Last updated: March 29, 2026
This Privacy Policy explains how TripKit ("we", "us", "our") collects, uses, stores, and shares your personal data when you use the TripKit web application (tripkit.app). Please read it carefully.
TripKit is operated as a personal / small-team project. For any privacy questions or to exercise your rights, contact us at: nikhil.ha@gmail.com
We collect the following categories of personal data:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of contract (Art. 6(1)(b)) |
| Trip planning features (itinerary, expenses, checklists, chat) | Performance of contract (Art. 6(1)(b)) |
| Live location sharing | Explicit consent (Art. 6(1)(a)) — you initiate it each session |
| Sending push notifications | Consent (Art. 6(1)(a)) — you opt in via browser permission prompt |
| Streak, badges, and gamification | Legitimate interest (Art. 6(1)(f)) — improves engagement and user experience |
| AI-generated features (see Section 5) | Performance of contract / legitimate interest (Art. 6(1)(b)/(f)) |
| IP-derived country/city lookup | Legitimate interest (Art. 6(1)(f)) — aggregate analytics, no precise location |
| End-to-end encryption (generating and storing keypairs, distributing trip keys) | Performance of contract (Art. 6(1)(b)) — necessary to provide the E2EE feature you have opted into |
We use the following third-party services that process your data:
Our database, authentication, file storage, and real-time messaging are provided by Supabase, Inc.. All your account, trip, chat, and file data is stored with Supabase. They act as a data processor under a Data Processing Agreement. For E2EE-enabled trips, Supabase only receives and stores encrypted ciphertext for messages and GPS coordinates — the plaintext is never transmitted to or accessible by Supabase.
If you choose "Continue with Google", your Google account identity and email address are shared with Google and passed to Supabase Auth to create your account. Google's privacy policy applies to the OAuth flow.
When you use AI-powered features — including AI itinerary generation, AI checklist
suggestions, daily story cards, and when you mention @tripkit in the
group chat — your trip data (destination, itinerary summary, member names) and
your chat message are sent to Groq Cloud, Inc. in the United States for processing. Groq does not use this data to train its models.
The data is transferred under Groq's standard contractual commitments. AI features are automatically disabled for E2EE-enabled trips; no trip content from those trips is sent to Groq.
If Groq is unavailable, the same trip and chat data may be sent to Google Gemini (Google LLC, US) as a fallback AI service for the same features described above. This fallback is also disabled for E2EE-enabled trips.
When viewing flight status, your flight number and date are sent to AeroDataBox via RapidAPI to retrieve real-time flight information.
Map tiles are served by OpenStreetMap (your IP address is exposed). Place-name geocoding uses Open-Meteo's free API. Nearby venue searches use the Overpass API. These services receive minimal data (place names or coordinates) and are subject to their own open-data terms.
On first login and once per week thereafter, your IP address is sent server-side to ip-api.com to determine your approximate country and city. This is processed entirely server-side; your browser does not contact ip-api.com directly. ip-api.com's free tier is used and no API key is shared. The result (country name, ISO code, city) is stored on your profile; your raw IP address is never stored by TripKit.
Icon assets are loaded from Cloudflare CDN and jsDelivr CDN. Your IP address and browser information are exposed to these CDNs when loading these assets.
If you enable push notifications, your browser's push subscription endpoint (provided by your browser vendor — e.g. Google FCM for Chrome) is used to deliver notifications. The notification payload is sent from our server to your browser via the W3C Web Push protocol.
Several features in TripKit use AI language models (Groq / Google Gemini):
@tripkit in the group chat, your message and trip context are sent to an AI service. Other trip members can see the AI's replies.What data is sent to AI services: trip title, destination, itinerary summary, member display names, and the triggering chat message. We do not send passport documents, photos, exact GPS coordinates, expense details, or passwords to AI services. AI features are entirely disabled for E2EE-enabled trips — no content from those trips is sent to any AI service. The @tripkit bot will not respond in an E2EE trip chat.
AI responses may occasionally be inaccurate. Do not rely solely on AI for critical travel decisions.
We use strictly necessary authentication cookies set by Supabase
(sb-* cookies). These are required for you to log in and stay logged in.
Because they are strictly necessary for the service to function, they do not require
your consent under the GDPR ePrivacy Directive.
We do not set any tracking, advertising, or analytics cookies.
We store small preference values in your browser's local storage (no expiry, device-local): dark mode preference, display currency, PWA install prompt dismissal, chat read timestamps, and AI hint dismissal. These are not transmitted to our servers and are used solely to remember your in-app preferences.
When you unlock your encryption vault, the decrypted private key is re-encrypted with a
randomly generated session key and stored in your browser's sessionStorage under the keys tripkit_e2ee_skey and tripkit_e2ee_priv. This
allows you to navigate between pages in the same browser tab without re-entering your
vault password. This data is automatically cleared when you close the tab or sign out.
It is never transmitted to our servers.
ai_request_log) are retained for up to 90 days for abuse monitoring and capacity planning, then deleted.last_seen_country/city) is updated weekly and retained for as long as your account exists; it is deleted when you delete your account.Depending on your location, you have the following rights:
Canadian users have rights to access and correct their personal information. Contact us at nikhil.ha@gmail.com to exercise these rights.
We use industry-standard measures to protect your data: HTTPS encryption in transit, Supabase Row Level Security (RLS) policies to restrict data access by user and trip membership, and VAPID-secured Web Push. However, no system is 100% secure. Do not upload highly sensitive identity documents unless you understand and accept the associated risks.
End-to-end encryption (E2EE) — for E2EE-enabled trips, messages and GPS coordinates are encrypted using AES-256-GCM on your device before transmission. Keys are derived using ECDH P-256 and PBKDF2-SHA-256 (600 000 iterations). Your unencrypted private key and plaintext message content are never transmitted to or stored on our servers. Even in the event of a server breach, encrypted content cannot be decrypted without your vault password and private key, which remain on your device.
Profile photos and trip photos are stored in publicly accessible storage buckets. The URLs contain random identifiers, but anyone who obtains a URL can access the file without authentication. Consider this before uploading identifiable photos.
TripKit is not directed at children under 13 years of age (or under 16 in the EU/EEA per GDPR Art. 8). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us to have it removed.
TripKit uses services based in the United States (Supabase, Groq, Google Gemini). Data transfers from the EU/EEA to the US are made under Supabase's DPA, Groq's standard contractual commitments, and Google's EU-US Data Privacy Framework participation.
We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the most recent revision. Continued use of TripKit after changes constitutes acceptance of the updated policy.
In accordance with the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023, the name and contact details of the Grievance Officer are:
Name: Nikhil
Email: nikhil.ha@gmail.com
Address: India
Response time: Grievances will be acknowledged within 48 hours and
resolved within 30 days of receipt.
For any privacy-related questions, data access requests, or to exercise your rights: nikhil.ha@gmail.com