Trippa Privacy Policy

1. Information we collect

• Account and authentication data: name, email address, securely hashed password, social sign-in identifier when used, account dates, and legal acknowledgements.
• Trip and traveler content: destinations, dates, places, schedules, notes, budgets, accessibility or dietary preferences, traveler profiles, routes, flights, lodging, and collaboration choices.
• Assistant content: prompts, chat history, feedback, saved preferences, and the cross-trip memory you can review, edit, or delete in Settings.
• Technical data: session identifiers, IP address and request metadata available to our host, browser and device details, security logs, error information, and content-free provider usage counters.
• Beta applications and communications: an email address and name you affirmatively submit, your answers about when you expect to take a trip and who you travel with, any optional note, support messages, and notification choices.

Trippa requests your device’s precise location only after you choose an explicit location feature, such as “Nearest to me” or the map’s locate button. The Activities distance feature sends those coordinates to Trippa long enough to calculate distances; the map locate button keeps them in the open page. Opening or using assistant chat does not request or send device GPS. Browser permission controls still apply.

2. How we use information

We use information to create and synchronize trips, personalize recommendations, generate routes and itineraries, answer assistant requests, search for travel options, deliver opted-in notifications, authenticate accounts, prevent abuse, monitor provider cost and reliability, debug the Service, respond to support and privacy requests, and comply with law.

3. AI processing

Relevant prompts, trip context, saved preferences, and tool results are sent through OpenRouter to the model provider selected for the request. Every OpenRouter inference request uses two privacy controls: zero-data-retention routing (zdr: true) and provider data-collection denial (data_collection: "deny"). OpenRouter uses those controls to route only to endpoints marked ZDR and to exclude providers whose stated endpoint policy permits collecting or training on prompts. If no compatible endpoint is available, the request can fail rather than silently using a weaker policy. See OpenRouter’s current ZDR documentation for the underlying policy definitions.

Optional voice typing uses your microphone only after you start recording. When you choose to transcribe, we turn your audio into text using the privacy controls described above. We won’t save your recording. The text becomes an editable draft; it is not sent to the assistant until you send it. Discarding a recording before transcription does not upload it.

This applies to AI inference requests. Web search, maps, lodging, weather, flight, and other external tools are separate services with their own data policies, which are described below. Trippa does not provide a secure store for confidential values. Anything you type into chat—including a booking confirmation code, a door code, a Wi-Fi password, or a payment-card number—is sent to the AI provider as part of that request and is kept in your chat history. Do not paste payment-card numbers or credentials you would not want stored. One narrow exception remains: a saved preference whose name looks like a credential (for example one called “wifi password”) is withheld from assistant context.

AI providers are independent service providers with their own security and legal obligations. Do not enter information that is unnecessary for planning. AI output can be incomplete or wrong, so verify important availability, accessibility, route, weather, and booking details with the final provider.

4. Maps, travel searches, and external data

To perform a feature you request, Trippa sends the minimum relevant query to the applicable provider. This can include a place name or address, coordinates, dates, party size, budget, route waypoints, travel mode, flight number, or search terms.

• Maps, places, and routing: location queries, coordinates, waypoints, and travel modes needed to geocode places and calculate routes.
• Weather and flight status: a destination or flight number and date needed to return the requested status.
• Web research: search terms when broader, current research is helpful.
• Lodging inventory and booking links: destination, dates, party size, and requested filters needed to return live booking options.

The final lodging booking is made with the named booking provider, under that provider’s terms and privacy policy. Trippa does not receive payment-card details from those bookings.

5. Affiliate relationships

Some lodging links are affiliate links. Trippa may receive a commission if you book through one, at no additional cost to you. Commissions do not determine ranking. Recommendations are ranked for user value—such as fit, availability, price, rating, distance, and stated preferences—not supplier compensation.

6. Analytics and operational telemetry

Optional product analytics are off by default. If you opt in, Trippa sends PostHog a pseudonymous identifier, broad account attributes such as plan and signup method, broad page area, and a curated set of feature events. Name, email, prompts, searches, destinations, addresses, notes, traveler profiles, chat text, tool arguments, tool results, and travel credentials are excluded. Autocapture and session replay are disabled.

For troubleshooting, we separately retain restricted error diagnostics, including error messages and stack traces, for up to 30 days. We redact known credentials, URLs and email addresses, but error text may contain incidental personal information. Diagnostic details are available only to administrators, and access is logged.

Global Privacy Control disables optional analytics during registration. You can also turn analytics off in Settings at any time; doing so stops future optional events and resets the browser analytics identity.

Trippa separately keeps first-party, content-free operational counters needed for security, cost control, and reliability. These may include an internal account reference, provider or operation name, app surface, success or failure, duration, token counts, cache state, and result count. These counters are not sent to PostHog.

Authorized administrators also use existing application records to understand feature adoption and returning use. Reports show account-level counts and costs, not trip content, conversations, journal text, or browsing histories. This reporting does not introduce additional click or page tracking and operates independently of optional PostHog analytics.

7. When information is shared

• Collaborators: members of a shared trip can see the trip content available to their role. Do not add another person’s information unless authorized.
• Service providers: vendors that perform hosting, AI inference, optional analytics, email delivery, social sign-in, maps, routing, weather, flight status, web research, and lodging search solely to provide the applicable feature.
• Payments: Stripe may process billing if paid plans are enabled in the future. Paid checkout is disabled during the current public beta.
• Legal, safety, and business events: when required by law, needed to protect users and the Service, or in a merger or transfer where users will be notified of materially changed practices.

8. Retention and deletion

• Account, trip, chat, and preference data are kept while your account is active, until you delete the content or account.
• Detailed first-party operational usage records are deleted after 90 days. Monthly usage and cost totals without account references are retained for 13 months. Provider billing snapshots and manually entered provider totals are retained for up to 13 months.
• Beta applications expire after six months. An approved invitation link expires after 14 days, and the application record is deleted 30 days after an account is created; withdrawn entries are deleted sooner.
• Privacy verification requests expire after 24 hours; completed and expired request records are removed after 30 days.
• Optional PostHog product events are intended to be retained for no more than 12 months.

You can request a portable data export or permanent account deletion in Settings. Export and deletion use a one-time email link. Before deletion, you must choose whether each owned trip with collaborators is transferred to an existing collaborator or deleted for everyone. Deletion removes data from Trippa’s active systems immediately after confirmation. Limited records may persist temporarily in provider-managed security logs or backups until they rotate, or longer when required for fraud prevention, disputes, tax, or other legal obligations.

9. Security

Trippa uses TLS in transit, hashed passwords, server-side sessions, role-based trip access, and hashed verification and access tokens. Trip content is visible to every member of that trip, so remove a collaborator promptly if they should no longer have access. Trippa does not offer encrypted storage for confidential values—see “What Trippa collects” above. No system is perfectly secure. If a breach requires notice, Trippa will notify affected users as required by law.

10. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to processing, withdraw consent, and appeal a denied request. Settings provides direct controls for account details, assistant memory, preferences, analytics, email, exports, connected AI clients, and account deletion. You may also contact privacy@trippa.ai. Trippa will not discriminate against you for exercising a privacy right.

Trippa does not sell personal information or share it for cross-context behavioral advertising. Trippa honors Global Privacy Control for optional product analytics. Browser “Do Not Track” signals are not otherwise standardized.

11. Children and fellow travelers

The Service is for adults age 18 or older and is not directed to children. An adult organizer may provide limited information about children or other travelers only when authorized and responsible for doing so. If you believe a child submitted an account directly, contact us so it can be removed.

12. International processing

Trippa is currently offered on a United States-first basis. Providers may process information in the United States and other countries. Their privacy protections may differ from those where you live. If Trippa expands its formal offering to additional jurisdictions, this policy and transfer safeguards will be reviewed.

13. Changes and contact

Material policy changes will be presented in the Service for renewed acknowledgement. The effective date and version above show the current policy. Contact Trippa at privacy@trippa.ai.