Privacy Policy

Effective October 14, 2026 · TripSanity, LLC, Atlanta, Georgia, USA · ericdelucajohnson@gmail.com

What we collect — organizers

If you create trips, we store your email address (used to sign you in with a one-time code — there is no account password) and the trips you build: itinerary days and stops, notes, addresses you enter, lists, and settings. That content is yours; we store it so your group can see it.

If you tick the box to hear when something new ships — at sign-in or on My trips — we keep that choice and when you made it, and email you now and then about new features and the occasional promo. Those emails go out through Resend, which keeps the list of organizers who said yes (each email address and whether it's still subscribed), so unsubscribing from one of those emails switches the setting off here too. It's off unless you turn it on, every one of those emails has an unsubscribe link, and the switch is at the bottom of My trips. Sign-in codes and messages about your own trips aren't marketing and don't depend on it. Guests are never emailed — not even a guest who adds a Zelle email address to the money ledger.

What we collect — guests

Guests join with a link and a trip password — no account, and no email address or phone number needed. What a guest does share, everyone on the trip can see:

• Check-offs and any stops you add to the plan.
• If you turn on the family finder: a display name and emoji you choose, plus your live location (next section).
• If the organizer turns on the trip feed: the display name and emoji you choose, and any messages or photos you post (next section).
• If you turn on trip alerts (the 🔔 button): your browser creates a push subscription — a delivery address held by your browser vendor's push service — which we store with the trip so organizer alerts can reach this device. It's removed when you turn alerts off or the trip is deleted. Alerts come from your trip's organizers, and — when the trip tracks a flight — automatic flight updates (a delay, a gate change, take-off, landing or a cancellation) for that flight.
• If you add your flight to a trip: the flight number, the day, and the name you type for who's on it, saved with the trip so everyone on it can see it.
• If you add how you'd like to be paid back on the money ledger: your Venmo, Cash App or PayPal username, or the email address, mobile number or tag you use with Zelle — saved with the trip so the people who owe you can see where to send it. It's optional, and you can clear it at any time.

Our hosting providers keep standard, short-lived server logs (IP address, request time) to run and secure the service, as virtually every website does.

Trip feed (messages & photos)

Some trips have a shared feed where anyone on the trip can post messages and photos. If your trip has one:

• Everyone on the trip sees what you post — it's a shared wall, not a private message. Only people with the trip link and password can see it; it's never public.
• Photos are shrunk on your own phone before they're sent, and that step removes the hidden metadata — including any GPS location tag the camera saved. We store the resized image, not the original file.
• You can delete your own posts from the device you posted them on. The organizer and co-organizers can delete any post (to keep the feed appropriate).
• Posts stay with the trip. Messages, photos and stop notes are kept for as long as the trip exists and are deleted when the organizer deletes the trip. Anyone on the trip can download the photos any time with Save all photos in the trip's Chat tab. Don't post anything you wouldn't want everyone invited to the trip to see.

Location sharing (family finder)

This is the most sensitive thing the product touches, so here is exactly how it works:

• Opt-in, per person. Nothing is shared until you tap "Start sharing my pin." Your browser will also ask for its own permission.
• Updates only while the page is open. Your position updates roughly every 15 seconds while the trip is open in your browser. Close the tab and the updates stop — there is no background tracking, ever.
• Visible to your trip only. Pins are shown to people who have the trip link and password. They are never public and never shown to other trips.
• Pause removes your pin. Tap Pause (or switch who the phone is) and your pin is removed from the trip's map right away.
• If you just close the page, your last spot stays up to a day. The last position you shared stays visible to your trip, marked with how long ago it was, for up to 24 hours. It's erased from our servers 14 days after your last update, or when the trip is deleted, whichever comes first. The trip's organizer can also remove anyone's pin from the Find tab.
• Children. A parent or guardian should decide whether a child's device shares its pin.
• Ask uses it too — only while you share. While you're sharing your pin, a question you ask the trip's AI helper includes your current coordinates, so "nearby" means near you. When you're not sharing, the helper never gets your location.

AI features

Everything below is sent to Anthropic (our AI provider) under commercial API terms that do not allow it to be used for model training. We log usage metadata (like counts and token numbers) to control cost and abuse. We don't store your questions or the AI's answers, and we don't reuse any of it for anything else.

• AI import and the packing-list generator (organizers): the pasted itinerary text, screenshots or PDFs, or the trip summary, to produce the structured result.
• The homepage preview (anyone, no account): the plan text you paste on the homepage, to show it as a trip before you sign up. Nothing is saved on our side — the result stays in your browser until you choose to save it as a trip. To keep the preview from being abused we record each use with a keyed hash of your connection's IP address (never the address itself) and the token counts; the hash can't be turned back into an address.
• Ask (anyone on the trip): your question, the display name you chose, the earlier questions and answers in the same conversation, and the trip's plan — its dates, where you're staying, and the day's stops — plus the local time and the forecast. The trip password and the organizer's contact list are removed first. If you're sharing your pin in the family finder, your current coordinates are included; if you're not, they aren't. To find places that are open or nearby, Ask may search the web through Anthropic's search tool, anchored on the trip's city.
• Heads-up cards: on a trip day, when rain is forecast before an outdoor stop or a booked stop is coming up soon, the trip page asks the same helper for a heads-up on its own — at most once per trip per day — sending the same information Ask does.

The built-in phrasebook uses no AI and no one else's servers: the phrases are a file on our own site. Tap-to-hear uses your device's voice. On an iPhone or iPad that stays on the device; some browsers (Chrome on a computer, for example) offer online voices, which send the phrase to the browser's maker to be spoken.

Services we rely on

• Supabase — database and sign-in (data stored in the United States).
• Resend — delivers our email. Every sign-in code goes out through it (your address and the code, nothing about your trips), and so do the feature-news emails if you asked for them: Resend keeps the list of organizers who said yes, as described above. Guests' details never go to Resend.
• Vercel — website hosting (Vercel serves every page as our host), plus its built-in anonymous, cookie-free page analytics on our marketing pages only.
• Ahrefs — anonymous, cookie-free visit counts on our marketing pages only (such as the homepage, trip templates and comparison pages), so we can see which pages bring people in.
• Anthropic — AI import, the packing list, Ask and heads-up cards, as described above.
• Open-Meteo — weather forecasts; we send the trip destination's coordinates, not your device location.
• OpenStreetMap tiles and public CDNs — the finder map loads map imagery and libraries from these servers, so your browser's IP reaches them, like loading any map.
• OpenStreetMap (Nominatim and public Overpass servers) and the US Census geocoder — when an organizer uses "What's nearby," we look up the home-base address with these services to find the closest groceries, pharmacies and places to eat. The result is saved with the trip, so guests' phones never make these lookups.
• FlightAware — when a trip tracks a flight, we look up its status with the flight number and date only (never names or anything else about the trip). Answers are cached on our servers and shared by everyone tracking that flight.
• Stripe — if you buy Pro, Stripe processes the payment; card numbers never touch our servers. We keep a record of the purchase with that trip — like its date and the email address you gave Stripe at checkout — so we can find it if you need help or a refund.

We keep anonymous usage counts in our own database — for example, how many times a trip was opened or a guest joined. On our marketing pages we also count visits ourselves: which page was viewed, the site that linked to it (without its query string), any campaign tag in the link, and your device type and country. We never store your IP address — our server combines it with your browser type into a code that changes every day and keeps only that code, so we can tell that two page views were one visit without being able to recognize you on another day. No cookies are involved. Vercel's page analytics, Ahrefs and our own visit counter run only on our public marketing pages. Inside the app itself — trip pages, the dashboard, the editor, co-organizer invites — none of those three run: no page analytics or trackers from anyone, no analytics cookies, and nothing that identifies you personally. We don't use advertising or cross-site tracking anywhere.

On your device

We use your browser's local storage — not tracking cookies — to remember that you unlocked a trip, your guest access token, and cached check-offs so the page works smoothly. Clearing your browser data removes all of it.

Retention and deletion

A trip's plan, check-offs, lists, money ledger and posts (messages, photos and stop notes) live until the organizer deletes the trip (archiving closes it to guests but keeps it). One thing goes sooner, on its own: a location pin is erased 14 days after its last update. Deleting a trip deletes all of it — itinerary, shared state, posts and location pins. Organizers can ask us to delete their account and everything in it by emailing us. We answer deletion requests from guests too — tell us the trip and the display name you used.

Security, honestly

Traffic is encrypted in transit, trip passwords are stored hashed, and all data access goes through server-side checks. One honest caveat: the trip password is a privacy layer for your invited group, not bank-grade security — anyone who has both the link and the password can view the trip. Share them the way you'd share a house key.

Changes & contact

If this policy changes in a way that matters, we'll note it here with a new effective date. Questions, deletion requests, anything: ericdelucajohnson@gmail.com.