Legal

Your account

• Your name, email address and profile picture link, from the sign-in provider you use (Google, Microsoft or Apple) or the email you give for a sign-in link.
• Which sign-in methods are linked to your account, and the sign-in tokens those providers return.
• Your role, whether your account is approved, and any invitation sent to your email address.
• Settings you choose: distance unit, notification preferences, a home place, and an optional travel profile (where you like to stay, what you like to eat and do, and price bands) that the AI plans around.
• Signed-in sessions, each with the IP address and browser (user agent) it was created from.

Your trips

• Trip details: names, dates, places, travellers (the names you enter, and their own start places if you add them), currencies, costs, payments between travellers and who paid for what.
• Plan items: journeys, stays and activities, with times, addresses, carriers, seat and service numbers, booking references, booking links, prices, notes and routes.
• Files you upload (tickets, booking confirmations and other documents) and a trip's cover photo.
• Ideas you save for one day (what, where, a description, links, a rough cost, your photos): yours alone unless you let friends see one (or tag them on it).
• Journal entries and their photos, videos, PDFs and GPX route files (with a video's length and a still from it, and a route's points), checklists, and saved links and videos.
• Who each trip is shared with and their role; secret links for a shared journal or calendar subscription, if you create them.

Other records

• Devices you turn notifications on for: the browser's push address and keys, and the browser name so you can tell devices apart.
• Each in-app AI request: which feature, model, how much it used and what it cost (for allowances), and for longer AI runs, the request and its working, kept for 30 days.
• AI assistants you connect (Claude, ChatGPT, Gemini…): the connection, what you approved, and its access tokens.
• Short-lived counters and cached lookups (rate limits, routes, places, weather, exchange rates), some keyed to your account, to keep the service fast and within its limits.
• Server logs of errors and requests, kept by our hosting provider.

We do not use advertising, tracking or analytics cookies, and we don't sell your data.

• To provide Tripella to you — your account, your trips and the features you use (performing our contract with you).
• To keep it secure and working — approving accounts, preventing abuse, rate limits, error logs (our legitimate interests).
• To send what you ask for — sign-in links, invitations, itineraries you email, and notifications you turn on.
• To meet legal obligations, where they apply.

[Lawyer to confirm the lawful bases and whether any processing needs consent.]

We use these services to run Tripella. Each receives only what its job needs:

• Hosting and database — [currently Vercel (hosting) and Neon (database); regions to confirm]. All the data above is stored or passes through them.
• File storage — Vercel Blob: documents, cover photos, and journal photos, videos, PDFs and GPX route files. Kept private (opened only through Tripella, for people allowed to see them) and deleted with what they belong to.
• Sign-in — Google, Microsoft or Apple, when you choose to sign in with them. They tell us your name, email and profile picture.
• Anthropic (Claude) — when you use an AI feature, the details it needs are sent to Anthropic: the trip, plan items and places concerned, dates, number of travellers, your travel profile, your request, and your location for Near me suggestions. Some features let the AI search the web. [Confirm Anthropic's data retention and no-training terms for the API plan used.]
• Maps, places and routes — Geoapify and Mapbox (with OpenStreetMap services — Nominatim, OSRM and Overpass — as a fallback): place names and addresses you search for, the coordinates of places and routes in your trips, and your location when you use Near me. The map itself is loaded by your browser straight from Mapbox (or OpenStreetMap or Esri map tiles), so they also see your IP address; Mapbox's map also sends Mapbox usage events.
• Weather — Open-Meteo: the coordinates and dates of places in your trips.
• Exchange rates — Frankfurter and ExchangeRate-API: currency codes only, no personal data.
• Cover photos — Wikipedia: the place names or themes looked up for a trip's cover.
• Link previews — when you save a link, our server fetches that page (or asks YouTube, Vimeo, TikTok, Spotify, X or Reddit for its preview) to get its title and picture.
• Email — Resend sends our emails: the recipient's address and the email's contents, including any itinerary and tickets you choose to attach.
• Notifications — your browser's push service (Google, Mozilla, Microsoft or Apple) delivers notifications; their contents are encrypted so the push service can't read them.

Some of these are outside the UK and the European Economic Area (for example in the United States). [Lawyer to confirm the transfer safeguards for each.]

• People you share a trip with see it according to their role. A guest sees the plan without prices or tickets.
• If a trip's owner lets friends follow it, friends of anyone travelling on it (with a Tripella account linked to the trip) see its name, dates, cover and which of their friends are going, and can follow it: they then see the plan and journal without prices or tickets.
• Anyone with a shared journal link sees that journal (entries and photos), and anyone with a calendar subscription link sees those trips' times and places, until you turn the link off or reset it.
• A journal post is seen by the audience you choose for it: only you, the trip, your friends too, or anyone using Tripella. With it they see your name and picture, its photos, videos and files, reactions and comments; its places, map, route and GPX route files only once the trip is over (unless you choose to show them sooner).
• If you report a post or comment, we keep what was reported, why, and who reported it, for our administrators to look at; the person isn't told who reported it. If you block someone, we keep that so neither of you sees the other's posts and comments.
• If you connect your own AI assistant, it can read and change your trips with the access you approved, and what it reads is handled by that assistant's provider under their own privacy policy. Disconnect it any time in Settings → AI.
• "Plan with your own AI" opens Claude, ChatGPT or Gemini with a prompt containing your trip's details, which you then choose whether to send.
• Tripella's administrators can see the list of users, their sign-in methods, trip counts, last activity and AI usage.

• Sign-in cookie — keeps you signed in for up to 30 days. It is essential for the service, so we don't ask for consent for it.
• Browser storage — remembers display choices on your device, such as the map style, distance unit, folded sections and AI runs in progress. It stays on your device.

There are no advertising or analytics cookies. [Lawyer to confirm whether Mapbox's usage events need mentioning in a cookie notice.]

• Your account and trips: until you delete them, or ask us to delete your account.
• Sign-in sessions: 30 days. Email sign-in links: 15 minutes, and they work once.
• Longer AI runs (request and working): 30 days. Records of reminders already sent: 30 days.
• Cached lookups: up to 90 days. Rate-limit counters: up to two days.
• AI usage records (feature, model, amount, cost): [retention period to decide].
• Database backups and server logs, kept by our providers: [periods to confirm].

• Download your data — "Back up all trips" in the trips menu downloads your trips as a file; each trip can also be exported with its attachments.
• Correct it — edit your trips and settings in the app; your name and picture come from your sign-in provider.
• Delete it — delete trips in the app. To delete your account, email [privacy contact email]. Trips only you are on are deleted with it; trips shared with others stay with them, without your account.
• Turn things off — notifications, shared links and AI connections can each be turned off in the app.

Depending on where you live, you may also have the right to access, restrict or object to our use of your data, and to complain to a data protection authority — in the UK, the Information Commissioner's Office. [Lawyer to confirm the rights wording and any EU representative.]

Data travels over encrypted connections. Sign-in is through your provider or a one-time email link — Tripella never stores passwords. Access to trips is checked on every request, and pages run under a strict content security policy. No system is perfectly secure; if something goes wrong that affects your data, we will tell you as the law requires.

Accounts are for people aged [minimum age] and over. Trips may list children as travellers by name; only add details you are entitled to share.

We will update this policy when Tripella changes what it does with your data, and change the date above. For significant changes we will tell you in the app or by email.