Privacy Policy

Tripkit is built and operated by Omkar Kardile as a personal project, not a company. There's one person behind it. You can reach me at omkarkardiletripkit@gmail.com.

We only collect information that's needed for the app to work or that you choose to enter.

From your Google account (when you sign in)

When you sign in with Google, we receive from Google:

• Your email address
• Your name (whatever your Google account shows)
• Your profile picture URL (the small avatar Google associates with your account)

That's it. Signing in with Google does not give us access to your Gmail inbox, contacts, calendar, drive, or photos. We only use the sign-in to verify "yes, this person is who they say they are."

Separately — and unrelated to your Google account — when you type in a place field (adding an itinerary stop or a trip destination), we send what you type to Google's Maps/Places service to suggest matching places. That's a search-suggestion lookup, not access to your Google account. See Places and location below.

From your use of the app

When you create or join a trip, we store:

• Trips you create or are a member of, including name, destination, dates, the invite-link token, and display choices like the trip's currency, emoji, and colour.
• Tasks you create or are assigned to, including title, category, assignee, status, progress, due date, dependencies, and expense amount.
• Expenses and money data — the expenses you add to a trip (task-linked or standalone), who paid, how each one is split between members, settlements (who has squared up with whom), and payments you record as having paid another member. This is what powers the balances and settle-up features.
• Personal expenses you log for yourself — these are private to you and are not shown to other members of the trip (see "Who sees your data").
• Itineraries — the places you add to a trip's day-by-day plan (place name, day, times, notes), the map coordinates resolved for those places, and your 👍/👎 reactions on a place.
• Polls you create and the votes you cast. Votes are shown by name to the other members of the trip.
• Trip notes (shared reminders) and any custom categories you add.
• Comments and replies you post on tasks.
• Chat messages you send in trip-level chat.
• Files you upload as itineraries or attachments (up to 3 files per trip, 5 MB each).
• Notifications generated for you (a feed stored in the app so you can see recent activity), and your push-notification subscription if you turn notifications on — a device-specific token from your browser that lets us send pings.

Places and location

The itinerary feature works with place names, not your device's GPS location. Tripkit does not track where you physically are. What happens is:

• When you type in a place field, the text is sent to a place-suggestion service (Google's Maps/Places, when configured) to offer matching places as you type.
• When you save a place, its name is sent to a geocoding service (OpenStreetMap's Nominatim) to resolve approximate map coordinates for the pin.
• Those coordinates are sent to a weather service (Open-Meteo) to show the forecast for that place around your trip dates.

These lookups use the place text and coordinates only — they don't receive your name, email, or any account info. The services are listed under "Who sees your data" below.

From your device / browser

• A session cookie so you stay signed in across visits. It contains a token; no personal data.
• Small preferences kept in your browser's localStorage: your theme (light/dark/system), accent colour, corner style, which details show on trip cards, which action buttons you pinned, your trips sort/filter and custom trip order, and which one-time prompts you've dismissed. These are UI choices only, and they never leave your device.
• A service worker is registered in your browser if you enable notifications, so push messages can be delivered even when the tab is closed.

Anonymous usage analytics

If your browser doesn't block it, Vercel Web Analytics records anonymous page views, country (approximate), browser, and device type. It does not use cookies and does not associate visits with your identity. It just helps me find bugs and figure out what's used.

We use the data above only to:

1. Run the app. Show you your trips, show your tasks to friends in the trip, deliver chat messages and notifications.
2. Keep you signed in across visits and devices.
3. Send notifications about events you opted into (comments on your tasks, chat messages, task due-date and settle-up reminders, etc.) — only if you turn them on.
4. Show places and weather on itineraries — suggest places as you type, place a map pin, and display the forecast for each stop.
5. Improve the app. Aggregate, anonymous usage stats help me find bugs and figure out what's used.

We don't sell your data, share it with advertisers, or use it for marketing. There are no ads in Tripkit.

Inside your trips

Anyone you invite to a trip can see most things inside that trip: members, tasks, assignments, comments, chat, attachments, shared expenses and balances, settle-up activity, itinerary places and reactions, polls and how each person voted, and notes. That's the point of a shared planning tool. You decide who's in your trips by sharing invite links with them. People not in a trip cannot see any of it.

A few things stay private to you even inside a trip: your personal expenses (money you logged as spent only on yourself), and your own device preferences (your personal colour for a trip, notification settings, and UI choices). Other members never see these.

Trip leads and members

The "group lead" (whoever created the trip) can edit trip details and remove members. Anyone can leave a trip; doing so removes you from that trip's member list. If the trip lead leaves and is the only member, the trip is deleted.

Third-party services we use

Tripkit is built on top of a few well-known services. Each one sees a specific slice of your data so the app can work:

We don't share data with any service beyond what's listed above.

Data location

All Tripkit application data lives in a Supabase Postgres database in the United States (Supabase's default region). Files you attach are stored in Supabase Storage, also in the US. The place-suggestion, geocoding, and weather lookups described above are handled by their own providers, whose servers may be in other regions. If you're in another country, your data crosses borders to be served. If that's not okay for you, please don't use Tripkit.

Tripkit keeps an in-app notification feed (the bell icon) so you can see recent activity in your trips; this works whether or not you enable push. Separately, you'll only get push notifications (pings when the app is closed) if you explicitly turn them on via the bell icon in the topbar (or the popup that appears in a trip). When you turn push on, your browser generates a push subscription identifier that we store. We send a notification when:

• Someone comments on a task assigned to you
• Someone replies to a comment you posted
• A new task is assigned to you
• A new chat message appears in a trip you're a member of
• A task assigned to you is due soon (a daily reminder)
• Someone in a trip you're in creates a poll
• Another member sends you a reminder to settle up a balance you owe them

You can turn push notifications off any time — either from the bell icon in Tripkit, or in your browser/OS notification settings. Once turned off, we delete your subscription on your next visit.

We do not send marketing or promotional notifications. Ever.

You can, at any time:

• See your data — it's already visible to you in the app.
• Export your data — email omkarkardiletripkit@gmail.com and I'll send you a JSON dump of every row associated with your account, usually within a week.
• Delete your account and all your data — see how to delete your account for the exact steps and what gets removed. In short: email me and I'll wipe everything tied to your account, usually within 30 days.
• Leave a trip — use the "leave" link on your member row. You're removed instantly; comments and messages you posted remain visible to that trip's other members.
• Turn off notifications — bell icon in the topbar.
• Clear preferences and dismissals — clear your browser's site data for Tripkit.
• Block analytics — most ad blockers already do this; Tripkit works fine without analytics.

If you're a resident of a region with stronger rights (EU, UK, California, etc.), you have additional rights to access, correct, restrict, or object to processing. Email me and I'll handle each request individually.

• While your account exists: we keep your data because the app needs it.
• When you delete your account: we delete everything from the active database within a few days.
• Backups: Supabase keeps automated daily backups for 7 days on the free plan. Once backups roll off, deleted data is gone for good.

We don't keep "shadow" copies for analytics or anything else.

Tripkit uses a small number of essential storage mechanisms in your browser:

• Session cookie — keeps you signed in.
• localStorage — remembers UI choices like your theme, accent colour, what shows on trip cards, pinned action buttons, and your trips sort/filter/order.
• sessionStorage — remembers whether you dismissed the notifications prompt during this browser tab session.
• Service worker — registered if you enable notifications, so pushes work when the tab is closed.

We don't use third-party tracking cookies. The Vercel Analytics service we use is cookie-free by design.

• All traffic is over HTTPS.
• Database access is gated by Row Level Security at the Postgres level — even if app code had a bug, the database wouldn't return your data to someone who shouldn't see it.
• The service-role key used for sending push notifications is server-only and never reaches your browser.
• The Maps/Places API key is used only on the server (place lookups are proxied through Tripkit's backend), so it's never exposed in your browser.
• File attachments are served via time-limited signed URLs (1 hour) rather than public links.

No system is 100% secure. If you spot a vulnerability or a data leak, email me and I'll fix it as a priority.

Tripkit is not intended for users under 13. If you're a parent or guardian and believe a child under 13 has signed up, email me and I'll remove their account and data.

If we materially change how we handle your data, we'll update the "Last updated" date at the top, and reasonable efforts will be made to notify active members via in-app message or the email tied to your Google account. Minor wording fixes won't be flagged.

Questions, requests, or concerns: Omkar Kardile — omkarkardiletripkit@gmail.com.