Privacy

What you tell us about the trip. The trip name, rough dates, and what each traveler says matters to them — the free-text answer people write on the invite page, plus any options they pick.

How to reach people. An email address or phone number for each person the organizer invites. Shared planning uses email for a personal invitation and, when the organizer authorizes them, two response reminders. Reminders stop after a response or opt-out. Organizers also give an email address to sign in.

Whether invites arrived. Our email provider tells us if a message was delivered, bounced, or marked as spam, so the organizer isn’t left guessing why someone hasn’t replied.

We do not use advertising trackers, we do not build profiles across sites, and we do not sell anything to anyone.

Your individual answers are private by default. Trippal uses your essentials to check your own limits. Other travelers see shared trip facts and participation status. In shared planning, you can explicitly share your essentials with the organizer and revoke that access later. Revoking access prevents future disclosure; it cannot erase information someone already read.

A personal invitation grants access as that traveler. Keep it private: someone you forward it to could act as you. Older group invitation links allow new people to join the trip. Contact us if an invitation is shared by mistake.

We use a small number of services to run Trippal. Each sees only what it needs: Supabase stores trips and answers, Resend sends invites, authorized reminders and sign-in links, Vercel hosts the app, Anthropic processes trip preferences to generate recommendations, Google resolves places and provides Maps and Places imagery, and Upstash stores abuse-control and AI-usage counters when its Redis integration is configured. Google receives place searches and the map or image requests needed to display a place, not private traveler answers.

Outbound booking and search links can open Booking.com, Airbnb, GetYourGuide, Viator, OpenTable, Trainline or Google. These are separate services with their own privacy policies. Links may include the place or item you selected, known travel dates and party size, and an opaque click reference for attribution. We do not put your email, private answers or Trippal trip identifier in affiliate tracking fields. A listed link does not imply a paid affiliate agreement.

When enabled, our server records planning milestones using keyed pseudonyms, such as saving basics, receiving a guest response, choosing a destination and accepting a plan. These records contain no names, emails or private answers. PostHog receives these limited milestone records when configured. Optional error reporting sends fixed error categories and route templates, without error text, page URLs, invitation credentials or request contents. Configured collection services receive only those limited records; we do not run browser analytics or session replay.

Trip data stays until it’s deleted. Sign-in links expire after 15 minutes and work once; sessions expire after 30 days. Delivery records are kept while the trip exists so the organizer can see what happened to each invite.

Before you save to an account, your planning draft is stored in this browser on this device.

Email support@trippal.app from the address you used, and we’ll delete the trip and everything attached to it — answers, contact details, delivery records — within 30 days.

Invited but never signed up? You still don’t need an account to have your answer removed. Write to the same address and say which trip.

Depending on where you live you may also have the right to a copy of your data, to correct it, or to object to how it’s used. Same address — we don’t require a particular form of words.

If this policy changes in a way that affects how existing data is used, we’ll email organizers before it takes effect rather than quietly updating the date at the top.