-service — open the mobile app, go to Settings → Delete account. The web app offers the same option under Settings. Your account and associated trips, saved planner trips and their results, travellers, travel style, files, and support messages are deleted. In the trip planner you can see, change or delete the people you travel with and your travel style at any time from Who’s travelling? and Your travel style. For any other right, contact us (section 12).

7. Security

All data is transmitted over TLS (HTTPS). Passwords are hashed by our authentication provider. Uploaded files and database rows are protected by row-level security so that only you can access your own trips. The trip planner’s keys to paid services stay on our servers and never reach your browser. No system is perfectly secure — if you believe your account has been compromised, contact us immediately via Help & Support.

8. International data transfers

Our providers (Supabase, Railway, OpenAI, Anthropic, Google, LiteAPI/Nuitée and the open services in section 4) operate globally. Your data may be stored or processed in regions outside your home country, including the United States and the European Union. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

9. Children

Tripdox accounts are for users aged 18 and over. Parents and guardians may add their children’s names, ages or dates of birth to plan a family trip (section 2.1); only their ages are used for prices and the AI planner (section 4), and children do not use Tripdox themselves. We do not knowingly collect personal information directly from children under 13 (or under 16 in the EEA/UK). If you believe a child has provided us with personal data, contact us and we will delete it.

10. Cookies and local storage

The web app uses essential cookies and browser local storage to keep you signed in, remember your preferences (currency, language), and run analytics on the rest of our website. The trip planner keeps your trip, the people you travel with, your travel style, the answers it found and your trip videos’ photo details in your browser’s storage (local storage and IndexedDB), so it works without an account; this is not used for tracking. When you take one of the scout’s ways to save, or keep your plan instead, it remembers that choice in your browser (what it was about and where, the choice, how to put your plan back, and the money or minutes it saved or cost), so it does not offer you the other side of the same trade; it keeps at most 40, and never puts them in your trip, a shared link, a saved trip or your account. Its counts and error reports use no cookies and store nothing on your device except your on/off choice (and, for one browser tab, a note that our server did not accept reports). The mobile app uses AsyncStorage / SecureStore for the equivalent purposes. You can clear these at any time from your browser or device settings, but doing so will sign you out and remove trips you have not saved.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email. The “Last updated” date at the top always reflects the current version.

12. Contact us

Questions, concerns, or data-rights requests? The fastest way to reach us is through the in-app Help & Support screen. You can also write to us at support@tripdox.com. [Grievance officer / EU representative, if counsel says one is needed.]

Terms of Service·Home