Privacy policy

Information we handle

When you create an account, we handle your name, email address, profile photo if you add one, sign-in details, and account settings. TripSova has no passwords: you sign in with a one-time code we email you, or with Apple or Google. We keep a hashed copy of each code for ten minutes. If you sign in with Apple or Google, we receive the account details and credentials needed to sign you in.

Trip information includes titles, dates, destinations and saved places, notes, itineraries, links, expenses and booking details you enter, cover photos you upload, and changes made with collaborators. Social features handle friend requests, invitations, comments, likes, and shared trip activity. The visibility you choose controls access in TripSova; people with access may keep copies of what they see.

We handle notification preferences and an Apple push token if you enable notifications. If you report content or contact us, we handle the details you send and the information needed to review and reply. Our servers and hosting provider also process connection and security information, such as IP addresses and request logs, to operate and protect the service.

How we use it

We use this information to sign you in, save and share trips as you direct, show social activity, send requested invitations and notifications, answer support messages, prevent misuse, and keep TripSova working. Comments, names, usernames, and trip titles are checked against a word list on our own servers when you save them, and anything that matches is rejected. Public share pages hide matching itinerary, link, and place text from visitors. This check does not send your content to any other company. People review reports and can remove content, photos, or accounts. You can report any person, trip, or comment, and anyone who opens a shared trip page can report that trip without an account. When we remove a reported photo, we keep a private copy that only our reviewers can open for up to 30 days, then delete it.

The website uses third-party website analytics and performance tools to understand site use and performance. Those website tools are separate from the native iPhone app. We do not use TripSova trip content for targeted advertising.

Optional trip assistants and expense tools

When you use an optional trip assistant on the website or in the iPhone app, TripSova sends your current and earlier assistant messages to Groq, a third-party AI provider, to prepare replies and suggestions. For an existing trip, the request can also include its title, dates, notes, saved places and links, itinerary, and expense summaries that you are allowed to see. On the website, a new-trip request can include draft title, dates, status, and visibility. Choosing a suggested new trip can also send its title, dates, and visibility to prepare notes. Information you type into a message can be included too. We do not save assistant conversations as trip history. Trip changes you choose to save become part of your trip. Assistant replies can be wrong or incomplete, so double-check important details before relying on them.

Optional expense tools also use Groq. When you paste a booking confirmation or receipt to fill in an expense, we send the text you paste and any note you add. That text can include traveler names, addresses, booking codes, and prices. We ask the AI to leave out card numbers, but it can only leave out what you choose not to paste, so remove payment details before pasting. When you set up a split in plain language, we send what you type along with the names of the people on the trip. When you add an expense from a photo or screenshot of a receipt, your iPhone reads the text on the device and the photo is never uploaded. Only the text it recognises is sent. We do not save pasted text, recognised text, or split requests. Only the expense you review and choose to save becomes part of your trip.

On iPhone, you can decline or turn off AI sharing under You → AI data sharing and continue planning manually. Turning it off stops future assistant and expense tool requests from that device. The website sends requests only when you use its optional assistant or expense tools; the iPhone setting does not control website use. You can skip them to avoid future website AI requests. These choices cannot recall information already sent. Groq says it does not normally retain request content, but may keep it for reliability or abuse investigations for up to 30 days, or longer when legally required. Usage information is kept separately. See how Groq handles your data.

Providers and other people

We use Apple and Google for sign-in when you choose them, cloud storage and media delivery networks to store and deliver uploaded images, third-party transactional email infrastructure providers to deliver email, website hosting providers to host the website and process website analytics, and Groq, a third-party AI provider, for optional trip assistants. We send each provider the information needed for that task. Apple handles push notifications, and Apple Maps may process places you view or open in Maps on iPhone.

Google Sign-In may also process phone number, approximate location, account and device identifiers, and usage information as part of its sign-in service. Its own privacy practices govern that processing.

Other travelers can see information according to the trip access, friend, and sharing choices you make. A public trip link makes that trip viewable by anyone who has the link until you revoke it, and anyone who opens it can report the trip. We may disclose information when required by law or to protect people and the service.

Retention and deletion

We keep account and saved trip information while your account is active, or until the relevant content is removed. You can delete your account in the app or on the website. That removes your profile, trips you own, related social activity, credentials, notifications, and push registrations from TripSova, and requests deletion of uploaded account and trip images. Content you added to another person’s trip can remain with that trip when it cannot be attributed to an individual author.

Deletion cannot take back messages already delivered, copies made by other people, or information already sent to an AI provider. Infrastructure logs, backups, support correspondence, and provider records may remain for their applicable retention periods or legal obligations. Image cache invalidation can take time. Contact us if you need help with a request.

Questions and updates

Email support@contact.tripsova.com or use our contact page. We may update this policy as TripSova changes and will post the updated date here.