Last updated: April 16, 2026
This Privacy Policy explains how TripKit ("we", "us", "our") collects, uses, stores, and shares your personal data when you use the TripKit web application (tripkit.app). Please read it carefully.
TripKit is operated as a personal / small-team project. For any privacy questions or to exercise your rights, contact us at: hello@gettripkit.com
We collect the following categories of personal data:
/chat are stored in our database and are publicly visible to everyone, including users who are not signed in. Do not post personal, sensitive, or private information in these channels.| Purpose | Legal Basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of contract (Art. 6(1)(b)) |
| Trip planning features (itinerary, expenses, checklists, chat) | Performance of contract (Art. 6(1)(b)) |
| Live location sharing | Explicit consent (Art. 6(1)(a)) — you initiate it each session |
| Sending push notifications | Consent (Art. 6(1)(a)) — you opt in via browser permission prompt |
| Achievement badges and engagement analytics | Legitimate interest (Art. 6(1)(f)) — improves engagement and user experience |
| AI-generated features (see Section 5) | Performance of contract / legitimate interest (Art. 6(1)(b)/(f)) |
| IP-derived country/city lookup | Legitimate interest (Art. 6(1)(f)) — aggregate analytics, no precise location |
We use the following third-party services that process your data:
Our database, authentication, file storage, and real-time messaging are provided by Supabase, Inc.. All your account, trip, chat, and file data is stored with Supabase. They act as a data processor under a Data Processing Agreement.
If you choose "Continue with Google", your Google account identity and email address are shared with Google and passed to Supabase Auth to create your account. Google's privacy policy applies to the OAuth flow.
When you use AI-powered features — including AI itinerary generation, AI checklist
suggestions, daily story cards, and when you mention @tripkit in the
group chat — your trip data (destination, itinerary summary, member names) and
your chat message are sent to Groq Cloud, Inc. in the United States for processing. Groq does not use this data to train its models.
The data is transferred under Groq's standard contractual commitments.
If Groq is unavailable, the same trip and chat data may be sent to Google Gemini (Google LLC, US) as a fallback AI service for the same features described above.
When viewing flight status, your flight number and date are sent to AeroDataBox via RapidAPI to retrieve real-time flight information.
Map tiles are served by OpenStreetMap (your IP address is exposed). Place-name geocoding uses Open-Meteo's free API. Nearby venue searches use the Overpass API. These services receive minimal data (place names or coordinates) and are subject to their own open-data terms.
On first login and once per week thereafter, your IP address is sent server-side to ip-api.com to determine your approximate country and city. This is processed entirely server-side; your browser does not contact ip-api.com directly. ip-api.com's free tier is used and no API key is shared. The result (country name, ISO code, city) is stored on your profile; your raw IP address is never stored by TripKit.
Icon assets are loaded from Cloudflare CDN and jsDelivr CDN. Your IP address and browser information are exposed to these CDNs when loading these assets.
If you enable push notifications, your browser's push subscription endpoint (provided by your browser vendor — e.g. Google FCM for Chrome) is used to deliver notifications. The notification payload is sent from our server to your browser via the W3C Web Push protocol.
Several features in TripKit use AI language models (Groq / Google Gemini):
@tripkit in the group chat, your message and trip context are sent to an AI service. Other trip members can see the AI's replies./chat are sent to an AI service to generate a structured trip plan. These messages are not stored in our database after the session ends.What data is sent to AI services: trip title, destination, itinerary summary, member display names, and the triggering chat message. We do not send passport documents, photos, exact GPS coordinates, expense details, or passwords to AI services.
AI responses may occasionally be inaccurate. Do not rely solely on AI for critical travel decisions.
We use strictly necessary authentication cookies set by Supabase
(sb-* cookies). These are required for you to log in and stay logged in.
Because they are strictly necessary for the service to function, they do not require
your consent under the GDPR ePrivacy Directive.
We do not set any tracking, advertising, or analytics cookies.
We store small preference values in your browser's local storage (no expiry, device-local): dark mode preference, display currency, PWA install prompt dismissal, chat read timestamps, and AI hint dismissal. These are not transmitted to our servers and are used solely to remember your in-app preferences.
ai_request_log) are retained for up to 90 days for abuse monitoring and capacity planning, then deleted.last_seen_country/city) is updated weekly and retained for as long as your account exists; it is deleted when you delete your account.Depending on your location, you have the following rights:
Canadian users have rights to access and correct their personal information. Contact us at hello@gettripkit.com to exercise these rights.
We use industry-standard measures to protect your data: HTTPS encryption in transit, Supabase Row Level Security (RLS) policies to restrict data access by user and trip membership, and VAPID-secured Web Push. However, no system is 100% secure. Do not upload highly sensitive identity documents unless you understand and accept the associated risks.
Profile photos and trip photos are stored in publicly accessible storage buckets. The URLs contain random identifiers, but anyone who obtains a URL can access the file without authentication. Consider this before uploading identifiable photos.
TripKit is not directed at children under 13 years of age (or under 16 in the EU/EEA per GDPR Art. 8). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us to have it removed.
TripKit uses services based in the United States (Supabase, Groq, Google Gemini). Data transfers from the EU/EEA to the US are made under Supabase's DPA, Groq's standard contractual commitments, and Google's EU-US Data Privacy Framework participation.
We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the most recent revision. Continued use of TripKit after changes constitutes acceptance of the updated policy.
In accordance with the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023, the name and contact details of the Grievance Officer are:
Name: Nikhil
Email: hello@gettripkit.com
Address: India
Response time: Grievances will be acknowledged within 48 hours and
resolved within 30 days of receipt.
For any privacy-related questions, data access requests, or to exercise your rights: hello@gettripkit.com