Trippy Privacy Policy

1. Who we are

Trippy is an independent project, currently in open beta, built and run from Albania by an individual developer rather than by a company. That person determines what Trippy does with personal data and is therefore the data controller for everything described in this policy. They can be reached at info@kvn.onl, which is the only address you need. If Trippy is ever incorporated, this section will name the company and this policy will be updated before that happens.

In this policy, "Trippy", "we", "us" and "our" all mean that developer acting as controller.

For anything at all — privacy questions, exercising your data-protection rights, or support — write to info@kvn.onl. It is the only address you need.

This notice is intended to describe Trippy's processing under Albania's Law No. 124/2024 "On Personal Data Protection" and, where applicable, Regulation (EU) 2016/679 (the GDPR).

2. What Trippy does

Trippy lets users create and manage trips, timelines, travel locations, tickets and booking files, links, checklists, reminders, photos and videos, maps, weather information, and shared trips. Trippy is a trip manager; it is not a travel agency, booking provider, airline, railway operator, navigation provider, or emergency service.

3. Personal data we process

3.1 Account and profile data

When you create or use an account, we may process:

• username;
• email address;
• first and last name;
• password hash and authentication/security records;
• email-verification status;
• account creation and update timestamps;
• account/storage-plan information and limits;
• which version of these documents you agreed to, and when. We keep the earlier entries as well as the current one, so the record shows what you were shown at the time;
• which photos and videos you added to a trip, so collaborators can tell whose is whose. See section 10.3.

We do not store your password in plain text.

If you sign in with Google, we receive the Google account identifier and identity information needed to authenticate or link your Trippy account, such as your verified email address and, where provided, your name. Google processes your use of Google Sign-In under its own terms and privacy policy.

3.2 Trip and itinerary data

Depending on what you choose to add, we may process:

• trip names, descriptions, start and end dates;
• time zones and preferred currency;
• destinations, place names, addresses, country/locality information and geographic coordinates;
• timeline entries such as flights, trains, buses, hotels, events, activities, restaurants, transfers and reminders;
• departure, arrival, check-in, check-out and "be there by" times;
• provider names, booking or reference codes, payment status and costs;
• map URLs and other links;
• notes and checklists;
• trip cover images.

This information can reveal where you intend to travel, where you have travelled, where you are staying, and when you expect to be at particular places. Treat shared trips accordingly.

3.3 Tickets, documents and attachments

You may upload files associated with timeline entries or plans, including tickets, booking confirmations, maps, and, if you choose, passport copies or other files.

Travel documents can contain sensitive identifying information. Only upload documents that are necessary for your use of Trippy, and do not share a trip containing such documents with people who should not have access to them.

3.4 Photos, videos and memories

If you upload trip memories, we may process:

• the photo or video file;
• filename and file type;
• file size and dimensions;
• video duration;
• capture date/time when supplied;
• title;
• the trip and saved place to which the media is assigned;
• media-processing status and compression choice.

Media can contain personal data about you or other people. You are responsible for ensuring that you have an appropriate basis to upload and share media containing other people.

3.5 Sharing and collaboration data

A trip can be shared with other authenticated Trippy users as readers or editors.

We process:

• trip membership and role;
• who created an invitation where recorded;
• invitation/share-link token, status and expiry;
• collaborator account identifiers.

The trip owner can view collaborator usernames and email addresses when managing collaborators.

Readers can view shared trip resources. Editors can make changes to shared trip resources. Depending on the trip content, shared resources can include timeline details, locations, ticket/booking attachments and trip media.

A share link is normally time-limited, but joining a valid share link creates a trip membership that can continue until the owner removes that membership or the trip/account is deleted.

3.6 Reminders, notifications and device data

If you enable browser push notifications, we may process:

• your push-service subscription endpoint;
• cryptographic subscription keys required to deliver encrypted push messages;
• browser/user-agent information;
• last-seen or delivery-failure timestamps;
• reminder times and delivery status.

Push notifications are optional. You can revoke browser notification permission through your browser/device settings and can disable reminders in Trippy where that setting is available.

3.7 Maps, places and weather

Trippy uses mapping and location-related providers to provide selected features.

Google Maps Platform. When Google Maps or Google Places features are used, search text, selected place information, map requests, coordinates and technical/network information may be sent to Google as necessary to provide those features. Google may independently process information such as the requesting device's IP address and service usage under Google's terms and privacy policy.

The globe's map tiles. The globe draws its imagery from an external tile source. That provider receives technical request information, including your IP address and which tiles you are looking at, when the imagery loads.

Open-Meteo. Where weather is enabled, Trippy sends approximate trip-location coordinates and a requested time zone to the configured Open-Meteo endpoint to retrieve current weather. Trippy caches weather by rounded coordinates and time zone so that users requesting weather for approximately the same area can reuse a cached response rather than triggering a new provider request.

Google Maps links. When you choose "Open in Google Maps", your browser or device opens an external Google Maps page or app. Your activity after leaving Trippy is governed by Google's terms and privacy policy.

3.8 Technical, security and cookie data

Trippy uses essential authentication cookies named trippy_access and trippy_refresh. They are HttpOnly, use SameSite=Lax, and are Secure in production. The access cookie is designed to expire after approximately 15 minutes and the refresh cookie after approximately 30 days unless refreshed, revoked or cleared earlier.

Our servers, reverse proxy and infrastructure providers may also process ordinary technical records such as IP address, request time, requested route, response status, browser/user-agent information and error/security logs.

Trippy does not currently include third-party advertising or behavioural-advertising analytics in the reviewed application code.

4. Where the data comes from

We receive personal data:

• directly from you;
• from another user when they add information to a trip shared with you or invite you to a trip;
• from Google when you choose Google Sign-In;
• from Google Maps/Places or other configured map/location providers when you request a place or map feature;
• from the weather provider when you request weather information;
• automatically from your browser/device and service infrastructure as needed to authenticate, secure and deliver the service.

If you add personal data about another person to a trip, you are responsible for having a lawful reason to do so and for sharing it only with appropriate collaborators.

5. Why we process personal data and our legal bases

Where the GDPR applies, we rely on the following legal bases as appropriate:

Where we rely on legitimate interests, we consider whether those interests are overridden by your rights and reasonable expectations.

We do not use consent as a blanket legal basis for everything described in this policy. Where processing depends on consent, you may withdraw that consent at any time without affecting processing that was lawful before withdrawal.

6. Who can receive your data

6.1 People you share trips with

When you share a trip, people who become collaborators can access data contained in that shared trip according to their role. Editors can change or delete trip resources; readers have read access.

Do not share a trip that contains tickets, passport copies, booking references, precise travel timing, addresses, photos or other private information unless you intend the collaborator to receive that information.

6.2 Service providers

Trippy runs on infrastructure operated by other companies. We do not name them individually, but this section says what each kind of provider actually receives, so that you can judge it.

Providers that hold your data on our behalf. These process it under our instructions and for no purpose of their own:

• Hosting and database. Everything you store in Trippy: your account, trips, timeline, places and the text you write.
• Private object storage. Your photos and videos, and the documents you attach to timeline items — tickets, bookings, and passport copies if you upload them. Files are stored privately and served through links that expire. Our encrypted database backups are kept here too, which means this provider also holds a copy of everything under "Hosting and database" above, for the 14 days described in section 12.
• Email delivery. Your email address and the contents of the messages we send you: verification, password resets, and similar.

Providers that receive data because your browser contacts them directly. These are the ones worth knowing about, because your device speaks to them rather than us relaying on your behalf:

• Google — Maps and Places. See section 7. Using Google here is a choice, not a requirement: when you add a place you pick between Google search, pasting a map URL, or typing the details yourself, and the Google code is only loaded if you choose Google. A trip that has locations with coordinates also displays a map, which loads from Google.
• Map tiles for the globe. The globe draws its imagery from a tile provider, which receives your IP address and which parts of the world you are looking at.
• Browser push. If you turn on reminders, delivery goes through the push service your own browser uses — Google, Mozilla or Apple, depending on the browser. It receives the encrypted notification and the address of your device's subscription. It cannot read the contents.
• Google Sign-In. Only if you choose to sign in with Google. You can use an email address and password instead.

Providers we send a small amount of data to. Weather for a trip is fetched from an external weather service. We send it approximate coordinates — deliberately rounded, so it identifies an area of roughly a kilometre rather than an address — and a time zone. We send no account information with it.

Each provider receives only what the feature needs. Where a feature is optional, not using it means the provider is not contacted at all.

6.3 Legal and safety disclosures

We may disclose information where required by law, court order or a competent authority, or where reasonably necessary to protect legal rights, investigate abuse, or protect the security of Trippy and its users, subject to applicable law.

6.4 No sale of personal data

We do not sell your personal data or provide it to third parties for third-party targeted advertising.

7. Google Maps and Places

Trippy integrates Google Maps Platform features, including Google Maps and Google Places. Use of those Google-powered features is also subject to the current Google Terms of Service, Google Maps Additional Terms of Service, and Google Privacy Policy.

You do not have to use them. When you add a place, Trippy offers three ways to do it:

1. Search Google — your search text and selection go to Google, and Google independently receives your device's IP address and usage information under its own terms.
2. Paste a map URL — Trippy reads the coordinates out of the link on our own server. Google is not contacted by your browser.
3. Type the details yourself — name, address and coordinates, with nothing sent to any map provider.

The Google code is only loaded into the page if you choose the first option. A trip that has locations with coordinates also shows a map, which loads from Google.

When you choose "Open in Google Maps", your browser or device leaves Trippy for Google, and what happens after that is governed by Google's terms and privacy policy.

8. International processing and transfers

Trippy is operated from Albania. Some service providers may process data in other countries, including countries outside Albania or the EEA.

Where GDPR restrictions on an international transfer apply, we will use a lawful transfer mechanism and appropriate safeguards where required, such as an applicable adequacy decision, approved standard contractual clauses, or another mechanism permitted by law.

Where restrictions on an international transfer apply, we use a lawful transfer mechanism and appropriate safeguards, such as an applicable adequacy decision or approved standard contractual clauses. You can ask us at info@kvn.onl which countries are involved for a particular provider.

9. How long we keep data

We keep personal data only for as long as reasonably necessary for the purposes described above, subject to legal obligations and the following general rules:

• Account/profile data: while your account remains active, then deleted or anonymised through the account-deletion process except where retention is legally required.
• Trips, timelines, places, links, checklists and attachments: until you or an authorised editor deletes them, the owning trip is deleted, or the owning account is deleted, subject to the shared-trip rules below.
• Photos/videos: until deleted from the trip or the account, subject to the shared-trip rules below and to storage cleanup. Media on a trip that more than one person can edit is kept with the trip when a contributor's account is deleted.
• Push subscriptions and reminders: until removed/disabled, invalidated, or your account is deleted.
• Authentication cookies: approximately 15 minutes for the access cookie and 30 days for the refresh cookie, subject to rotation, revocation and manual clearing.
• Share links: a newly created link is normally valid for 24 hours; membership created by joining is separate and can persist beyond the link expiry.
• Security, application and reverse-proxy logs: 30 days, after which they are rotated away automatically. These logs can contain IP addresses and request paths. We keep a specific log longer only where it is necessary to investigate a particular security incident or legal claim.
• Backups: the database is backed up daily and each backup is deleted 14 days after it is made. Data removed from active systems can therefore remain in a backup for up to 14 days after removal. In the case of a deleted account, that is at most 14 days after the 30-day deletion window closes. Backups are never used to serve the product; if one is ever restored, deletions are reapplied.
• Deleted files: when you delete a photo, video or document, it stops being available immediately, and the storage service keeps a recoverable copy for a further 14 days before erasing it. This exists so that a mistake on our side — a compromised key, an accidental mass deletion — can be undone rather than losing your trips permanently. It is not used to restore anything you deleted yourself, and after 14 days the file is gone.

We may retain minimal information longer where required by law or reasonably necessary for the establishment, exercise or defence of legal claims.

10. Account deletion

You can delete your account from your Profile, or by writing to info@kvn.onl. We ask you to confirm who you are first — your password, or a fresh Google sign-in if that is how you sign in.

Deletion is scheduled 30 days ahead, and nothing is destroyed until then. During those 30 days the account is signed out everywhere and locked: you can still sign in, but the only things you can do are take a copy of your data, restore the account, or sign out. Restoring cancels the deletion entirely. If you do nothing, it runs when the 30 days are up.

The window exists because none of this can be undone afterwards. If you would rather it happened sooner, write to us.

10.1 Trips you own

For a trip that you own and that nobody else can edit, account deletion will normally delete the trip and its associated timeline data, attachments, memories and sharing records from active systems. Readers do not change this: a trip shared only with readers is treated as a trip you own alone, and those readers lose access when it is deleted.

If you own a trip that another user can edit, the trip is not deleted. Ownership passes to one of its existing editors, and the trip keeps its timeline data, attachments and memories, so that the people who built it with you do not lose their work because you left.

This means content you added to that trip, including photos and videos, stays with the trip after your account is deleted. Section 7 of the Terms of Service sets this out as a condition of collaborating rather than something applied afterwards. You can delete anything you do not want to leave behind before you delete your account.

10.2 Trips owned by someone else

If you are a collaborator on another person's trip, deleting your account removes your membership and your access.

Content you added to that trip stays with it, on the same basis as above: a shared trip belongs to the people collaborating on it rather than to any one of them. Where Trippy records that you created or uploaded an item, that attribution is removed or anonymised as described below. Where retained content contains personal data about you, you may still exercise applicable erasure, objection or restriction rights, and you can delete content you do not want to leave behind before you delete your account.

10.3 Attribution in shared content

Photos and videos record who added them, so that people working on a trip together can tell each other's contributions apart. When your account is deleted that name is removed automatically — the record keeps the photo, which belongs to the trip, and forgets who added it.

Memories added before we started recording this carry no uploader at all, and we do not guess one. Such content can remain as trip content if it is not otherwise required to be erased, but you can contact us about personal data contained in it.

10.4 Files, providers and backups

Account deletion includes deleting the applicable files from local and object storage, not only the database records. As described in section 12, the storage service then holds a recoverable copy of each deleted file for 14 days before erasing it.

Some provider-side technical records are controlled by the relevant provider and are retained under that provider's policies.

Deleted data can remain in a database backup for up to 14 days after it leaves active systems, which is how long each backup is kept (section 12). We do not restore deleted data to ordinary use because it happens to still be in a backup, and if a backup is ever restored, the deletions are reapplied.

10.5 Legal exceptions

The right to erasure is not absolute. We may retain specific information where processing remains necessary for a legal obligation, the establishment/exercise/defence of legal claims, or another exception permitted by applicable law.

We will act on valid data-subject requests without undue delay and, where the GDPR applies, provide information about action taken within one month unless the legally permitted extension applies.

11. Your data-protection rights

Depending on the law that applies to you, you may have rights to:

• obtain information about our processing;
• access personal data we hold about you;
• correct inaccurate or incomplete data;
• request erasure;
• request restriction of processing;
• receive eligible data in a structured, commonly used, machine-readable format and exercise data portability;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

To exercise a right, write to info@kvn.onl. We may request information reasonably necessary to verify your identity.

If you are in Albania, you may also contact the Commissioner for the Right to Information and Personal Data Protection (IDP). If the GDPR applies, you may lodge a complaint with an appropriate EEA supervisory authority, including in the Member State of your habitual residence, place of work, or the alleged infringement.

12. Security

Trippy uses technical and organisational measures intended to protect personal data, including authenticated access controls, role-based trip permissions, password hashing, short-lived access tokens, refresh-token revocation/blacklisting, private authenticated file access, private S3-style signed access when S3 storage is enabled, and encrypted browser push payloads.

No internet service can guarantee absolute security. You are responsible for keeping your credentials secure, protecting your devices, and sharing trips only with people you trust.

13. Cookies, PWA storage and local device data

Trippy uses strictly necessary authentication cookies to maintain your signed-in session.

The Progressive Web App service worker caches application shell/static assets to improve availability. It is configured not to cache API requests as application data.

Google and other externally loaded providers may use their own storage or process device/network information under their own policies. If non-essential analytics, advertising or similar technologies are added later, this policy and any legally required consent mechanism must be updated before those technologies are enabled.

14. Children

Trippy is not intended for children under 16. If you believe a child has provided personal data to Trippy in circumstances that are not legally permitted, write to info@kvn.onl so that we can investigate and take appropriate action.

15. Automated decision-making

Trippy does not currently use personal data to make solely automated decisions that produce legal effects or similarly significant effects on users.

Timeline calculations, time gaps, weather display and map/location features are informational product functions and are not legal or eligibility decisions about a user.

16. Changes to this policy

We may update this Privacy Policy when the service, providers, legal requirements or data practices change. We will update the "Last updated" date.

When the policy changes, Trippy shows you a notice in the app the next time you open it, with a link to the new version. This is a notice rather than a request: a privacy policy describes what we do, so there is nothing here for you to agree to, and dismissing the notice does not sign anything away. It records only that you were shown it, which is what stops it appearing again.

17. Contact

Controller: the independent developer who operates Trippy, Albania (open beta; see section 1) Everything, including privacy requests: info@kvn.onl