Privacy Policy

Last updated: July 2026

1. Controller

[First and last name], [address], email: [email address]

2. General

TripSake is an application for planning trips together and is currently in a testing phase. We process personal data only to the extent necessary to provide the app (Art. 6(1)(b) GDPR) or where we have a legitimate interest in operating it securely (Art. 6(1)(f) GDPR).

3. Hosting

The app is hosted on servers operated by Hetzner Online GmbH (Gunzenhausen, Germany). When you access the app, technically necessary data (IP address, time of access, page requested, user agent) is processed in server logs and deleted after a short period.

4. Registration and sign-in

You sign in via email (magic link) or via your Google, Facebook or X account (OAuth), all handled through Supabase (Supabase Inc.). With social sign-in, we receive your email address and display name from the respective provider. Your email address and sign-in timestamps are processed in the process. Guests can join via invite links as anonymous users without providing an email address; in that case only a technical identifier is created.

5. Content you create

Content you create in the app — trips, places, bookings, packing lists, expenses, photos, voice and text notes — is stored in our database (Supabase) and is visible only to members of the respective trip. You can delete your content yourself at any time.

6. Location data

The live feature can access your device location in order to share it with your trip members. This only happens after your explicit consent in the browser or operating system (Art. 6(1)(a) GDPR) and can be stopped at any time.

7. Google services

We use the following services of Google Ireland Limited / Google LLC:

Google services may involve data transfers to the USA; Google is certified under the EU-U.S. Data Privacy Framework.

8. Cookies and local storage

We use technically necessary cookies and browser storage for session management (login); these require no consent. We do not use advertising cookies.

In addition, we use PostHog (EU-hosted) for privacy-friendly product analytics — no autocapture, no cross-site tracking, and profiles only for signed-in users. This runs only with your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG), which we ask for on your first visit. You can withdraw or change your choice at any time here:

9. Storage period

Data is stored for as long as your account or the respective trip exists. As the app is in a testing phase, data may also be reset or deleted at any time as part of testing.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to lodge a complaint with a data protection supervisory authority. To exercise these rights, contact the email address given above.

11. Deleting your account

You can delete your account, including all personal data, yourself at any time: in the app via the account menu or directly at delete TripSake account. Deletion takes effect immediately and is irreversible.