1. Who We Are
TripTrekr is operated by MaeTara LLC, a Texas limited liability company ("we", "us", "our"). For the purposes of the EU and UK General Data Protection Regulation, we are the data controller for the personal data described in this policy.
MaeTara LLC
5900 Balcones Drive, Suite 100
Austin, TX 78731
United States
You can reach us about any privacy matter at contact@triptrekr.com. We have not appointed a Data Protection Officer, as we are not required to.
2. Information We Collect
Account information
When you sign in with Google, we receive your name, email address, and profile picture. This is used to identify your account and personalise your experience.
Trip and booking data
Any journeys, bookings, expenses, and expense groups you create are stored in your account. This data is yours — we store it to power the app's core features.
Google Calendar data (optional)
If you connect Google Calendar, we request read-only access to your calendar solely to detect and import travel-related events (flights, hotels, activities) into your trips. We access only the event data needed to identify travel — and only structured trip data (titles, dates, times, locations) is saved to your account. We do not modify your calendar, use it for any other purpose, or share your calendar data with third parties.
If you disconnect Google Calendar, previously imported events remain in your account as part of your trip. No new events will be read after disconnection. Calendar API calls are logged server-side for error monitoring only; these logs are retained for 30 days and contain no event content. You can revoke access at any time via your Google Account settings.
Subscriptions and payment information
TripTrekr offers an optional paid subscription ("Pro"). On iOS, subscriptions are purchased through Apple's In-App Purchase system — Apple processes your payment, and we never receive or store your card details. On the web, payments are processed by Stripe; again, we do not store card details, and Stripe handles payment data under its own PCI-compliant privacy policy.
We use RevenueCat to manage subscription status and validate purchases across platforms. RevenueCat receives your purchase history and a pseudonymous app user identifier (and may receive a device identifier) in order to determine whether your subscription is active. We retain your subscription status (active or expired, plan, and renewal date) to unlock Pro features.
Location data
If you grant location permission, TripTrekr uses your device location to find restaurants and things to do near you. Precise location is sent to our servers and to our maps and places providers only to fulfil that request, and is not stored against your account. Approximate (coarse) location may also be inferred from your IP address by our analytics provider.
Photos
If you add highlight photos to a trip, the photos you choose — via your camera or photo library — are uploaded to your account so they appear in your trip. We access only the photos you explicitly select.
Usage, analytics, and device data
We use Google Firebase Analytics to understand how the app is used (for example, which features are opened) so we can improve it. This may include product-interaction events, a device or app-instance identifier, and approximate location derived from your IP address. We do not use this data for advertising, and we do not track you across other companies' apps or websites.
Analytics runs on the website only, and in Europe only if you say yes. It is never enabled inside the TripTrekr iPhone or Android app — nothing about your usage is collected there at all. On the website, if you are in the EU, the EEA, the UK or Switzerland, we ask you before anything is stored on your device, and nothing is collected unless and until you accept. Declining is one tap and costs you no part of the service. You can change your mind at any time in Settings → Analytics; turning it off stops any further collection, and anything already loaded in that browser tab stops at your next page load.
AI-generated itineraries and insights
If you ask TripTrekr to generate an itinerary, suggest activities, or produce seasonal or cost insights, the trip details needed for that request — such as destination, dates, party size, and any preferences you enter — are sent to our AI provider, Anthropic, to produce the response. Anthropic processes this on our behalf and does not use it to train its models.
3. How We Use Your Information, and Our Legal Basis
If you are in the EU, EEA, or UK, data protection law requires us to have a legal basis for each use of your personal data. Ours are:
| What we do | Legal basis |
|---|---|
| Create and operate your account; store the trips, bookings, expenses, and photos you add; share a trip with the people you invite | Performance of a contract (Art. 6(1)(b)) |
| Import travel events from your Google Calendar | Your consent (Art. 6(1)(a)) — given when you connect Calendar, withdrawable at any time |
| Use your device location to show nearby restaurants and things to do | Your consent (Art. 6(1)(a)) — given at the system permission prompt, withdrawable in device settings |
| Generate AI itineraries and insights from your trip details | Performance of a contract (Art. 6(1)(b)) |
| Take subscription payments and validate subscription status | Performance of a contract (Art. 6(1)(b)); keeping the resulting records is a legal obligation (Art. 6(1)(c)) |
| Send service emails — trip invitations, access requests, account notices | Performance of a contract (Art. 6(1)(b)) |
| Operate the referral programme | Performance of a contract (Art. 6(1)(b)) |
| Measure how features are used so we can fix bugs and improve the app | Your consent (Art. 6(1)(a)) if you are on the website in the EU, EEA, UK or Switzerland — we ask first and collect nothing until you accept, and you can withdraw at any time in Settings → Analytics. Elsewhere on the website, our legitimate interest in improving the service (Art. 6(1)(f)). Analytics does not run in the mobile apps at all. |
| Keep the service secure, prevent abuse, and respond to support requests | Our legitimate interest in a secure and supportable service (Art. 6(1)(f)) |
We will never sell your personal data or use it for advertising purposes. We do not make decisions about you by automated means that produce legal or similarly significant effects.
4. Google API Services
TripTrekr's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, Google Calendar data obtained via Google APIs is used only to import travel events into your trips at your request. It is not transferred to third parties, used to serve advertisements, or used for purposes beyond the feature you explicitly enabled.
5. Data Sharing and Processors
We share data only in these limited circumstances:
- Trip collaborators: When you invite someone to a trip, they can see the trip details you share with them, based on the role you assign.
- Support and troubleshooting: Authorised personnel may access account data where reasonably necessary to respond to a support request, investigate a technical issue, or maintain the security and integrity of the service. Such access is limited, read-only and logged. See Support access.
- Legal requirements: If required by law or to protect our rights or users' safety.
- Service providers (processors), listed in full below. Each acts only on our instructions, under a written data processing agreement.
| Provider | What it does for us | Where it processes |
|---|---|---|
| Google (Firebase) | Sign-in, database, file storage, server functions, analytics, push notifications | United States |
| Apple | In-App Purchase — seller of record for iOS subscriptions | United States / EU |
| Stripe | Card payments for web subscriptions | United States |
| RevenueCat | Subscription status and purchase validation | United States |
| Anthropic | AI itineraries, activity suggestions, and trip insights | United States |
| Resend | Transactional email — invitations, access requests, account notices | United States |
| Geoapify | Place search, address autocomplete, and geocoding | European Union |
| Google Maps & Places | Nearby places, place details, and photos | United States |
| Duffel, Kiwi, Travelpayouts | Flight options and fare tracking for the routes you search | European Union / United States |
Providers we use only for non-personal content — such as Wikimedia, Unsplash, Pexels, and Pixabay for destination photography, and the U.S. National Park Service for park data — receive no personal data about you.
6. International Data Transfers
We operate from the United States, and most of the providers above process data there. If you are in the EU, EEA, UK, or Switzerland, this means your personal data is transferred outside your home country.
Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), incorporated into our data processing agreement with each provider, together with the technical measures described in the next section. You can request a copy of the relevant safeguards by contacting us.
7. Data Storage and Security
Your data is stored in Google Firebase (Firestore), which uses industry-standard encryption at rest and in transit. Access is controlled by Firestore security rules so that only you (and those you explicitly invite) can access your trip data.
Firebase Authentication secures your sign-in. We do not store passwords — authentication is handled entirely by Google.
Support access
Access to account data by our personnel is restricted to a limited number of authorised administrators and is permitted only where reasonably necessary to provide customer support, diagnose a technical issue, or maintain the security and integrity of the service. Such access is read-only, time-limited, subject to internal authentication controls, and recorded in an internal audit log. You may request confirmation of whether your account has been accessed for these purposes by contacting us at the address below.
8. Data Retention
| Data | How long we keep it |
|---|---|
| Account, trips, bookings, expenses, photos | For as long as your account is open. Deleted when you delete your account. |
| Travel events imported from Google Calendar | Kept as part of your trip until you delete that trip or your account. Disconnecting Calendar stops new imports but does not remove past ones. |
| Server and API error logs | 30 days. They contain no event content and no personal identifiers. |
| Analytics events | Up to 14 months, then deleted automatically by Firebase. |
| Subscription and payment records | Held by Apple or Stripe for as long as tax and accounting law requires — typically six to seven years. We keep only your subscription status. |
You can delete your account yourself at any time in the app, under Settings → Delete account. Deletion is immediate and permanent: it removes your trips, expenses, photos and their underlying files, the trips you have shared out, your subscription record, your push notification tokens, and your sign-in account. It also removes the photos you uploaded to other people's trips, any pending request to join a trip, and your name and picture from the trips you were a member of. It cannot be undone, and we cannot recover the data afterwards. If you would rather we did it for you, email us and we will action it within 30 days.
9. Your Rights
Wherever you live, you can ask us to:
- Access the personal data we hold about you, and receive a copy
- Correct data that is inaccurate or incomplete
- Delete your data — see the account deletion described above
- Export your data in a portable, machine-readable format
If you are in the EU, EEA, or UK, you also have the right to:
- Restrict how we process your data while a concern is being resolved
- Object to processing we carry out on the basis of legitimate interests
- Withdraw consent at any time, where we rely on it — and withdrawing is as easy as giving. Turn analytics off in Settings → Analytics, disconnect Google Calendar in Settings, or turn off location for TripTrekr in your device settings. Withdrawing consent does not affect processing carried out before you withdrew it.
- Lodge a complaint with your national data protection authority. In the EU you can find yours through the European Data Protection Board; in the UK it is the Information Commissioner's Office. We would appreciate the chance to put things right first.
You can also revoke TripTrekr's access to your Google account at any time via your Google Account settings.
To exercise any of these rights, contact us at contact@triptrekr.com. We will respond within one month. Exercising your rights is free, and we will never treat you differently for doing so.
10. Children's Privacy
TripTrekr is not directed at children. We do not knowingly collect personal data from anyone under 16, or under 13 where local law sets that lower age. If you believe a child has provided us with their information, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date above. Continued use of the app after changes constitutes acceptance of the updated policy.
Contact Us
If you have questions about this privacy policy or how we handle your data, please reach out:
Email: contact@triptrekr.com
App: triptrekr.com