Privacy Policy

Introduction

At TripHub ("we," "our," or "us"), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service").

By using TripHub, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

Information We Collect

Personal Information

We collect information that you provide directly to us, including:

• Name and email address when you create an account
• Profile information such as profile picture, birthday, and preferred display currency (optional)
• Authentication credentials when you sign in via Google or Apple — in these cases your identity is verified by the respective provider and we receive only your name and email address
• Travel preferences collected during onboarding (travel style, travel frequency, and intended use-cases), stored as part of your profile
• Trip details including destinations, dates, itineraries, and notes
• Destination coordinates (latitude and longitude) derived from the location autocomplete when you create or edit a trip — these are place coordinates, not your device's live location
• Expense information and financial transactions within trips, including currency and category
• Photos and videos you upload to trips
• Private travel documents you upload (boarding passes, booking confirmations, visa scans, insurance documents, and similar) — these are stored privately and are not visible to other trip members
• Communication data when you contact our support team

Automatically Collected Information

When you access our Service, we automatically collect certain information, including:

• Device information (model, operating system, unique device identifiers)
• Usage data (features used, time spent, interactions)
• An action log of in-app events such as expenses added or edited, events created, photos uploaded, and members joining or leaving trips — used to power the activity feed and to improve the Service
• Log data (IP address, browser type, access times)
• Crash reports and error diagnostics collected by Firebase Crashlytics, including device state at the time of the error, a breadcrumb trail of recent in-app actions, and the screen that was active when the error occurred

Push Notifications

When you enable push notifications, we collect a device push token to deliver notifications through Google Firebase Cloud Messaging (FCM). You can revoke push notification permissions at any time via your device settings or the in-app Notification Preferences screen.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process your transactions and manage your trips
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Facilitate collaboration between trip members
• Personalize and improve your experience
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and address technical issues, crashes, or fraudulent activity
• Comply with legal obligations and enforce our terms

Payments

When you purchase trip credits or storage packs, your payment is processed by Stripe. You are redirected to a Stripe-hosted checkout page where you enter your payment details. TripHub does not receive or store your card number or other sensitive payment credentials — Stripe handles these under their own privacy policy and PCI-DSS compliance program. We receive from Stripe only a confirmation of the transaction, the product purchased, and the amount paid, which we use to credit your account.

Receipt Processing

When you use the receipt scanning feature, the receipt image is temporarily transmitted to Google's Gemini Vision API for text extraction. The image is then stored in our private cloud storage, accessible only to the trip members you share it with. Google processes the image under their data processing terms. We do not use receipt content for advertising or profiling.

Information Sharing and Disclosure

With Trip Members

When you join or create a trip, information you add to that trip (including your name, profile picture, expenses, itinerary items, and photos) is shared with all members of that trip. Private travel documents you upload are visible only to you and are never shared with other trip members.

With Service Providers

We share your information with third-party service providers who perform services on our behalf, including:

• Supabase — cloud database, authentication, file storage, and backend infrastructure
• Stripe — payment processing for trip credit and storage pack purchases; Stripe receives the information you enter on their checkout page and returns only a transaction confirmation to us
• Google Firebase Cloud Messaging (FCM) — push notification delivery; receives your device push token
• Google Firebase Crashlytics — crash reporting and error diagnostics; receives device state, error details, breadcrumb logs, and the user ID we associate with your account
• Google Gemini Vision API — receipt OCR processing; receives receipt images only when you explicitly use the scan receipt feature
• Google Identity / Apple Identity — authentication; if you sign in with Google or Apple, those providers verify your identity and share your name and email address with us
• Nominatim / OpenStreetMap — location autocomplete; your destination search queries and IP address are sent to OpenStreetMap's servers when you search for a trip destination
• open.er-api.com — currency exchange rates; fetched automatically when you add a multi-currency expense; no personal data is included in these requests beyond your IP address
• Email communication services — transactional emails such as account verification
• Analytics providers — aggregated usage analytics to understand how the Service is used

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

Business Transfers

If TripHub is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Data Security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security audits and vulnerability assessments
• Restricted access to personal information
• Secure authentication mechanisms

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security.

Your Rights and Choices

You have certain rights regarding your personal information:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to certain exceptions)
• Portability: Request a copy of your data in a machine-readable format
• Objection: Object to our processing of your personal information
• Withdrawal of Consent: Withdraw consent where we rely on consent to process your information

To exercise these rights, please contact us at support@triphubapp.io.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Media Expiry for Completed Trips

Photos and videos uploaded to a trip are retained for one year after that trip's end date once the trip is marked as completed. After this period, media files are automatically and permanently deleted from our servers. You will receive a notification in advance of expiry and can use the bulk-download feature in the Trip Memories screen to save your files to your device before they are removed.

Account Deletion

When you delete your account, we will delete or anonymize your personal information, except where we need to retain it to comply with legal obligations or protect our legitimate interests.

Children's Privacy

Our Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will delete such information.

International Data Transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. We take steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: