Who looks after your personal data
TripCompanion is run by an individual. For privacy questions or requests about your personal data, email privacy@tripcompanion.io.
What is collected
Your account. When you sign in with Apple or Google we receive an identifier for you, and an email address if the provider gives us one (Apple sends it only the first time, and may send a relay address instead). We store that, plus the handle, display name, photo, home city and bio you choose.
What you make. Your trips, the places in them, the notes you write, the stops you mark as visited, the hidden gems you add and their photos, the trips and places you save, and who you follow. Also which places you opened, asked for directions to or marked “Not for me”, at most once a place a day, so lists learn what is worth going to. That is never shown to anyone and never leaves TripCompanion. Trips are private until you decide otherwise; a gem is yours alone until you choose “Everyone”.
What you ask for. The sentence you type or say on Discover (“a week somewhere warm…”) and the trip ideas it produced, so you can go back to them and start one later.
Your travel style. The kinds of places you like (beaches, hikes, museums, coffee…), from the styles you pick when you first open the app and from what you do with places: the ones you put in trips, save, add as gems, ask directions to, open often or mark “Not for me”. It is worked out on our servers from your own activity only, and used only to order your own suggestions, to suggest travellers like you, and to tell Claude what you tend to like when it suggests places or plans your days. No style is ever about your religion, health, sexuality or politics. Up to three show on your profile unless you turn that off. It is on until you switch it off (You › Your travel style, or Settings › Privacy), which deletes what was learned and what you picked.
Messages and trip chats. They are end-to-end encrypted on your devices with the Signal protocol. Our server only passes them on: it holds each message, encrypted, until your devices collect it, then deletes it. It never has the keys. What it does know: who you have conversations with, when the last message was, which you muted, which trips’ chats you are in, and the devices you linked (up to five, with their name and type). If you set a recovery PIN, the server keeps a copy of your messaging identity sealed with a key made from that PIN on your phone; it never sees the PIN and can’t open the copy. Ten wrong PINs erase it.
Plus. If you subscribe, the store tells us what you bought and its state, and we keep that: the store, monthly or yearly, when it started and renews or ends, whether it is in a trial or a grace period, and the store’s purchase identifiers. We also count, for everyone, how many asks, trip ideas and planned trips you used each month, and keep a record of each AI request made for you (what kind, which model, when, what it cost). We never receive your card or bank details.
Your language. The app saves the language you use it in (English, Portuguese, Spanish or Dutch) with your account, so the notifications it sends you are in it. On this website, choosing a language in the footer sets one cookie, tc_lang, that remembers it for a year. Your browser sends this cookie to this website with its requests. The site uses it only to remember your language choice; it is not used for advertising or analytics.
Your location, while you are using the app. Discover and Around send a coordinate to show places near you and how far they are. It is used for that request and isn’t stored against your account. Refusing the permission turns those off and nothing else. When you add a gem, its location (from the photo, or from where you stand) is what you are saving.
Your voice, only when you tap “Type or talk”. Speech is turned into text on your phone. The app only uses on-device recognition; where your phone has none, it says so and you type instead. No audio is sent to us or to anyone else.
Reports. If you report a person, trip, place or conversation, we keep the report and who made it, so a person can review it. For a conversation, that includes only the messages you chose to share.
Where you’re staying. The flat or hotel you add to a trip, its address and which nights. Only you and the people planning the trip with you see its name and address; anyone else who can open the trip sees only the town and the nights. A copy of the trip doesn’t take it.
What you tell us. When you send something from Tell us (You › Settings › Tell us what you think, or by shaking your phone), we keep what you wrote with your account, the screen you were on (its name, not what was on it), the trip you had open, the app’s version, whether it’s an iPhone or Android phone, and your language. A person reads it, to fix and improve the app. It is in your data export and goes with your account. The phone notices a shake by itself, only while the app is open, and nothing about it is sent.
App health. When the app hits an error, or a screen or request is slow, it sends a report through Expo Observe: the error, the screen, timings of our own server’s requests, your phone model and system version. Identifiers are taken out of screen addresses first. It also counts a few things, such as how many suggested travellers were shown or followed, without saying who. It isn’t used for advertising or to follow you around.
Technical necessities. A push token if you turn on notifications, and a record of each signed-in session (stored as a hash) so a stolen one can be revoked. Server logs keep a request’s id and any error, briefly, for fixing problems and stopping abuse.
On your phone only
Some things never reach us. Your message history lives on your devices. The Today widget and the day’s Live Activity show your trip from the phone’s own copy. Siri and Spotlight learn your trips and places on the phone, and that stays there. To update a Live Activity while the app is closed, our server sends the day’s next stop through Apple’s push service.
What is not collected
- No advertising identifiers, and no ad networks.
- No marketing analytics or behavioural tracking.
- No background or continuous location. The app never asks for “always” permission.
- No contacts and no calendar.
- Nothing is sold or shared with data brokers.
Photos and the location in them
The app reads where a photo was taken on your phone, to place the gem you are adding. When the photo is uploaded we re-encode it and drop all its metadata, location included, so a published photo doesn’t say where you stood. HEIC photos are converted to JPEG on the phone first.
Who else handles your data
We use the following services to run TripCompanion. Some process personal data on our instructions; others may process it under their own privacy terms. The purpose for each is described below.
- Railway: hosting the API and the database, in the Netherlands.
- Cloudflare: this website, uploaded photos, and the database backups.
- Anthropic: Claude writes your trip ideas and day plans from what you ask, and describes places and destinations. Your request is sent so it can be answered, with your travel style when it’s on, and isn’t used to train models. When you tap “Translate” on something a traveller wrote, that text is sent to be translated; the translation is kept, so the next reader gets it without asking again.
- Voyage AI: turns place descriptions into search vectors. Place text only, never your requests or trips.
- Foursquare: photos, ratings, tips, hours and busy times for public places. We send a public place’s name and coordinates to match it; never anything about you, and never a private gem.
- Mapbox: maps in the app, turning place names into coordinates, and travel times and routes between stops.
- komoot (Photon, a search of OpenStreetMap): finding on the map the places Claude names for your days, and the place you’re staying when you type its name or address. We send that text and roughly where the trip is; never your name or anything about your account.
- Expo: delivering the notifications you asked for, and the app health reports above.
- Apple and Google: signing in, the App Store and Google Play purchases of Plus, and delivering notifications to your phone.
Our API and primary database are hosted in the Netherlands. Some providers may process data in other countries, including the United States. The applicable transfer safeguards depend on the provider, destination and law that applies to you; contact us if you would like details about a particular transfer.
Other people see only what you publish. A private trip is visible to you and the people you invite; a trip shared by link, to anyone with the link; a public trip appears on your profile and in your followers’ Discover. Your handle, display name, photo, bio and public trips are visible to anyone unless you make your profile private. Whether you have Plus is shown only to you.
How long it is kept
- Your content and account: until you delete them, or delete your account.
- Messages: on our server only until your devices collect them.
- Foursquare details: refreshed or removed after 30 days.
- Sessions: refresh tokens expire after 30 days, sooner if you sign out.
- Server logs: around 30 days.
- Backups: deleted account data may remain in backups for up to 90 days.
- Purchase records: while your account exists; after that, only what tax and accounting law make us keep.
Deleting your account
You can delete your account in the app (You › Settings › Delete account). Your public profile details are removed, sign-in sessions are revoked and notifications are disabled. The account is then marked for deletion; after 30 days, the scheduled cleanup removes most remaining account-linked data. A minimal “Deleted account” record may remain to preserve references, and some records may be retained where required by law. If you can’t use the app, Delete your account explains how to ask by email.
Trips other people copied into their own accounts stay with them: they are that person’s trip now. Gems that went public stay on the map, unlinked from your account. Messages you sent stay on the phones of the people you sent them to. Deleting an account triggers an attempt to cancel an active Google Play subscription; that attempt can fail. Apple subscriptions must be cancelled by you in the App Store. Check the store to confirm the subscription will not renew.
Your rights
Your rights depend on the law that applies to you. If UK data protection law applies, you may have the right to access and correct your data, request erasure or restriction, receive certain data in a portable format, object to certain processing, withdraw consent where processing relies on it, and complain to the ICO. These rights are subject to conditions and exceptions.
- Download an account export: Settings › Download my data provides the files described in the app. It does not include message ciphertext, security secrets or another person’s data.
- Correct or delete data: edit your profile and content in the app, delete your account as above, or contact us about a specific request.
- Manage optional features: switch off travel style, notifications or location in the app. This is not a substitute for an objection or consent withdrawal request where those rights apply.
Email privacy@tripcompanion.io to exercise a right or ask a question. We aim to respond within 15 days. If UK data protection law applies, you can complain to the ICO. People elsewhere may also have rights under local law, including the EU GDPR or Brazil’s LGPD; contact us for the rights and authority relevant to your location.
Children
TripCompanion isn’t meant for children under 13, and we don’t knowingly collect their data.
Changes
If this policy changes in a way that affects what is collected or who receives it, we will say so in the app before it takes effect, rather than quietly changing the date at the top.