Privacy Policy

Last updated September 15, 2026

What we collect

When you use Trip Tracker, we collect:

• Account info: your name and email address, and your password (stored securely, hashed — we never see it in plain text). If you set up a passkey, your device stores the private key; we only ever see a public credential identifier.
• Trip content: anything you or your trip's members add — trip names and destinations, itinerary items (flights, hotels, reservations, etc.) including confirmation numbers, costs, notes, and addresses, and any comments left on itinerary items. This is visible to everyone else in that trip.
• Push notification subscriptions: if you turn on notifications, your browser gives us an endpoint we use to deliver them. We never see the notification's content once your browser's push service (e.g. Google's or Apple's) delivers it — just the fact that it was sent.
• Basic usage data: if analytics are enabled, which pages you visit and which actions you take (creating a trip, adding an item, etc.), tied to your account so we can understand how the app is actually used.
• Error diagnostics: if error tracking is enabled, technical details about crashes or bugs (e.g. a stack trace), to help us fix them.

Biometric unlock (Face ID/Touch ID/fingerprint) is handled entirely by your own device — we never receive your biometric data at all.

Who we share it with

We don't sell your data, and we don't share it with advertisers. We do rely on a small number of service providers to run the app, each of whom only sees what they need to do their specific job:

• Supabase — hosts our database and handles account authentication. This is where your account and trip data actually live.
• Vercel — hosts the app itself.
• Sentry (if enabled) — receives crash/error diagnostics.
• PostHog — receives basic usage analytics.
• Anthropic, Unsplash, and Pexels (if enabled) — used only to pick a nice cover photo for a trip based on its name and destination text; no account or personal data is sent to them.
• Resend (if enabled) — delivers account emails (confirmation, password reset) in place of our default email sender.

We only ever disclose your information beyond this list if required to comply with the law, or to protect the safety of our users.

How long we keep it

We keep your account and trip data for as long as your account exists. If you leave a trip, your own itinerary items and comments generally remain (since other trip members rely on them) unless you remove them yourself. We don't currently offer automatic self-service account deletion — email us at support@grouptriptracker.com and we'll delete your account and personal data promptly.

Your rights

Regardless of where you live, you can ask us at any time to:

• See what personal information we hold about you
• Correct anything that's inaccurate
• Delete your account and associated personal data
• Export your data in a portable format

If you're a California resident, you have specific rights under the CCPA, including the right to know what personal information is collected and the right to request deletion — we don't sell or share personal information for cross-context behavioral advertising, so there's nothing to opt out of on that front. Contact us at support@grouptriptracker.com to exercise any of these rights.

Children's privacy

Trip Tracker isn't directed at children, and we don't knowingly collect personal information from anyone under 13. If you believe a child has created an account, contact us and we'll remove it.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page. We encourage checking back occasionally.

Contact

Questions about this policy or your data: support@grouptriptracker.com.