Privacy Policy

TripperLife, LLC operates Tripper and the related launch website. This policy explains how we handle information for trip organisation, social features, AI planning, digital-guide purchases and creator payouts. The initial app launch is for adults aged 18 or older in the United States.

1 Information and purposes

We use information for the features and purposes described here, to meet applicable legal duties and to maintain the service. Optional device permissions and consent-based features are handled through the relevant controls. We request access relevant to the feature you choose.

2 Private and shared information

Sharing a post, guide or trip makes the selected content available to the audience you choose. Place reviews, ratings and photos you add to places are public to signed-in users and show your display name and profile photo; guide ratings are private and only averages are shown. You can delete them at any time in the app. The location and time a place photo was taken are visible only to you. Other participants may receive or retain information needed for the collaboration. Review audience settings and avoid sharing another person’s information without appropriate authority. We use engagement and transaction information to operate social and marketplace features and provide appropriate creator metrics, rather than disclosing unrelated private trip content to creators.

Travel dates, locations and photo metadata can reveal where you or another person are or plan to be. Review content before sharing it. Device location permission and location information already embedded in an uploaded photo are separate: turning off device location does not remove location metadata from files you provide.

3 OpenAI trip planning

When you request an AI-generated trip plan, we send only the trip details you enter for that request to OpenAI to generate travel suggestions: destination, dates, travellers (including any child ages you enter), preferences (including any dietary or mobility needs you choose to add), must-see places and free-text notes. Nothing else from your account is shared for planning.

Planning does not automatically pull information from your profile, saved trips, messages or photos. Only enter dietary, mobility or other personal details that you want reflected in the plan, and only enter information about other travellers that you are authorised to share. Avoid unnecessary identifiers or private documents in free-text fields.

Before your first AI-planning request, we identify OpenAI and the information categories above in the app and ask for your affirmative permission. You can decline and continue using manual trip-organisation features. Withdraw permission in Settings → AI planning → Withdraw permission, or contact [email protected] for help. Withdrawal stops future requests and queued requests that have not yet left your device. It cannot recall information already transmitted or automatically delete completed plans. We ask again before materially expanding the disclosed recipients, information categories or purposes.

OpenAI processes API content under its business terms and API data controls. By default, API inputs and outputs are not used to train its models unless the customer explicitly opts in. Planning-data retention depends on the endpoint, feature and applicable settings; security or abuse-monitoring retention may apply. The moderation endpoint has different retention controls from generative planning.

4 Content safety

We use automated checks and human review to enforce our Community Guidelines. Post and guide text and images, and comment text where applicable, may be sent to OpenAI’s moderation API. Keyword filters can also block prohibited text in posts, comments, polls and guides. These checks are separate from optional AI trip planning; permission for planning is not permission for a different use of information.

Depending on the feature and checks enabled, review can happen before or after publication. Automated results can prevent posting, hold content for checking, limit its visibility or send it for human review. A score or report alone is not proof of a violation. You can request a free human review of a moderation decision.

You can start a direct private conversation only with a friend. People who are not friends can communicate in a shared trip’s chat. We do not send private messages, private trip notes or private trip photos to OpenAI for routine safety scanning, and we do not routinely read private messages. You can report an individual message or user, block a user, leave a conversation, or contact [email protected]. We may review information you report and relevant account or content information needed to investigate a credible safety or legal concern, with access limited to that purpose.

For supported post and profile images, we may also use Microsoft PhotoDNA to compare image fingerprints with known child sexual abuse imagery. For this separate check, Tripper generates the fingerprint in its own infrastructure and sends Microsoft only the hash, not your photo, an image URL or your Tripper account details. A hash is not a viewable copy of the photo, and this check is not facial recognition. A possible match is a safety signal requiring appropriate handling; it does not establish a violation by itself.

Where we become aware of apparent child sexual abuse material, we make reports to the National Center for Missing & Exploited Children (NCMEC) as required by US law. These reports are separate from PhotoDNA hash matching and may include the reported content and relevant account or technical information required or permitted by law. We may preserve evidence and limit or delay notice where the law or a concrete safety or investigation risk requires it. See our Child Safety Standards and intimate-image removal process.

We use appropriate case information to investigate reports and provide the applicable human appeal process. Copyright notices and counter-notices use their own legal procedure; relevant notice and contact information may be shared with the affected parties as that procedure requires. We do not promise that formal copyright complainant or counter-notifier details remain confidential.

5 Purchases and creator verification

Apple or Google handles launch purchase billing. We use RevenueCat to help manage purchase records, subscriptions and access entitlements. These flows can involve app/account identifiers, receipts or purchase tokens, device/platform information and purchase status/history. The store handles the payment credentials you provide to it.

For creator verification and payouts, you submit identity documents and bank details directly to Stripe through its hosted onboarding pages. We receive account identifiers and verification and payout-status information needed to administer your creator account.

We also keep the transaction, earnings and adjustment records needed for payments, accounting, disputes and applicable tax duties, and we receive payout-status and related financial information from Stripe. We and our providers may collect tax certifications (such as Form W-9 or W-8 information through Stripe-hosted onboarding), report creator payments where required, and apply withholding where the law requires it.

6 Hosting and service providers

Cloudflare supports the website and app infrastructure. Supabase supports app authentication, database and related account services. Google Firebase supports push delivery and optional crash diagnostics. OpenAI, RevenueCat, Apple, Google Play and Stripe have the roles described above. We share information needed for the relevant service or applicable legal purpose, subject to the actual arrangements and protections that apply.

If you use Apple or Google sign-in, that provider supplies the account identifier and the name or email information authorised in its sign-in flow; Apple may supply a private relay email address. Microsoft’s role, where PhotoDNA matching is enabled, is the hash comparison described above. Cloudflare’s email service supports automated moderation notices where enabled; email delivery services process the recipient address and the notice content needed for delivery.

Map and place services, public-photo sources, weather services and currency-rate services receive the requests needed for the feature you use. A provider contacted directly by your device can receive its IP address and request details; a request sent through Tripper’s servers instead exposes the server’s connection details. Location-based requests can include coordinates or a place query. Your device’s Apple or Google geocoding service may also process coordinates to look up an address. We do not intentionally attach unrelated Tripper account or private-trip details to these requests.

Some providers have their own legal, security or compliance responsibilities. Their notices and applicable terms explain that processing. We do not describe every recipient as using data solely on our instructions for every purpose. Information may be processed in the United States and other locations where the service or providers operate, subject to applicable legal requirements and contractual protections.

7 Notifications and diagnostics

Notification delivery uses Google Firebase Cloud Messaging and the applicable platform push service. Registration tokens identify app installations for delivery; they can be linked with your Tripper account and platform information. Tokens may be registered at sign-in even when your device does not display notifications. Any message preview included in a notification payload is processed through the delivery services. Manage display permissions in your device settings.

Crash diagnostics are optional and off until you choose to enable them. You can change the choice in Settings under Diagnostics. Enabled reports can include error/stack information, app/device details and installation/session identifiers; we do not attach your Tripper user identifier to crash reports. Native or third-party crash reports may include information our own filtering cannot remove. Disabling future collection does not recall reports already sent to the provider.

8 Advertising and marketing

For the launch, we do not sell personal information or share it for advertising based on activity across other companies’ apps or websites. Necessary service-provider processing is described separately above. We are not adding AdMob at this launch.

You can unsubscribe from marketing updates using the provided link. Necessary account, purchase, safety and privacy messages may still be sent. A website signup can also involve security and request metadata; we do not describe it as collecting only an email address in all circumstances. If we introduce advertising in the future, we will update this policy and our store declarations, and obtain any permission or provide any opt-out that applicable law and platform rules require, before doing so.

Website cookies and storage

The website uses functional and security technologies. Cloudflare Turnstile processes browser and network signals to help prevent automated abuse and may use security cookies or similar technologies; see its privacy notice. We store your light/dark theme choice in browser local storage. The account-deletion sign-in flow uses browser session storage to maintain your session while the tab is open. Blocking these technologies may affect the relevant features.

9 Retention and account deletion

We keep user-saved private trip history while the account remains open unless you delete it or another applicable removal reason arises. At launch, we do not automatically delete saved trips solely because you stop logging in. This is not a promise of perpetual service or storage.

You can initiate account deletion in the app’s account settings. You can also request account deletion from our website without reinstalling the app. Sign in to the account you want to delete or request a one-time sign-in link by email, then confirm your request. If you cannot use that flow, contact [email protected]. We may use proportionate verification to protect your account, explain the expected completion time and confirm completion. We handle requests within applicable deadlines.

How long we keep information depends on its category. Account, trip and social content is generally kept while your account remains open. We keep safety, moderation and dispute records while the case or appeal is open, and afterwards only as needed for applicable appeal periods, repeat-conduct enforcement, disputes and legal duties. We assess that need and delete or de-identify records when it ends. Photos and other content kept as evidence for an open report or moderation review are deleted 90 days after the report or review closes, unless a legal hold or the preservation requirement below applies. Purchase, payout, tax and accounting records are generally kept for seven years. Longer retention may be required for a legal hold or an unresolved dispute, chargeback or payout.

For a report submitted to NCMEC’s CyberTipline, we preserve the reported material and reasonably accessible related information covered by the US preservation requirement for at least one year after submission. Access is restricted for child-safety handling and lawful disclosure. A legal preservation request or other justified legal obligation may require a longer period.

We normally complete account deletion within 24 hours after a verified request and in any event within 30 days, and we confirm when deletion is complete. Backup copies are kept only for disaster recovery and expire on a rolling schedule; if a backup is ever restored, we take steps to re-apply completed deletions.

On deletion, we delete account-associated personal and social data as required by law and platform rules. Some content is kept for other people, as explained on the account-deletion page: trips you share with others stay for them, with what you added; messages you sent, including direct and group messages, stay with their recipients; and published guides, along with guides others bought, saved or used, may remain available for continued use. Your place photos are deleted. Place reviews and ratings you wrote stay, with your name and profile photo removed, and guide ratings still count toward averages. New guide sales stop when the creator account is deleted.

Retained content is shown under the neutral label “Deleted user”, or without a name, with your profile and contact links removed; credits required by law or a licence are preserved. Identifying information embedded in retained content does not become anonymous simply because the byline changes. The Creator Terms describe the limited buyer-fulfilment licence. Necessary financial, safety and legal records have restricted access and are not repurposed for unrelated marketing.

Account deletion does not itself cancel an Apple or Google subscription. The deletion flow directs you to the store’s subscription controls, and deletion remains available without waiting for subscription expiry or final creator settlement.

10 Choices and privacy requests

Use the relevant sharing, device-permission and diagnostics controls for those features. Withdraw AI-planning permission in Settings → AI planning → Withdraw permission, or ask us for help. Contact [email protected] to request access, correction, deletion or a copy of your information. Additional rights, including objection, restriction, appeal or an authorised-agent route, apply where the relevant law provides them. We verify and respond proportionately, explain any applicable exception or refusal and provide an applicable appeal route without unlawful discrimination.

Adults may provide information for family trips. Do not create an account for a child. If you believe a person under 18 holds an account or that children’s information has been handled improperly, contact us. We assess the report and take the appropriate steps under applicable requirements.

11 Security and policy changes

We use appropriate measures intended to protect information and restrict access to the relevant service and safety purposes. No service can guarantee absolute security. Tell support promptly if you suspect an account compromise; do not send passwords or authentication codes by email.

If we make a material change to how we use or share personal information, we will provide appropriate advance notice and obtain any consent required before applying the change. An updated policy does not by itself authorise broader use of information collected under earlier privacy commitments.

TripperLife, LLC
10520 New Arden Way
Raleigh, NC 27613, United States
Support [email protected]
Privacy [email protected]
Telephone +1 (919) 356-9072