Privacy Policy

Last updated: 1 November 2026

Trips Planner (“we”, “the service”) is a free website for planning trips day by day, alone or with friends. This policy explains what personal data we handle, why, who helps us, and what you can do about it. Questions: hello@trips-planner.xyz.

Who is responsible

The service is run by its developer, the data controller for the purposes of the GDPR. You can reach us at hello@trips-planner.xyz.

What we collect

• Account: email address, password (stored only as a hash by our authentication provider), or your Google account email and name if you sign in with Google; the date the account was created and last signed in.
• Profile: username, avatar colour, an optional photo, time format, and your email settings (new-member emails, news).
• Trips: everything you and your fellow travellers enter — trip names, dates, cities, places, times, notes, transfers — plus who is a member of which trip with which role, and invite links.
• Guests: if you use “Try without signing up”, we create a temporary account without an email. It holds the same profile and trip data.
• Technical data: IP address, browser and device information, and timestamps in server logs and error reports; which people are online in a trip right now (not stored).
• Analytics: only if you accept cookies — pages visited and general device and location information via Google Analytics.

Why we use it (legal bases)

• To provide the service you asked for: your account, trips, collaboration, emails about your account (contract, Art. 6(1)(b) GDPR).
• To keep the service secure and working: bot protection, error reports, logs, backups (legitimate interests, Art. 6(1)(f)).
• Analytics and the news emails: only with your consent, which you can withdraw at any time (Art. 6(1)(a)).

We do not sell your data and do not show ads.

Who helps us (processors)

• Supabase — database, sign-in and photo storage. Our project is hosted in the EU (Paris).
• Vercel — website hosting; requests are served from the region closest to you, our functions run in the EU (Paris).
• Resend — sending emails (account emails and notifications).
• Cloudflare — domain, DNS, email forwarding for hello@trips-planner.xyz, and Turnstile bot protection on sign-in forms.
• Google — “Continue with Google” sign-in; Google Analytics (only with consent); Google Places search when enabled.
• Sentry — error reports, so we can fix bugs. Reports may include your IP address and browser details.
• Place search and maps: your search text and the map area go to Photon by komoot (OpenStreetMap data), Wikidata (Wikimedia Foundation) and OpenFreeMap map tiles. They see your IP address, not your account.
• GitHub — encrypted daily database backups, kept for about 14 days.

Some of these companies are based in the United States. Transfers rely on the EU–US Data Privacy Framework where the company is certified, or on the European Commission’s Standard Contractual Clauses.

Who else sees your data

People in your trips see your username, avatar and photo, and everything in the trips you share. Anyone with an invite link can join that trip until the owner revokes the link.

How long we keep it

• Account data: until you delete your account.
• Guest accounts: deleted automatically, with their trips and photos, after 30 days without activity.
• Deleting your account removes your profile, photo, and trips where you are the only member. Shared trips pass to another member and stay for them.
• Backups: about 14 days. Server logs and error reports: up to 90 days.

Cookies

Necessary cookies work without consent: signing in, your language, your theme, and remembering your cookie choice (for one year).

Analytics cookies from Google Analytics (_ga, _ga_*) are set only after you click “Accept”. You can change your mind at any time with the “Cookies” link at the bottom of every page.

Your rights

You can access, correct, export, and delete your data, object to processing, restrict it, and withdraw consent. Most of this is in your profile: edit it, “Download my data” under Sign-in and security, and “Delete account”. Turn emails off under Notifications or with the link in any email. For anything else, write to hello@trips-planner.xyz. You can also complain to your local data protection authority.

Age

The service is for people aged 16 and over.

Changes

If we change this policy, we will update the date above, and tell you by email or on the site if the change is significant.