Last updated: March 28, 2026
This Privacy Policy explains how TripKit ("we", "us", "our") collects, uses, stores, and shares your personal data when you use the TripKit web application (tripkit.app). Please read it carefully.
TripKit is operated as a personal / small-team project. For any privacy questions or to exercise your rights, contact us at: nikhil.ha@gmail.com
We collect the following categories of personal data:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of contract (Art. 6(1)(b)) |
| Trip planning features (itinerary, expenses, checklists, chat) | Performance of contract (Art. 6(1)(b)) |
| Live location sharing | Explicit consent (Art. 6(1)(a)) — you initiate it each session |
| Sending push notifications | Consent (Art. 6(1)(a)) — you opt in via browser permission prompt |
| Streak, badges, and gamification | Legitimate interest (Art. 6(1)(f)) — improves engagement and user experience |
| AI-generated features (see Section 5) | Performance of contract / legitimate interest (Art. 6(1)(b)/(f)) |
We use the following third-party services that process your data:
Our database, authentication, file storage, and real-time messaging are provided by Supabase, Inc.. All your account, trip, chat, and file data is stored with Supabase. They act as a data processor under a Data Processing Agreement.
If you choose "Continue with Google", your Google account identity and email address are shared with Google and passed to Supabase Auth to create your account. Google's privacy policy applies to the OAuth flow.
When you use AI-powered features — including AI itinerary generation, AI checklist
suggestions, daily story cards, and when you mention @tripkit in the
group chat — your trip data (destination, itinerary summary, member names) and
your chat message are sent to Groq Cloud, Inc. in the United States for processing. Groq does not use this data to train its models.
The data is transferred under Groq's standard contractual commitments.
If Groq is unavailable, the same trip and chat data may be sent to Google Gemini (Google LLC, US) as a fallback AI service for the same features described above.
When viewing flight status, your flight number and date are sent to AeroDataBox via RapidAPI to retrieve real-time flight information.
Map tiles are served by OpenStreetMap (your IP address is exposed). Place-name geocoding uses Open-Meteo's free API. Nearby venue searches use the Overpass API. These services receive minimal data (place names or coordinates) and are subject to their own open-data terms.
Icon assets are loaded from Cloudflare CDN and jsDelivr CDN. Your IP address and browser information are exposed to these CDNs when loading these assets.
If you enable push notifications, your browser's push subscription endpoint (provided by your browser vendor — e.g. Google FCM for Chrome) is used to deliver notifications. The notification payload is sent from our server to your browser via the W3C Web Push protocol.
Several features in TripKit use AI language models (Groq / Google Gemini):
@tripkit in the group chat, your message and trip context are sent to an AI service. Other trip members can see the AI's replies.What data is sent to AI services: trip title, destination, itinerary summary, member display names, and the triggering chat message. We do not send passport documents, photos, exact GPS coordinates, expense details, or passwords to AI services.
AI responses may occasionally be inaccurate. Do not rely solely on AI for critical travel decisions.
We use strictly necessary authentication cookies set by Supabase
(sb-* cookies). These are required for you to log in and stay logged in.
Because they are strictly necessary for the service to function, they do not require
your consent under the GDPR ePrivacy Directive.
We do not set any tracking, advertising, or analytics cookies.
We store small preference values in your browser's local storage (no expiry, device-local): dark mode preference, display currency, PWA install prompt dismissal, chat read timestamps, and AI hint dismissal. These are not transmitted to our servers and are used solely to remember your in-app preferences.
Depending on your location, you have the following rights:
Canadian users have rights to access and correct their personal information. Contact us at nikhil.ha@gmail.com to exercise these rights.
We use industry-standard measures to protect your data: HTTPS encryption in transit, Supabase Row Level Security (RLS) policies to restrict data access by user and trip membership, and VAPID-secured Web Push. However, no system is 100% secure. Do not upload highly sensitive identity documents unless you understand and accept the associated risks.
Profile photos and trip photos are stored in publicly accessible storage buckets. The URLs contain random identifiers, but anyone who obtains a URL can access the file without authentication. Consider this before uploading identifiable photos.
TripKit is not directed at children under 13 years of age (or under 16 in the EU/EEA per GDPR Art. 8). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us to have it removed.
TripKit uses services based in the United States (Supabase, Groq, Google Gemini). Data transfers from the EU/EEA to the US are made under Supabase's DPA, Groq's standard contractual commitments, and Google's EU-US Data Privacy Framework participation.
We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the most recent revision. Continued use of TripKit after changes constitutes acceptance of the updated policy.
In accordance with the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023, the name and contact details of the Grievance Officer are:
Name: Nikhil
Email: nikhil.ha@gmail.com
Address: India
Response time: Grievances will be acknowledged within 48 hours and
resolved within 30 days of receipt.
For any privacy-related questions, data access requests, or to exercise your rights: nikhil.ha@gmail.com