Privacy Policy
Last updated: October 9, 2026
Privacy Policy
This Privacy Policy explains how Tripist Inc. (“Tripist,” “we,” “us,” or “our”) collects, uses, and shares personal information when you use the Tripist mobile application, our website at tripist.app, and related services (collectively, the “Services”).
Tripist is a travel planning app that helps you create trips, save places, build itineraries, upload travel documents, use travel tools, collaborate with trip members, access optional paid features, and search for and book hotels and flights.
If you have questions, contact us at support@tripist.app.
SUMMARY OF KEY POINTS
We collect information you provide (account, profile, trip content) and limited technical data needed to run the app.
We use service providers such as Supabase, Apple, Google, RevenueCat, Stripe, Nuitée / LiteAPI, Brevo, Sentry, Meta, and (when configured) PostHog, Google Maps/Places, OpenAI, and Expo push services.
Product analytics, when configured, is sent to PostHog. We do not record in-app session replays, so payment screens, passport and travel-document screens, passenger details, and hotel guest details are not captured as recordings.
We do not sell your personal information. The app currently on the App Store does not include on-device Meta measurement, so it does not send those events. An app version that includes it shares conversion events with Meta to measure Facebook and Instagram ads only after the permissions described in this policy. Those events do not include passports, dates of birth, passenger or guest names, email addresses, phone numbers, or payment card details.
You can delete your account in the app under Settings → Account → Delete account. That removes your Tripist account and the files and booking records we store. It does not cancel a reservation, and airlines, hotels, and payment processors may keep records they need for that booking.
For more detail, read the sections below or email support@tripist.app.
TABLE OF CONTENTS
WHAT INFORMATION DO WE COLLECT?
HOW DO WE USE YOUR INFORMATION?
WHEN DO WE SHARE YOUR INFORMATION?
ARTIFICIAL INTELLIGENCE FEATURES
SIGN IN WITH APPLE AND GOOGLE
SUBSCRIPTIONS AND PAYMENTS
PUSH NOTIFICATIONS
HOW LONG DO WE KEEP INFORMATION?
HOW DO WE KEEP INFORMATION SAFE?
CHILDREN
YOUR PRIVACY RIGHTS
UNITED STATES RESIDENTS
INTERNATIONAL TRANSFERS
TRAVEL DOCUMENTS YOU UPLOAD
TRAVEL INFORMATION ACCURACY
CHANGES TO THIS POLICY
CONTACT US
1. WHAT INFORMATION DO WE COLLECT?
Information you provide
Account and profile: email address, password (stored by our authentication provider), display name, username, profile photo, and preferences you set in the app.
Trip and app content: trip names, dates, destinations, saved places, itineraries, budgets, packing lists, notes, and similar data you enter or generate in the app.
Hotel bookings: when you book a hotel, we collect and store guest first and last name, guest email, phone number if provided, hotel and stay dates, booking amount and currency, booking status, confirmation and reference numbers, and check-in instructions when they are provided.
Flight bookings: when you book a flight, we collect the passenger and contact details needed to make the reservation, including name, email, phone number, date of birth, nationality, and gender. A booking can include adults, children, and infants as travelers. That does not create a Tripist account for a child. Where a booking requires a travel document, we also collect the passport number, issuing country, and expiry and send them to the booking provider with the reservation. We store passenger names, nationality, contact details, the itinerary, selected seats, baggage and other extras, booking references, amounts, status, and cancellation or refund information. We do not store the passport number, document expiry, or date of birth in our booking record. Booking confirmation emails and PDFs do not include the passport number, document expiry, or date of birth.
Checkout on your device: while you finish a hotel booking, guest name, email, phone, nationality, and a payment client secret may be kept in your device’s secure storage so the checkout can resume if the app is interrupted. Tripist removes that device copy when the booking finishes, when you sign out, when you delete your account, or about 36 hours after it was stored. Flight passenger and passport details used at checkout stay in memory for that checkout only and are not written to device storage.
Travel documents and images: files and photos you upload (for example passports, tickets, or booking confirmations) and images you choose from your photo library for a profile photo or trip cover. With your permission, trip share images you create in the app can be saved to your photo library. Tripist does not use your device camera to take photos in the app today.
Voice input: if you use the translator’s voice feature, audio you record is sent to Google Cloud speech services to provide transcription and spoken translation. We do not keep voice recordings after the request is processed.
Support and feedback: information you send when you contact support or submit feedback.
Information collected automatically
Device and app data: device type, operating system, app version, general diagnostic and usage information, and IP address processed by our servers or providers for security and operations.
Crash and error data: crash reports and technical logs sent to Sentry when crash reporting is enabled.
Product analytics: if enabled in a given build, event data such as feature usage may be sent to PostHog. Advertising measurement is separate and is described with the Meta sharing below. We do not record session replays.
Session replays: Tripist does not record session replays. Card information, passport numbers, dates of birth, and email or phone fields are not sent through session replay. Product analytics events also exclude those values.
Information from third-party services you use in the app
Maps and places: when you search for places, view maps, or request routes, we send requests (such as search text, place IDs, and map coordinates tied to your trip) to Google Maps Platform. We do not continuously track your GPS location in the background. Map-related data may be cached on your device to improve performance.
Sign in providers: if you use Sign in with Apple or Google sign-in, we receive information from that provider (such as email and name) as allowed by your choices and their policies.
Payments: subscription status is handled through RevenueCat and the Apple App Store (and Google Play on Android). Hotel and flight card payments are processed through Stripe using payment infrastructure provided through Nuitée. Tripist receives payment transaction and status information for those bookings. Tripist does not store the full card number or CVC.
2. HOW DO WE USE YOUR INFORMATION?
We use personal information to:
Create and manage your account and profile.
Provide trip planning features, collaboration with trip members you invite, travel tools, and optional paid features.
Process subscriptions and restore purchases through the app stores and RevenueCat, and determine whether an account is Free, Pro, trialing, or manually entitled so we can provide subscription features and the applicable hotel and flight prices.
Search for and complete hotel and flight reservations you request, confirm those reservations, provide the related travel services, and manage changes, cancellations, and refunds.
Send booking-related messages, such as a confirmation, a cancellation, or a material update, and send push notifications you enable (for example trip or account-related alerts).
Provide customer support when you contact us about a booking or the Services.
Operate AI-assisted features such as itinerary suggestions when you choose to use them.
Maintain security, prevent abuse, troubleshoot problems, and improve reliability.
Comply with law and enforce our terms.
Measure Tripist ads on Facebook and Instagram, in app versions that include that measurement, as described in the Meta section below.
We process information only for these purposes or with your consent where required.
Where European or UK data-protection law applies, we use these reasons: providing the account, trip tools, and bookings you request; our interest in keeping the service secure and understanding which product features are used, limited to the product analytics described in this policy; a legal duty to keep certain booking or payment records; your consent when you turn on optional device access such as location, notifications, or the microphone; and, for advertising measurement, the permissions described in the advertising section below. Where the device region is in the European Economic Area or the United Kingdom, that includes a separate Tripist choice. On iOS it also includes the Apple app-tracking prompt. Those choices are only about the advertising measurement described below. They are not a choice about your account, your bookings, or the other uses in this policy.
3. WHEN DO WE SHARE YOUR INFORMATION?
We share personal information with service providers that help us run the Services, including:
Supabase — authentication, database, storage, and server functions.
Sign in with Apple and Google Sign-In — account sign-in on supported platforms.
RevenueCat and Apple App Store / Google Play — subscription purchase, renewal, and entitlement status.
Sentry — crash and error monitoring (when enabled).
PostHog — product analytics only, when analytics keys are configured for that build. Session replay is not used.
Meta — advertising measurement for Facebook and Instagram. RevenueCat is already connected to Meta dataset 1328442953691575 for subscription events. The app currently on the App Store does not include the on-device measurement, so it does not send advertising events or attribution identifiers. Older installed versions do not include that measurement either. Tripist does not offer sign-in with Facebook. Meta privacy information is at https://www.facebook.com/privacy/policy/
Expo push notification services — delivering notifications you opt into.
Google Maps Platform — place search, maps, directions, and related place data.
Google Cloud translation and speech services — text translation and voice features in the translator.
OpenAI and related AI infrastructure — processing prompts and trip-related inputs when you use AI itinerary or similar features.
Exchange rate and other APIs — for features such as currency conversion.
Nuitée / LiteAPI — hotel and flight search, reservation, and booking management. Required booking details are shared so the reservation can be fulfilled. We do not sell traveler personal information to Nuitée or to airlines, hotels, or other travel suppliers.
Airlines, hotels, and other travel suppliers — the passenger, guest, itinerary, and booking details they need to provide the reserved service.
The booked hotel or property — guest and stay details needed to fulfill the reservation.
Stripe — hotel and flight card payment processing, using payment infrastructure provided through Nuitée, including payment status and refunds where a refund applies. Tripist does not store the full card number or CVC.
Brevo — delivery of booking-related transactional email. This can include the recipient email address, the recipient or booking name where it appears in the message, the booking information included in the message, and delivery metadata. These messages do not include the full passport number.
These providers process data on our instructions and under their own privacy terms where applicable.
We may also share information:
With other trip members you collaborate with (for example trip name, itinerary, and content you add to a shared trip). Documents you upload, including passports and visas, are private to the account that uploaded them. Other people on the trip cannot open those files.
If required by law, legal process, or to protect rights and safety.
In connection with a merger, acquisition, or sale of assets, with notice where required by law.
We do not sell your personal information.
Advertising measurement
RevenueCat is already connected to Meta dataset 1328442953691575 so subscription events can be passed to Meta. The app currently on the App Store does not include the on-device Meta software kit, so it does not send advertising events or attribution identifiers. In an app version that includes that kit, Tripist uses it on the device for the events below, and can give RevenueCat the attribution identifiers described below. The purpose is to measure how Tripist ads perform, see which ads lead to an install or a purchase, attribute those results, and improve those campaigns.
What those app versions can send:
App activation, including the first open and later returns to the app.
Completed account registration, and completed onboarding. These events do not include your email address or phone number.
Trip creation, with a trip identifier only. The trip name and destination text are not included.
A hotel search or a flight search, marked only as hotel or flight. The words you type, place names, and travel dates are not included.
A hotel or flight offer view, marked as hotel or flight, with an offer identifier when one is available. The hotel name and the flight description are not included.
The start of hotel or flight checkout, marked as hotel or flight, with the amount and currency when they are already known.
A confirmed hotel booking or flight booking, with the amount you paid, the currency, and a booking identifier. This is sent after the booking is confirmed. Starting payment is not treated as a completed booking.
Attribution identifiers are shared only from an app version that includes this measurement, and only after the permissions in this section are satisfied. When that happens on iOS, Tripist can share these identifiers with RevenueCat so Meta can match a later subscription event: the iOS advertising identifier, the iOS vendor identifier, an IP address collected for attribution, the Meta app-scoped anonymous identifier, and the fact that tracking was allowed.
These advertising events are not used to send passport numbers, passport images, other travel documents, dates of birth, passenger or guest names, account names, email addresses, phone numbers, payment card numbers, card security codes, payment secrets, passwords, or sign-in tokens.
Where the device region is in the European Economic Area or the United Kingdom, Tripist asks for a separate choice before any advertising event is sent. Allow and Do not allow are both available. The rest of the app stays usable while you decide, and the choice is not shown over checkout or the subscription screen. You can change that choice later in Tripist Settings, under Ad measurement. The Apple app-tracking prompt is not that choice. If you do not allow the Tripist choice, Tripist does not initialize Meta measurement, does not send the events, and does not store the Meta anonymous identifier with RevenueCat.
On iOS, after any required Tripist choice is allowed, Tripist still asks with the Apple app-tracking prompt before it sends the events or reads the advertising identifier. If you allow that prompt, the attribution identifiers above can be shared. If you do not allow the Apple prompt, Tripist does not send the events, does not read the advertising identifier, and removes the Meta anonymous identifier from the RevenueCat profile. You can change the Apple setting later on an iPhone or iPad in Settings, under Privacy & Security, then Tracking. The app reads that setting again the next time it opens.
If the device does not report a region, Tripist does not show the extra choice. On iOS it still uses the Apple app-tracking prompt before anything is sent.
Outside the European Economic Area and the United Kingdom, Tripist does not show that extra choice. On iOS it still uses the Apple app-tracking prompt before anything is sent. On Android, outside those regions, the app can send the conversion events and store the Meta app-scoped anonymous identifier with RevenueCat. It does not read the Android advertising identifier.
On Android inside the European Economic Area or the United Kingdom, the same events and the Meta app-scoped anonymous identifier are sent only after you allow the Tripist choice. The Android advertising identifier is still not read.
Neither choice decides how Tripist handles your account, your bookings, or the other processing in this policy.
The app does not send a Tripist Pro purchase to Meta as a separate purchase event. RevenueCat is already connected to Meta dataset 1328442953691575. Through that connection RevenueCat can send a subscription start, a renewal, and the related subscription revenue to Meta. RevenueCat does not send the full payment card number for that purpose. The published App Store app does not provide the attribution identifiers that connection uses, so subscription measurement from that published app has not gone live. In an app version that includes the measurement, Tripist provides those identifiers only after the permissions above. On iOS, Tripist tells RevenueCat whether tracking was allowed, and those subscription events are sent only when it was allowed.
Meta processes this information under its own terms. Tripist does not control whether Meta later matches an event to an ad, or how long Meta keeps a copy it has already received.
4. ARTIFICIAL INTELLIGENCE FEATURES
Tripist may offer AI-assisted itinerary planning and related features. When you use these features, trip details, destinations, preferences, and prompts you provide may be sent to our servers and to AI service providers (such as OpenAI) to generate suggestions.
AI output may be incomplete or inaccurate. You should verify important travel details with official sources before relying on them.
You can avoid AI features by not using them. Contact support@tripist.app with privacy questions about AI processing.
5. SIGN IN WITH APPLE AND GOOGLE
On supported devices you may sign in with Apple or Google instead of email and password.
We receive information from the provider you choose (such as email address and name) according to your settings with that provider. We use it only to authenticate you and maintain your Tripist account.
Tripist does not offer sign-in through Facebook, X (Twitter), or other social networks in the app today.
Review Apple’s and Google’s privacy policies for how they handle your data when you use their sign-in services.
6. SUBSCRIPTIONS AND PAYMENTS
Tripist Pro and other paid features are sold through in-app purchases processed by the Apple App Store or Google Play and managed with RevenueCat.
Tripist does not collect or store your full payment card number or CVC. Purchase and subscription records are handled by the app store and RevenueCat. See their privacy policies for payment data:
We process subscription and entitlement information, including whether an account is Free, Pro, trialing, or manually entitled, to provide subscription features and the applicable hotel and flight prices.
Hotel and flight reservations are separate from Tripist Pro. When you book a hotel or a flight, card payments are processed through Stripe using payment infrastructure provided through Nuitée. Tripist receives payment transaction and status information, and refund status where a refund applies. Tripist does not store the full card number or CVC. See Stripe’s privacy policy for payment processing:
A Tripist Pro purchase is not sent to Meta from the app itself. RevenueCat is already connected to Meta dataset 1328442953691575 and can send a subscription start, a renewal, and the related subscription revenue. That does not include the full payment card number. The app currently on the App Store does not provide the attribution identifiers that connection uses, so that measurement has not gone live in the published app. In an app version that includes the measurement, those identifiers are provided only after the permissions in the advertising section, and on iOS only if app tracking is also allowed.
7. PUSH NOTIFICATIONS
If you turn on notifications, we register a device push token with our notification provider so we can send alerts about your account or trips. You can turn notifications off in your device settings or in the app where available.
We do not use push notifications for third-party advertising.
8. HOW LONG DO WE KEEP INFORMATION?
We keep account and trip information while your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.
Travel documents you upload, such as a passport, visa, or ticket, stay in your account until you delete that file or delete your account. Tripist does not automatically delete those files after a fixed number of days, because you may have saved them for a later trip.
Passport numbers, document expiry dates, and dates of birth entered for a flight are sent to the booking provider when the reservation requires them. They are not kept in the booking record Tripist stores. Passenger names and the rest of the itinerary remain so you can see the booking, and so we can support changes, cancellations, and refunds.
Hotel checkout details kept on your device are removed when that checkout ends, when you sign out, or about 36 hours after they were stored.
When you delete your account through Settings → Account → Delete account, we delete your login and the profile, uploaded documents, and booking records in Tripist’s active systems. Backup copies may remain for a short time. Deleting your account does not cancel a hotel or flight. Airlines, hotels, Nuitée, and the payment processor may keep the information they need to provide the booking, handle payment, prevent fraud, or meet their own legal duties. Tripist cannot erase those copies.
Product analytics and crash reports are minimized as described in this policy. Resetting the app removes the analytics identity on your device. Older events already received by those providers follow their own retention. Advertising events already received by Meta are kept under Meta practices. Tripist does not set that retention period, and deleting your Tripist account does not erase a copy Meta has already received.
9. HOW DO WE KEEP INFORMATION SAFE?
We use technical and organizational measures designed to protect personal information. Connections to our servers use encryption in transit. Uploaded documents are stored in a private bucket. Only the account that uploaded a file can read or delete it, and download links expire quickly. We rely on our infrastructure provider’s access controls and storage protections. The app does not add a second encryption layer on those files, because doing so would require a separate key-recovery design and could make files you already uploaded unreadable.
Crash reports and product analytics are filtered so passport numbers, dates of birth, document details, and payment secrets are not included. Tripist does not record in-app session replays.
No method of transmission or storage is completely secure. Use the Services in a secure environment and keep your login credentials private.
10. CHILDREN
Tripist accounts are not directed to children under 18, and we do not knowingly let a child under 18 create an account. If you believe a child has created an account, contact support@tripist.app and we will take steps to delete it.
A hotel or flight booking can still include a child or an infant as a traveler. For that traveler we collect the details the airline or hotel requires, such as name and date of birth, and a passport when the airline requires one. Those details are used to make the reservation. They do not create a Tripist account for the child. They are not included in advertising events sent to Meta.
11. YOUR PRIVACY RIGHTS
Depending on where you live, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing.
In the app you can update profile information in Settings → Account. You can delete your account in Settings → Account → Delete account.
You may also contact support@tripist.app to exercise your rights. We may need to verify your identity before responding.
Deleting your Tripist account removes the information we store, as described above. It does not erase copies an airline, hotel, booking provider, or payment processor must keep, and it does not cancel an existing reservation.
Privacy requests go to support@tripist.app. This policy does not name a separate European or UK representative address.
12. UNITED STATES RESIDENTS
If you live in a U.S. state with a consumer privacy law (such as California, Colorado, or Virginia), you may have additional rights, including the right to know what personal information we collect, to delete it, and to opt out of certain processing.
Tripist does not sell personal information. In an app version that includes Meta measurement, sharing conversion events and advertising identifiers with Meta to measure our own ads can be “sharing” for cross-context behavioral advertising under California law. Declining the Tripist advertising choice, where that choice is shown, stops that sharing. On iOS, declining the Apple tracking prompt also stops it. On Android, the measurement does not read the advertising identifier. Outside the European Economic Area and the United Kingdom, Android can still send conversion events with an app-scoped identifier. Inside those regions, Android sends them only after the Tripist choice is allowed. To make a request, email support@tripist.app. We will not discriminate against you for exercising privacy rights.
13. INTERNATIONAL TRANSFERS
Tripist is based in the United States. Your information may be processed in the United States and in other countries where our service providers operate, including Meta when an app version sends advertising measurement there.
If you are in the EEA or the United Kingdom, a transfer of your information outside those places needs a lawful safeguard. Which safeguard applies depends on the contract with each provider. This policy does not name a certification or a specific set of contract clauses. Those details have to be confirmed from the provider agreements before they can be stated here.
14. TRAVEL DOCUMENTS YOU UPLOAD
Documents and images you upload may contain sensitive personal information, such as a passport or other ID. Upload only content you have the right to store.
Only the account that uploaded a document can view or delete it. Other members of a shared trip cannot open those files. You can delete a document in the trip, or delete your account to remove the files we store. We do not automatically delete uploaded documents after a set number of days.
We use uploaded files to provide the document storage feature. They are stored by our storage provider and are not sent to the booking provider as part of a hotel or flight reservation.
15. TRAVEL INFORMATION ACCURACY
Maps, place details, hours, prices, exchange rates, routes, and AI suggestions may come from third parties or automated systems and can be wrong or outdated. Always confirm important plans with official sources.
16. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last revised. Material changes may be communicated in the app or on tripist.app.
17. CONTACT US
Tripist Inc.
2604 Whittier PL
Wilmington, DE 19808
United States
Email: support@tripist.app
Website: https://tripist.app/privacy