Privacy Policy

Account info. Your email and, if you set one, a display name and profile photo. If you sign in with Google, we receive your name, email, and profile photo from Google. If you sign in with Apple (on iPhone), we receive the email Apple gives us (your own, or a private relay address if you chose Hide My Email) and, the first time only, your name if you choose to share it; if you don’t, we ask what your group should call you. When you delete your account, you confirm with Apple once more and we use that to disconnect Tripslate from your Apple ID; we don’t keep any Apple token. You can also try Tripslate as an anonymous guest (e.g. via a shared demo link). That creates no personal record beyond a randomly generated guest name. Each guest gets their own sample trip with made-up friends: no other visitor sees what you vote, add or write there.

Trip content. Everything you and your group add to plan a trip: group and trip names, travel dates, destination votes, itinerary items, accommodation options, expenses and who paid what, group chat messages, and travel-buddy direct messages. Anything you post inside a shared group is visible to the other members of that group. That’s how the app works, not a privacy leak.

Organizers. Each group has an owner (whoever created it) and can have other organizers, whom an organizer chooses. Everyone in the group can see who the organizers are. Organizers can see who hasn’t said whether they’re coming, and can remove people from the group. In a corporate offsite, every organizer (not only the creator) can see what attendees submit on the intake form, including dietary, accessibility and room preferences and where they travel from, and can see the budget and approvals. Organizers also see those answers added up as totals, and can share a summary of the totals (with no names) with a venue or caterer themselves; Tripslate sends it nowhere. When someone is removed, what they already added to the trip stays with it. If an owner deletes their account, each group they own passes to the organizer who joined it first, who is told.

Surprise guests. For a surprise trip, organizers can add the guest of honour by name without inviting them, and they or a helper the organizers choose can note that person’s flight, where they’re staying and other notes. That person isn’t on Tripslate and nothing is sent to them. Only members of the group see these details, and they’re deleted with the trip, or moved to the person’s own account if they join the group and an organizer links them.

Travel preferences. If you fill out your preference profile (travel style, climate, budget, pace, comfort levels, dietary restrictions), we use it to compute destination match scores for your groups. In a group with four or more travelers, the group also sees totals on Activities and Services (for example, how many are into food, or prefer a balanced pace and a mid-range budget), never who chose what; in smaller groups these totals aren’t shown.

Accessibility, dietary and family details. You can choose to tell Tripslate about access needs (for example step-free access), dietary needs, the times of day you prefer, and any children you are bringing. All of it is optional. We use it to suggest places and activities that work for your group. Your access and dietary details are private to you: other people in a group of four or more see only anonymous totals (for example “1 traveler needs step-free access”), and see your name next to your details only if you turn on “Tell my group”. Details about children you are bringing are shown to your group, because you enter them where everyone can see. You can change or clear any of it at any time, and it is deleted with your account. If you use the AI Assistant, it is given only the anonymous totals, never names. Please do not enter medical information we do not ask for: a short note about what to plan around is enough.

Must-dos. You can add up to three short things you would be sad to miss on a trip (for example “a proper beach day”). They are optional and private to you: other members never see the words you wrote. When Tripslate suggests activities for a trip, it turns each must-do into kinds of activities and shows your group only anonymous totals (for example “covers a must-do for 2”), and only in groups of four or more. To do the matching, the text of your must-dos may be sent to the AI service we use, as an unnamed list with nothing that says who wrote it. You can change or clear them at any time, and they are deleted with your account.

Activity and booking links. Tripslate suggests tours and activities from partner booking sites (currently Viator). When you open one, the link goes through Tripslate first so we can record that you opened it: which trip, which activity and provider, and when. The partner link carries a random tag that lets the partner tell us which opened link led to a booking, so we can match the commission we earn. Nothing about your preferences or the rest of your group is added to the link. After that you are on the partner’s site, which has its own privacy policy and may set its own cookies. You can see only your own recorded clicks, and they are deleted with your account.

GetYourGuide links. Next to suggested activities there is a link to more tours for your destination on GetYourGuide. It goes straight to GetYourGuide carrying only our partner id and which app it came from (web or iPhone), so GetYourGuide can credit us if you book. We don’t record that click and send GetYourGuide nothing about you or your group; once there, GetYourGuide’s privacy policy and cookies apply.

Venue search for corporate offsites. Organizers of a corporate offsite can search venue partners for event and meeting spaces. A search sends the partner only the destination, the trip dates, the expected headcount, the room setup (for example theater or banquet) and the budget, never names or anything attendees told us. Results are kept with the trip for a day so a repeat search is quick. Venues added to the shortlist are kept with the trip and deleted with it. A request for a quote or a booking happens on the partner’s site, under its own privacy policy. No venue partner is connected yet; the list of providers below will name each one when it is.

Suggestions for your group. To suggest activities, and to suggest alternatives when a plan falls through, Tripslate looks at the group’s preferences together. Any access, dietary or family needs are applied as filters on our side and are never sent on. When we ask our AI provider to put the best options in order and explain them, it receives only the destination, the candidate activities, and an unnamed list of the group’s interests, pace, budget level and preferred times, with nothing that says who is who. A drafted day-by-day plan is stored so your group can see it, without who asked for it. Saying that a plan changed (for example “rained out”) stores the plan’s name and the suggestions for your group to see, but not who reported it. To warn you about weather during the trip, the destination’s coordinates (never your own location) are sent to Apple WeatherKit, which returns the forecast. When two destinations stay neck and neck, Tripslate may suggest a third that could suit both sides: on our side, it compares the travel preferences of the people backing each one, and the group sees only the suggested place, never who backs what. Nothing is sent to an AI service for this.

Trip budgets. You can add what you plan to spend on a trip. Everyone in the group can see each traveler’s budget and the total, like the expenses you already share. You can change or clear your own at any time, and your budgets are deleted with your account. Your private budget tier in your travel preferences is separate and is never shown to the group.

Booked activities. You can record a tour or activity your group booked: its name, date, start time, where to meet, how many people, and the confirmation code. Everyone in the group can see these details, including the confirmation code, like the flights and stays you add. Only the person who added a booking can change or remove it. Tripslate does not learn about bookings from the partner: what is recorded is only what a member types in. Your bookings are deleted with your account.

Calendar availability. To help your group find dates that work, you can choose to share which days you are busy for a trip. On iPhone, Tripslate can read your calendar on your device to work this out, after you allow calendar access. Only the list of busy days leaves your phone: never event names, times, places, attendees or which calendar they are on, and you can review and remove days before sharing. Other members see only how many people are free for a window of dates or for dates someone proposed (counts only when four or more people have shared; below that, only whether everyone who shared is free), never who is busy. You can stop sharing at any time, and your shared days are deleted when the trip’s dates are confirmed, when you stop sharing, or when you delete your account.

Changing trip dates. When a trip’s confirmed dates change, Tripslate records who changed them and the old and new dates, and tells the rest of the group. Before the change, the app checks the trip’s recorded bookings, stays, flights and plans to show what may be affected; nothing is sent to any partner. The record is kept with the trip and deleted with it; if the person who changed the dates deletes their account, their name is removed from it.

Reminders. A member of your group can send you a reminder (for example, that the group is waiting on your vote), and Tripslate can send one automatically when a decision is stalled. If a vote stays neck and neck for two days, the group’s organizers get one reminder that doesn’t say who voted for what. We keep a record that a reminder was sent, to whom, about which trip, and who sent it (or that it was automatic), so no one is reminded more than once a day and so reminders can’t be used to pester. A reminder can carry a message the sender wrote (Tripslate suggests a first draft); that message, and the sender’s name with it, is shown to the person reminded and kept with the trip. A reminder with no message, and every automatic one, doesn’t say who sent it. During a trip, when the forecast threatens an outdoor plan, the first member to open the trip that day triggers one heads-up to the whole group, at most once a day; it says nothing about who opened the app. If you record a booked tour or activity, Tripslate also reminds the whole group the evening before and the morning of, in the destination’s local time, with its date, time and meeting point. You can switch off push reminders, and trip updates such as weather heads-ups and booking reminders, in Settings.

Payment info. If you book a service or settle an expense, payment is handled entirely by Stripe. We never see or store your full card number. We do store the amount, timing, and status of the transaction.

AI Assistant subscription. On the web it is billed by Stripe. In the iPhone and Android apps it is bought through the App Store or Google Play, which take the payment; we never see your Apple ID, Google account or card. To connect the purchase to your Tripslate account, the app shares your Tripslate account id with RevenueCat, which checks purchases with Apple and Google for us. We keep a record of where you subscribed, whether it is active or in a free trial, when the current period ends and whether it will renew, so the add-on unlocks on every device. These records are deleted when you delete your account.

Photos you upload. Profile photos, listing photos (for businesses), destination photos, expense receipts, and photos you add to a group’s album.

Packing lists. Your own packing list is private: only you can see or change it. The group’s packing list, and who said they’ll bring what, is seen by everyone in the group. Suggested items are worked out on our side from the trip’s destination, dates and plans and from whether you have kids coming; nothing is sent to an AI service or anyone else for this. Both lists are deleted with the trip.

Group photo album. Photos you add to a group’s album are resized on your device, then stored with Cloudflare (R2). Only members of that group can see them, through links that stop working after an hour. We keep who added each photo and when, and its size. You can remove your own photos; the group’s organizers can remove any. Removed photos, and the whole album when a group is deleted, are deleted from storage shortly after.

Receipts. When you add a receipt to an expense, you can take a photo with your camera or choose one from your photo library (on the web, through your browser’s file picker). Tripslate only opens the camera or photo library when you tap Add receipt, and only receives the one photo you take or pick. It never reads the rest of your library. The receipt is stored with the expense it belongs to, and the members of that group can see it. It is kept at a link that isn’t listed anywhere, but anyone who has the link can open it, so cover card numbers or anything else you don’t want shared before you take the photo. A receipt can show what you bought, where, and when. If you delete your account, receipts on expenses you shared stay with those expenses in the group. To have a receipt removed, email privacy@tripslatetravel.com.

Itemizing a receipt with AI. If you use the paid add-on’s Itemize button, that one receipt photo is sent to our AI provider, Anthropic, which reads the lines and amounts off it so you can check them. This only happens when you tap Itemize, for the receipt you chose. A receipt can show card digits, names or other details, so cover what you don’t want read. The lines are saved with the expense only after you confirm them, in the currency printed on the receipt, and the group can see them like the receipt itself.

Pasting a booking email. If you use the paid add-on’s Paste a booking email, the text you paste is sent to our AI provider, Anthropic, together with the trip’s name and dates, so it can find the flights, stays and tours it confirms. We don’t store the email and Tripslate never reads your inbox: only what you paste is read. The AI is told not to pick out names, card, passport, phone or loyalty numbers, and anything that looks like a card or passport number is thrown away. Nothing is saved until you tap Add on a booking; then it is saved like one you typed in: your flight (airline, flight number, times, confirmation code, and any connections and return flight in its notes), a stay or a booked activity, which the members of the group can see.

AI Assistant. If you use the paid AI Assistant, the question you type and a summary of the trip are sent to our AI provider, Anthropic, to generate a response. The summary holds what every member of the trip can already see in the app: the destination and dates, members’ names and whether they’re in, the itinerary, where you’re staying (with its confirmation code), members’ flights, booked tours and their meeting points, and expenses with who paid and who owes whom. It never includes anyone’s private preferences, must-dos, dietary, accessibility or family details. This only happens when you actively use the Assistant.

Push notification tokens. If you enable notifications on the mobile app, we store a device token (via Apple/Google’s push services, through Expo) so we can notify you about votes, messages, and expenses. Alerts about what you do in a group (a vote, or saying you’re in or out) name you to the other members by your display name, the same name they already see in the group.

Standard technical logs. Our hosting and database providers automatically log things like IP address and request timestamps for security and reliability, the same as virtually any web service. We don’t run advertising or ad-tracking scripts; the one analytics service we use, PostHog, is described under “Usage events” below.

In-app tips. We record, against your account, whether you’ve seen, dismissed, or skipped each of the short tips that guide you around the app. We use this only to improve those tips. You can turn this off on each device in Settings.

Error reports. When the app hits an unexpected error, it sends us a short technical report: what failed and roughly where, your device type, and the app version, tied to your account if you’re signed in. We remove email addresses and tokens from it first, and use it only to find and fix bugs. It’s deleted if you delete your account.

Feedback. If you send feedback from Settings, we keep your message with your account, along with your device type and the app version, so we can follow up and fix what you reported. It’s deleted if you delete your account.

To run the app: show you your trips, match destinations to your group’s preferences, tally votes, split and settle expenses, process bookings, send the notifications you’ve enabled, and answer questions through the AI Assistant and read receipts when you ask it to, if you use them. We don’t use your data for advertising, and we don’t sell it.

Analytics. To see how Tripslate is doing we count things the app already records (sign-ups, groups, votes, bookings, subscriptions, which AI features are used, partner link clicks), as totals that never name anyone; demo guests are left out. When you open a business’s listing we add one to that listing’s daily view count: only the number, never who viewed it. A business that lists on Tripslate sees totals for its own listings (views, bookings, guests, earnings, cancellations, ratings), never which travelers they were beyond the bookings and reviews it already receives.

Usage events. We also record a few steps the app does not otherwise keep, to see what works: opening the home page, the sign-up page or an invite link, reaching each step of the preference setup, sharing an invite, seeing the AI add-on offer and starting to pay for it. Each is stored in our own database with the step, the time, whether it was the web or the app, and your account if you are signed in; never your name, email, trip details or anything you type. It is deleted with your account.

Product analytics (PostHog). On the website and in the release app, the same steps go to PostHog, our analytics provider, along with the pages and screens you open and a few actions (creating a trip, joining a group, voting, confirming a destination, adding an expense, sending a reminder, asking for packing suggestions). Page addresses are sent without ids, invite codes or anything after a “?”. PostHog also records screen recordings of sessions, with every piece of text, every input field and, in the app, every image hidden, so they show where people tap and get stuck but not what they read or type. PostHog receives your Tripslate account id (a random number) if you are signed in, and whether you are a demo guest; never your name, email, trip details, messages or anything you type. It stores no IP address, keeps events for up to a year and recordings for up to a month, and holds them on servers in the United States. It is not used for advertising or to follow you across other apps or sites. You can switch all of this off in Settings (“Share usage analytics”, per device); email us to have your PostHog data deleted sooner.

We don’t sell personal data or share it with third parties for their own marketing. We do use a small number of service providers to run Tripslate, each only for the purpose below:

• Supabase: our database, authentication, and file storage. Nearly everything described above lives here.
• Cloudflare: stores the photos in group albums (R2). It holds the files only; who can see them is decided by Tripslate.
• Stripe: payment processing for bookings and expense settlement, and the AI Assistant subscription on the web.
• Apple and Google: the App Store and Google Play take payment when you subscribe to the AI Assistant in the iPhone or Android app.
• RevenueCat: receives your Tripslate account id and your App Store or Google Play purchase records, to confirm an in-app subscription.
• Google: only if you choose to sign in with Google.
• PostHog: product analytics and text-hidden screen recordings, as described under “Product analytics” above, unless you switch them off.
• Anthropic: only when you send a message to the AI Assistant, tap Itemize on a receipt, paste a booking email, or ask for activity suggestions or alternatives for your group.
• Apple WeatherKit: during a trip, to check the forecast for your destination. Only the destination’s coordinates and dates are sent, never anything about you.
• Viator: to find tours and activities for your trip. Only the destination, the trip dates and a price limit are sent, never anything about you. If you open a Viator link and book, Viator handles the booking under its own privacy policy.
• GetYourGuide: receives nothing from us directly. If you open a GetYourGuide link, it carries our partner id, and GetYourGuide handles any booking under its own privacy policy.
• Vercel (web) and Expo/EAS (mobile): hosting and app delivery infrastructure.
• Wikipedia, Wikidata and Wikimedia: when a destination is added, we look up the place by its name only, for a public photo (unless one was uploaded), where it is, its elevation and its country (used to fill in its region, climate and time zone); no personal data is sent.

We may also disclose information if required by law, or to investigate fraud or abuse of the service.

We use cookies and browser storage to keep you signed in, and nothing beyond what’s needed to run the app. We don’t use advertising or cross-site tracking cookies. Unless you switch off usage analytics, PostHog keeps a random visitor id and your current session in your browser’s storage (not a cookie), so your page views can be counted as one visit.

If you open a Tripslate invite link, your browser keeps the invite code until you join the group, so it survives signing up or in. So you know what you’re joining, the invite page shows the group’s name, the organizer’s first name and how many people are in it, to anyone who has the link; it never shows who the members are. Link previews in messaging and social apps show only the Tripslate logo, not the group’s name.

We keep your account and trip data for as long as your account is active. Deleting a trip or group removes its content from normal use; some records (like completed payment transactions) may be retained longer where we’re required to for accounting or legal reasons.

You can edit or remove most of your own information (profile, preferences, photos) directly in the app, and delete your account yourself in Settings, on the web or in the app. For anything else (such as asking what data we hold about you, or having something removed you can’t remove yourself), email privacy@tripslatetravel.com and we’ll take care of it.

Emails about your account, such as confirming your address or resetting your password, come from noreply@tripslatetravel.com. Replies to that address aren’t read, so write to support@tripslatetravel.com instead. We never ask for your password, card number or a sign-in code by email; treat any message that does as suspicious.

Tripslate isn’t directed at children, and we don’t knowingly collect data from anyone under 13.

If this changes in a meaningful way, we’ll update the date below and, for significant changes, make a reasonable effort to let you know.

Questions about this policy, or a privacy request of any kind: privacy@tripslatetravel.com. For help with the app or your account, write to support@tripslatetravel.com.