Privacy Policy

Welcome to Triplanex (“we”, “us”, “our”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our trip-planning web application at triplanex.com (the “Service”).

By using the Service, you agree to the collection and use of information in accordance with this policy.

2a. Information you provide directly

• Account information: name, email address, and password when you register.
• Profile information: avatar photo, home currency preference.
• Trip data: trip names, destinations, itinerary items, expenses, hotel details, wishlists, and packing lists.
• Places and map pins: the places you add to a trip (names, addresses, and the map position of each), and any Google Maps link you paste, which is saved with the item.
• Payment information: processed securely by Stripe. We do not store your card details.

2b. Information collected automatically

• Usage data: pages visited, features used, and actions taken within the app.
• Device information: browser type, operating system, IP address.

We do not use advertising or analytics trackers, and we never ask for your device's location. Places on the map come only from what you add or search for.

• To provide and maintain the Service.
• To process your subscription payments via Stripe.
• To send transactional emails (trip invitations, password resets) via Resend.
• To improve the Service based on usage patterns.
• To respond to your support requests.
• To comply with legal obligations.

We will never sell your personal data to third parties or use it for advertising purposes.

Your data is stored on Supabase infrastructure (AWS, ap-southeast-1 region). All data is encrypted in transit using TLS and at rest using AES-256. Access to production databases is restricted to authorised personnel only.

We implement Row Level Security (RLS) policies so users can only access their own data and the trips they're members of.

We use the following third-party services:

• Supabase: database, authentication, and file storage.
• Stripe: payment processing and subscription management.
• Resend: transactional email delivery.
• Vercel: hosting and edge infrastructure.

Maps, place search, flights, weather and exchange rates use a few more services, listed in the next section.

Public holiday dates come from the open-source date-holidays project (CC-BY 3.0). Dates are a guide; check with your employer.

Each provider has their own privacy policy. We encourage you to review them.

Some features send a small amount of information to other services so that they can answer. We send only what the request needs, and none of it is used for advertising.

• Map tiles (OpenFreeMap): when you open the day map, your browser asks OpenFreeMap for the map pictures of the area you are viewing. They can see your IP address and the area. Map data is © OpenStreetMap contributors.
• Place search (Photon by Komoot, Nominatim by the OpenStreetMap Foundation): the text you type into a place search, and your trip's destination so results near it come first, are sent from our servers to these services. Your name and email are not sent.
• Google Maps links: when you paste a Google Maps link, our server opens that link to read where it points, and may look up the address it names in OpenStreetMap. We do not send Google your account details. We save the resulting map position and the link with the item.
• Flight lookup (AeroDataBox via RapidAPI): the flight number and date you look up. Airport names and positions come from the public OurAirports list that is built into the app, so they are not requested from anyone.
• Weather (Open-Meteo): your trip's destination position and dates.
• Exchange rates (Open Exchange Rates): the two currencies being converted.
• Fonts and icons (Google Fonts): your browser loads the icon font from Google, which can see your IP address and browser details.
• Sign in with Google: if you choose it, Google shares your name and email with us as part of signing in.

We use session cookies provided by Supabase to keep you logged in. We do not use tracking or advertising cookies. You can disable cookies in your browser settings, but some parts of the Service may not function correctly.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Export your data in a portable format.

To exercise any of these rights, contact us at privacy@triplanex.com.

We retain your data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.

The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If we discover that a child has provided us with personal data, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or by a prominent notice on the Service. The Last updated date at the top of this page indicates when this policy was last revised.

If you have any questions about this Privacy Policy, please contact us at privacy@triplanex.com.