Privacy Policy

Who is responsible

Trippy is run by Jakub Szwajka, a Polish sole proprietorship (jednoosobowa działalność gospodarcza). Under the GDPR, the person who runs Trippy is the controller of your data.

Controller

Jakub Szwajka

Trading as

Trippy

Address

ul. Bolesława Chrobrego 34 lok. 13, 50-254 Wrocław, Poland

NIP

8982277864

REGON

522094050

Email

[email protected]

Use the email address for privacy, legal and support questions alike.

What Trippy handles, and why

Your account

Clerk runs sign-in. It holds your account, your email address and your sessions, and it sends the sign-in and verification emails. Trippy keeps the id Clerk gives you, to know which Trips you own. It reads your verified email addresses to match them against Shares. Legal basis: a contract with you, to give you the app (Article 6(1)(b) GDPR). Clerk's script, with its Clerk Protect checks, loads only on the sign-in and sign-up pages and on the pages you see once signed in. Our public pages, such as the home page, this policy and the Terms, do not load it.

Your Trips

Everything you enter: Trips, Places, Days, Transport, Flights, Stays, Activities, Costs, Packing items, Links and notes. It sits in a Postgres database. Please do not enter more about other people than the plan needs. Legal basis: the same contract.

Files you attach

You can attach a file, such as a booking confirmation or a receipt, to a Transport, Stay, Activity or Cost: a PDF or a JPEG, PNG, WebP or HEIC image of up to 10 MB. We store the file itself in an S3-compatible file store on the servers we rent from Hetzner Online GmbH, and its name, type and size in the database. Everyone with access to the Trip, its Owner and the people it is shared with, can open and download it. We keep it until someone with access to the Trip deletes it, or until the Owner deletes the Trip. Its name, type and size can stay in a database backup until that backup expires, as described under Backups. Legal basis: the contract (Article 6(1)(b)).

Shares

When an Owner shares a Trip, they type another person's email address. Trippy stores that address with the Trip and sends nothing to it. Anyone who signs in with that verified address sees the Trip and can edit it. If you are that person, the Owner gave us your address, not you. We keep nothing else about you from it, and you can ask us to remove it. Legal basis: our legitimate interest, and the Owner's, in letting a Trip be shared (Article 6(1)(f)).

Maps

With a Google Maps key set, your browser loads the Google Maps JavaScript API and the Places API (New) from Google. Trippy stores the Google place id and what you save about a place, and reads the place's details from Google each time its card opens. When you paste a short Google Maps link, our server follows it to Google to read the place. Without the key, the map is drawn with Leaflet and your browser fetches map tiles from tile.openstreetmap.org, run by the OpenStreetMap Foundation. In both cases the map provider sees your IP address and the map area you look at. Legal basis: the contract.

Visits and selected actions

We use Umami, hosted by us at analytics.niuluc.me, to count page views and a fixed, allowlisted set of events for every visitor, without cookies. The events are: landing_view, cta_click, signup_started, signup_done, trip_created, trip_activated, trip_shared, paywall_view, paywall_option_click, checkout_started, subscribed, alternative_answer, built_by_click, in_trip_open, mobile_interest_view, mobile_interest_click, mobile_waitlist_join and plan_interest_click. These describe opening a landing page, starting registration, creating and sharing a Trip, reaching three planned items, viewing plan options, opening checkout, subscribing, answering an optional question, clicking the maker link and clicking a city plan that cannot be bought yet. Event properties contain only approved categories, such as language, campaign code, plan option or city.

With each page view or event, Umami receives the page address, page title and referrer, plus the site id, hostname, screen size and browser language. Our Umami server also reads your IP address and your browser's user agent from each request. From them it works out your country, region and city, and your browser, operating system and device type, and stores those. The IP address and the user agent are used to build a session id, so page views from one visit count as one session. They are not stored in Umami. We keep Umami visit and event data for 25 months, then delete it. Your browser shortens every address before it is sent. It keeps the path, drops the hash and every query parameter except the campaign tags utm_source, utm_medium, utm_campaign, utm_content and utm_term, and replaces with "redacted" any part of the path that looks like an id, such as a Trip id, or holds an email-like or encoded value. A tag value that looks like an email address or an id is dropped. A tag can still hold any other text that the person who made the link typed into it. Umami receives no email addresses, Trip titles or Trip content. It honours Do Not Track: with it on, your browser sends nothing. Legal basis for these counts: our legitimate interest in measuring use of Trippy (Article 6(1)(f)).

Only with your consent

A banner asks whether you allow analytics linked to your account. Only with your consent, and only after you sign in, do we link your visits and events in Umami to your Clerk account id, sent as trippy:u: followed by the id. The link applies on the pages you see while signed in, such as your Trips. Our public pages, such as the home page, this policy and the Terms, never send the account id, even while you are signed in. Only with your consent does your browser send performance reports: how fast pages load and respond, and only with your consent does it record session replays and heatmaps, described below. Without consent, or after you withdraw it, none of this happens, and the counts above go on without a link to your account. Legal basis: your consent (Article 6(1)(a)). Give or withdraw it at any time under Privacy settings: in the footer of our public pages, in the top bar of the app once you are signed in, and under the sign-in and sign-up forms. Withdrawal stops the link, the reports and the recording from then on. It does not undo data already sent.

The banner is run by Utati, our consent tool, also hosted by us at analytics.niuluc.me. Your browser keeps a random key for our consent server in localStorage and sessionStorage, and the server keeps your choice under that key. The server does not store the key itself. It stores a row with a hash of the key, the address of the site the key belongs to and an expiry date, which stays in the far future unless the key is revoked. The row lets the server check that a request about your choice comes from the browser that holds the key, and links your choice and its records to that browser. Before you make a choice, the legal basis for the row is our legitimate interest in showing the banner, recording a choice you make later and stopping abuse of the consent server (Article 6(1)(f)). It is deleted after 30 days if you make no choice. Once you make a choice, it is kept as long as the records of your choices that point to it: 5 years. From then on its legal basis is the same as for those records: Article 6(1)(c) with Article 7(1) GDPR. Our consent server keeps a record of each choice: the options, the time and the version of the consent text, so we can show what you chose. We keep these records for 5 years from the choice, because we must be able to prove consent (Article 6(1)(c) with Article 7(1) GDPR). We ask again 365 days after your choice, or sooner if the consent options change. Marketing pixels are not used: Trippy loads no ad or marketing trackers, and the marketing option in the banner cannot be switched on.

Session replays and heatmaps

Only with your consent to analytics, as part of the same Analytics choice in the banner, your browser records how a visit goes, so we can see where Trippy gets in the way. We may record only some visits. A session replay records the layout of each page and how it changes, your mouse movements, clicks and scrolling, the size of the window and the page address. A heatmap records where you click and how far you scroll on each page, with the page address and the window and page size. Page addresses are shortened the same way as for the counts above.

What you type into a form field is always masked: a replay shows stars, never your text. On the pages you see once signed in, all text is masked too, and so are labels, link addresses and image addresses in the page. A replay there shows the layout of a Trip, but not its name, its places, notes or costs, or the people in it. Maps, place photos, attached files, links and notes, and Clerk's sign-in and sign-up forms and account menu, are not recorded at all: a replay shows an empty box in their place. On our public pages, such as the home page, this policy and the Terms, the text is recorded as it is, because it is the same for every visitor. Form fields stay masked there too. Our public pages never send your account id, even while you are signed in. On the pages you see once signed in, a replay belongs to the same Umami session as your visits, so it is linked to your account id as described above.

Replays and heatmap data go to our own Umami at analytics.niuluc.me. We keep them for 25 months, then delete them. Legal basis: your consent (Article 6(1)(a)). When you withdraw consent or reject analytics in Privacy settings, the recording stops at once, and nothing more is sent. Data already sent stays until it is deleted after 25 months, or until you ask us by email to delete it sooner. The recorder writes nothing of its own in your browser.

Campaign attribution and account milestones

If attribution storage is enabled, localStorage in your browser keeps the source and campaign codes of your first visit for up to 30 days. Only codes from our campaign registry are accepted. After sign-in, we link them to your account in Trippy's own database and clear the browser entry. A later campaign does not replace the first one. Attribution storage stays off until its lawful basis has been reviewed and approved.

Separately, our database records account-linked milestones, such as registration, Trip creation, activation, sharing and subscription, and interactions with paid plan options. We use these records to count which campaigns lead to use and paid plans. They are separate from the Umami counts. We delete growth attribution, milestone and plan-option records after 90 days. Legal basis for account activity measurement: our legitimate interest in understanding use of the service (Article 6(1)(f)). You can object or request erasure by email. localStorage also remembers whether the optional feedback question was shown. Only while attribution storage is on, a per-tab sessionStorage flag, trippy.growth.signedIn, remembers whether you were signed in so attribution can be cleared when you sign out in that tab. It lasts until the tab closes. While attribution storage is off, Trippy neither writes nor reads it. The full list of what your browser keeps is under Browser storage and cookies below.

Use during a Trip and the mobile app list

When an Owner or a Share opens a Trip during its dates, we record the account id, Trip id, Warsaw calendar day and device class (phone, tablet or desktop) in our database, at most once per account and Trip per day. The server derives the class from browser headers, without storing those headers. These records expire after 90 days and do not depend on campaign attribution. The in_trip_open event carries the device class only, and its page address has the Trip id replaced with "redacted". Legal basis: our legitimate interest in measuring use during Trips (Article 6(1)(f)).

Our optional mobile app list records only your Clerk account id, consent version, language, signed-in method and date in Trippy's database on Hetzner. Your email stays in Clerk. The purpose is one update if work on a mobile app starts, not marketing. The controller named above relies on your separate, affirmative consent (Article 6(1)(a)). Withdraw it at /trips/mobile-app or by emailing the contact below. Withdrawal deletes your list entry. Otherwise it expires after 30 days, when the test ends. No email-list provider receives it, and Trippy sends no email now.

Mobile interest events contain only platform (iOS, Android or unknown), persona, entry point, action or method and approved campaign codes. Count distinct mobile visitors where available, not repeated impressions. localStorage remembers that the dismissible mobile invitation has been shown; it contains no account id.

Payments

If you buy a paid plan, Stripe processes the payment and runs checkout and the billing portal. Payment details go to Stripe, not to Umami. Trippy keeps the account-linked customer, subscription and checkout references, plan status and paid-through date needed to provide access. Legal basis: the contract (Article 6(1)(b)) and legal obligations for required billing records (Article 6(1)(c)). Billing records have separate statutory retention and are not covered by the 90-day growth-data deletion.

Logs and the call audit

Every action in the app, from the web or from an AI client, is a named call. We store a row for each write, each failure, and each read over MCP: the call name, its permission, your user id, the outcome, how long it took, whether it read or wrote, the id of the Trip it touched, the channel, and a request id. A row never holds what you typed or an error message. Rows are kept 365 days. Our server logs carry the same details and the request id. Legal basis: our legitimate interest in security and in fixing faults (Article 6(1)(f)).

AI clients

You may connect an AI client, such as Claude, to Trippy. It signs in through an OAuth flow that Clerk runs. After that it reads and changes your Trips whenever you ask it to. You pick the client, and its provider handles what it receives under its own terms.

Backups

A backup of the database is taken each day and sent to an S3 storage bucket. Backups are kept 14 days. They hold everything the database holds. Legal basis: our legitimate interest in not losing your Trips (Article 6(1)(f)).

We do not sell data or show third-party ads in the app.

Browser storage and cookies

Trippy and its sign-in provider keep these entries in your browser:

• utati.consent.v1. followed by our consent site id, in localStorage and sessionStorage: a random key that lets our consent server find your banner choice. The entry stays until you clear site data. Our consent server deletes the key after 30 days if you make no choice. Once you make a choice, it keeps the key as long as the records of your choices that point to it: 5 years. Your choice itself expires after 365 days, and then we ask again.
• trippy_locale cookie: pl or en, the language Trippy shows you. It lasts one year.
• trippy.growth.signedIn, sessionStorage, only if attribution storage is on: whether you were signed in, so attribution can be cleared on sign-out. Until the tab closes.
• trippy.growth.attribution, localStorage, only if attribution storage is on: the first campaign codes. Up to 30 days.
• trippy.growth.probeSeen and trippy.mobile.promptSeen, localStorage: that the feedback question or the mobile invitation was shown. Until you clear site data.
• trippy:summary-currency, localStorage: the currency you picked for the cost summary. Until you clear site data.
• trippy:route: entries, sessionStorage: map routes already drawn, so they need not be fetched again. Until the tab closes.
• Session replays and heatmaps add no entry of their own: the recorder keeps its data in the page while it runs and sends it to Umami.
• Clerk, our sign-in provider, needs these for sign-in. Its script, with its Clerk Protect checks, loads only on the sign-in and sign-up pages and on the pages you see once signed in, never on our public pages. It writes some of these entries on the sign-in and sign-up pages before you sign in. Some cookie names come twice: once plain and once with a suffix Clerk derives from Trippy's Clerk key, such as __client_uat_1f9F4U_N. Both copies hold the same value and last as long.
  • __client cookie, set by Clerk's server on clerk.trippyplanner.me, where page scripts cannot read it: the token that tells Clerk which browser it is talking to, so you stay signed in between visits. Clerk asks the browser to keep it for 10 years. Many browsers keep a cookie for at most 400 days.
  • __client_uat and __client_uat_ cookies, set by Clerk's server: 0 when you are signed out, otherwise the time your sign-in last changed, so our server knows whether to check your session. Clerk asks the browser to keep them for 10 years.
  • __session and __session_ cookies, only while you are signed in: your session token, which our server checks on each request. The token inside is valid for about 60 seconds, and Clerk swaps in a new one while a Trippy page is open. The cookie itself is set to expire after one year, and Clerk deletes it when you sign out.
  • clerk_active_context cookie, after sign-in: your Clerk session id and organization id, so open tabs agree on who is signed in. It goes when you sign out or close the browser.
  • __clerk_redirect_count cookie: counts sign-in redirects, so a redirect loop stops. It lasts 2 seconds.
  • __cf_bm and _cfuvid cookies on clerk.trippyplanner.me: Cloudflare sets them in front of Clerk's server, to spot bots and to limit request rates. __cf_bm lasts 30 minutes. _cfuvid goes when you close the browser.
  • __clerk_environment, localStorage: Clerk's public sign-in settings for Trippy, so the sign-in form loads faster. Each copy is marked to expire after 24 hours. Clerk writes a fresh copy as you use Trippy and deletes an expired one when it reads it.
  • __clerk_protect_pid, localStorage: a random id for Clerk Protect, Clerk's check against automated sign-ups and sign-ins. It stays until you clear site data. On the sign-in, sign-up and signed-in pages, Clerk Protect loads a script from cdn.protect.clerk.com that reads details of your browser and device, such as how it draws graphics and which graphics card it reports, and sends them to Clerk. Our public pages do not load it. Legal basis: our legitimate interest in keeping accounts safe from fake sign-ups and stolen passwords (Article 6(1)(f) GDPR).
  • __clerk_protect_st, localStorage: the latest Clerk Protect token, its expiry and when it was written. Clerk ignores it once the token expires, and at the latest 24 hours after it was written. It stays until Clerk replaces it or you clear site data.
  • clerk_telemetry_throttler in localStorage and the __clerk_db_jwt cookie: Clerk writes these only on its development instances. trippyplanner.me runs on a production instance, so you will not find them there.

Browser settings let you remove these entries. Removing browser data does not erase records already linked to your account.

Who else handles your data

• Clerk: sign-in, accounts and sessions, and the emails it sends for them.
• Stripe: checkout, payments, subscriptions and the billing portal.
• Hetzner Online GmbH: the servers we rent, including the file store for attached files. We run them with Dokploy.
• Cloudflare: DNS and a proxy in front of the site, so every request to Trippy passes through Cloudflare.
• An S3 storage bucket: the daily backups.
• analytics.niuluc.me: our own Umami and Utati servers, which we run ourselves on servers rented from Hetzner Online GmbH. They receive the visit counts, events, session replays, heatmap data and consent records described above.
• Google: maps, place search and place details, when the key is set.
• OpenStreetMap Foundation: map tiles, when the key is not set.
• The people you share a Trip with, and the AI client you connect.

We also pass data to authorities or advisers when the law requires it or when we need it to defend a claim.

Data outside the EEA

These providers may process your data outside the European Economic Area:

• Clerk: its Data Privacy Framework notice states that it is certified under the EU-U.S. Data Privacy Framework.
• Google Maps Platform: Google's data transfer notice states that Google LLC is certified under the EU-U.S. Data Privacy Framework. It also describes using Standard Contractual Clauses where required.
• Cloudflare: its privacy policy states that it relies on the EU-U.S. Data Privacy Framework for EEA transfers to the United States. It uses Standard Contractual Clauses for other EEA transfers and if its certification lapses or becomes invalid.
• Stripe may process data outside the EEA. Its privacy policy describes its safeguards, including Standard Contractual Clauses.
• The OpenStreetMap Foundation processes data under its own privacy policy.

How long we keep it

• Trips and everything in them: until the Owner deletes the Trip, which also deletes its Shares, or until you ask us to delete them.
• Attached files: until someone with access to the Trip deletes the file, or until the Owner deletes the Trip.
• Your account: until you ask us to delete it. See your rights below.
• Growth attribution, milestones, in-Trip opens and plan-option interactions: 90 days.
• Mobile app consent: until withdrawal or 30 days, whichever comes first.
• Browser first-touch attribution in localStorage: up to 30 days, cleared after sign-in.
• Required billing records: the applicable statutory retention period.
• Call audit rows: 365 days.
• Umami visit and event data, linked to your account or not: 25 months, then deleted.
• Session replays and heatmap data: 25 months, then deleted.
• Records of your consent choices: 5 years from the choice. Legal basis: Article 6(1)(c) with Article 7(1) GDPR, because we must be able to prove consent.
• The random browser key on our consent server: 30 days if you make no choice. Once you make a choice, as long as the records of your choices that point to it: 5 years. Legal basis: Article 6(1)(f) before a choice, then Article 6(1)(c) with Article 7(1) GDPR.
• Backups: 14 days. A deleted Trip can sit in a backup until that backup expires.

Your rights

You can ask us for a copy of your data, for a correction, for erasure, for a limit on how we use it, and to move it to another service. You can ask about any of these by email.

Your right to object. You can object at any time to any use that rests on our legitimate interest, such as the visit counts and the account milestones. To stop the visit counts at once, turn on Do Not Track in your browser: with it on, your browser sends nothing to Umami. For milestones or any other use, email us at [email protected].

You can withdraw consent at any time. Open Privacy settings and choose Withdraw consent or Reject all. We ask again 365 days after your choice, or sooner if the consent options change.

Trippy has no delete-my-account button yet. To close your account and have your data erased, email us from the address on the account. We answer within one month. We may need to check it is you.

We make no decision about you by automated means that has a legal or similar effect.

If you think we handled your data unlawfully, you can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl. You can also complain to the authority in the EU country where you live or work. We would like the chance to fix it first.

Security

A Trip is open only to its Owner and to people shared by a verified email address. The app checks that on every request. If a breach puts your rights at risk, we report it to UODO within 72 hours where the law requires, and we tell you when the risk is high.

Changes

When this policy changes, the date at the top changes too.

Contact

[email protected]