Privacy Policy
Last updated 1 October 2026.
triiip is a trip planner for iPhone. It holds the plans you put into it, and as little else as it can. This page says exactly what that is, where it goes, and how to make it go away. "We" is triiip, the developer of the app; you can reach us at [email protected].
What we store, and why
- Your account. Your name and your email address. They come from whichever way you signed in: Sign in with Apple, Google, or a code we emailed you. The name is what the people you travel with see on a shared trip; the address is how you get back in.
- How you signed in. A Sign in with Apple or Google account carries an identifier that lets that same account sign in again. We keep that identifier on our server and never show it in the app or hand it to anyone. If you sign in with Google, we also keep the web address of your Google profile picture so the app can show it (see "Your picture" below).
- Sign in codes. When you sign in by email, we send a six digit code and keep only a scrambled (hashed) copy of it for ten minutes, so we can check what you type. The code itself is not stored.
- Your trips. Names, dates and destinations, the days and stops you plan, expenses and how they are split, who else is on the trip and what they are allowed to do, and the trip's cover photo if you chose one.
- Files you attach. Boarding passes, bookings, insurance and anything else you add to a trip's documents, with the title and category you gave them.
- Your packing list. Kept on our server so it follows you between devices, but private to you even on a shared trip. Nobody else on the trip is ever sent it.
- Requests to join a trip. When you ask to join with a join code, the trip's owner sees your name and when you asked.
- How the app is used. Which screens you open and which buttons you press, with the app's version and whether you are on Pro, so we can see where the app loses people and fix it. This includes recordings of the app's own screens during a session. Whatever you type is hidden in them; the rest of the screen is recorded as you saw it, so a recording can show the names of your trips and places. Your documents are hidden too: neither a file you open nor its name appears in a recording. Before you sign in this is anonymous. After, it is tied to your account's identifier, not to your name or email address.
- Your answers to the first-run questions (who you travel with, how you travel, what you find hard), the way you signed in, and the guide your first trip was made from, if there was one. They are kept with the usage data above.
- Whether an ad brought you here. If you installed the app after tapping one of our ads in the App Store, Apple tells our server which campaign and search keyword it was, and we keep that with your account. This is Apple's own attribution: the app does not use your phone's advertising identifier and never asks to track you.
What stays on your phone
- Your picture. A profile photo you pick from your library is saved on your phone and only there. It is never uploaded. If you signed in with Google and have not picked one, the app fetches your Google profile picture once, from Google, and keeps that copy on the phone too.
- Your location. If you allow it, the app shows where you are on the trip map. Your position is used on the device to draw that dot and is not sent to our servers or stored.
- Saved spots and the currencies you keep in the converter are stored on the device.
What we do not do
- We do not sell your data, and we do not share it for advertising.
- We do not track you across other apps or websites.
- The analytics described above are for us alone. No advertising network's code is in the app, and it does not use your phone's advertising identifier.
- We do not read your attachments or use your trips to train anything.
Who else can see a trip
Only the people you invite. A trip has a join code; someone who enters it sends a request, and the trip's owner decides. Members see the plan, the expenses, the documents and each other's names. The owner can change what each person may do (edit or only view) and can remove anyone from the trip's settings, and anyone can leave. Your packing list is never shown to another member.
Services we use
Each of these receives only what it needs to do its job. None of them gets your account details unless it says so here.
- Sign in with Apple (Apple). If you choose to hide your email, Apple gives us a relay address instead of your real one, and that is what we store.
- Google Sign-In (Google). Google tells us your name, your verified email address and the address of your profile picture. Google's own privacy policy covers what Google keeps about the sign in.
- Mailgun (Sinch), on servers in the EU, delivers the sign in code email. It receives your email address and the code, and keeps delivery logs for a short time under its own policy.
- OpenAI builds the day-by-day plan when you ask the planner to. Our server sends it the destination, the dates, who you are travelling with, your pace and your interests, and nothing that identifies you.
- Mapbox draws the trip map. Your phone requests map tiles from Mapbox directly, so Mapbox sees your IP address and which parts of the map you look at. The Mapbox SDK may also collect anonymised usage data under Mapbox's privacy policy.
- Apple Maps answers place searches and directions. What you type in the search box goes to Apple under Apple's policy.
- Open Exchange Rates API (open.er-api.com) supplies the currency converter's rates. It receives only the request; no amounts and nothing about you.
- Railway hosts our server and the database that holds accounts, trips and packing lists.
- Hetzner, in Helsinki, Finland, stores attached files and cover photos. Files are private and are served over links that expire after an hour.
- PostHog, on servers in the United States, holds the usage data and the screen recordings described above. It also sees your IP address and the rough place it points to, your phone's model and its version of iOS.
- Amplitude counts visits to this website, and only the website, not the app: which page was opened and when, the kind of device and browser, your IP address and the rough place it points to, the page that linked here, and whether the App Store button was pressed. It keeps a random identifier in a cookie so that a second visit is not counted as a second person. It knows nothing about your account or your trips.
Where it lives, and for how long
Everything is on your phone first, so the app works without a signal, and is copied to our servers so a trip can be shared and restored. We keep it as long as you keep it: deleting a trip removes it from our servers for everyone on it, along with its files. Sign in codes are gone after ten minutes. Attachments and covers are deleted from storage when the document or trip that owned them is.
Getting rid of it
Delete a trip and everything in it goes, for everyone on it. Delete your account from Settings and the app removes everything it holds on the phone and signs you out. To have your account and its trips removed from our servers as well, write to [email protected] from the address on the account; we do it within 30 days and confirm. The usage data and recordings tied to the account go with it.
You can also ask us for a copy of what we hold about you, or to correct it, at the same address.
Security
Traffic between the app and our servers is encrypted. Sign in identifiers and codes are stored so that a copy of the database does not give them away. Files are served over private, expiring links. No system is perfect; if we learn of a breach that affects you, we will tell you.
Children
triiip is not aimed at children under 16, and we do not knowingly collect their data. If you believe a child has made an account, tell us and we will remove it.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data, to object to how it is used, or to complain to a data protection authority. Everything above is how we honour that; the address for all of it is [email protected].
Changes
If this policy changes in a way that matters, the app will say so before the change takes effect, and the date at the top of this page will move.