Privacy Policy

1. Who we are

Tripami is operated by Mythfit Corporation, 17814 N. 35th St., Phoenix, AZ 85032, USA (“Tripami,” “we,” “us”). This policy explains what information we collect when you use the Tripami apps for iPhone and Android and the tripami.io website, how we use and share it, how long we keep it, and the choices you have.

Questions? Email privacy@tripami.io.

2. Information we collect

Information you give us

• Account details: your name, your phone number or email address, how you sign in (with Apple, Google, your phone number or your email address), and an optional profile photo. If you create a password, our sign-in provider stores it in a protected, hashed form, and we never see it.
• Travel preferences (optional): food requirements, food likes and experience interests you choose to save. We use these across your trips to help find options for you and the groups you travel with. Your full account preference profile is private; dietary needs can affect group recommendations. You can change or clear these in Profile. We do not send your full preference profile to recommendation providers or include preference values in usage analytics.
• Trip details: trips, destinations, dates, plans, reservations and confirmation numbers, transportation details, attendance (going, maybe or can’t go), notes, and documents or photos you attach.
• Money details: expenses, receipts you scan or upload, amounts and currencies, who paid, who was involved, and whether a balance is settled. We don’t collect bank or card numbers.
• Messages to us: what you send when you contact support.
• Early access: if you join the early-access list on our website, the email address you enter. We use it to confirm your signup and to send occasional updates about Tripami. Every update includes a way to unsubscribe. With your address we save how you found us: the page you signed up on, the campaign details of the link you followed (such as utm_source), the site that sent you and the random identifier described below. That tells us which pages and campaigns bring people to Tripami.

Information from Apple and Google when you sign in

• Sign in with Apple: your name, your email address (or a private relay address, if you choose to hide yours) and an Apple account identifier.
• Sign in with Google: your name, email address, profile photo and Google account identifier. See section 5.

Information about people you add

When you add someone to a trip, we store the name and the phone number or email address you enter, so we can show them on the trip and share their invite. They appear as invited until they join. Please only add people who would expect to be included.

Information from services you connect

• Gmail (optional): see section 5.
• Voice trip setup (optional): when you tap the microphone, your device’s speech service converts your speech to editable text and may process audio online under its provider’s privacy policy. Tripami does not record or store your audio. Only the text you choose to submit is sent to our itinerary reader to extract trip details for your review.
• AI assistants (optional): if you connect ChatGPT, Claude or Muse by Meta to Tripami, you sign in to Tripami and approve what the assistant can access. We receive the trip details you ask the assistant to save, like a plan, a booking or an expense, but not your conversations. What the assistant reads from your trip is also handled under its provider’s privacy policy. You can disconnect an assistant anytime in Connected accounts.
• Contacts (optional): if you let Tripami use your contacts, it shows them on your device to help you choose people to invite. Tripami doesn’t upload or keep your address book. We store only the people you add to a trip.

Permissions Tripami asks for

Tripami asks before it uses these features of your device. Each one is optional, and you can change your choice anytime in your device settings.

• Camera and photos: to scan receipts, and to attach photos or documents to a trip.
• Notifications: to tell you about changes to your plans, reminders and when to leave.
• Location: only if you allow it, while you use Discover (see section 6).
• Reports and blocks: if you report something, we keep what you reported, who shared it, your reason and your account, so we can review it, and we email those details to our support team. If you block someone, we keep that on your account to hide what they share from you. They aren’t told.
• Partner booking links: when you open a tour or activity’s booking page, or a partner’s search for a place to stay, from Tripami, in the app or through an assistant, we record which experience or which stop and dates it was, the trip, the number of travelers, where you opened it (such as Discover or the trip’s home), the price shown for an experience, when, and a random code for the link. If the partner later reports a booking or commission for that code, we record the partner’s booking reference, its value and our commission. We don’t learn what else you do on the partner’s site.
• Contacts: only to help you choose people to invite.

Information collected automatically

• Device and app information: device model, operating system, app version, language, time zone, and the identifiers we need to send you notifications.
• Diagnostics: the Tripami app doesn’t include a crash-reporting service. If you’ve chosen to share analytics with app developers in your device settings, Apple or Google gives us crash reports and usage statistics that don’t identify you.
• App usage analytics: unless you’re in Europe or you turn it off, the app uses PostHog to see which screens and features people use. PostHog receives the screens you open, a few things you tap (such as which kind of place you look for in Discover or that you opened a notification), when the app opens and closes, and what you do with a trip (such as creating one, adding a plan or expense, starting a poll or joining), whether you do it in the app or through an assistant. It also receives your device model, operating system, app version, language and an approximate location (city and country) it estimates from your IP address. These are linked to your Tripami account ID, so we can see how people go from signing up to planning a trip together. They never include your name, email, your trips’ titles, places, messages, receipts or your device’s location. There’s no screen recording. Turn it off any time in the app under Profile → Share usage data.
• Web app usage analytics: on Tripami for the web (app.tripami.io), unless you’re in Europe, your browser sends a privacy signal, or you turn it off, we use PostHog the same way: it receives the pages you open (with trip IDs, dates and invite codes removed from the address), a few things you do (such as starting to sign in, whether it worked, adding your name, opening Add event, starting a trip, viewing or answering an invite, or copying an invite link) and your browser, operating system and approximate location (city and country), which it estimates from your IP address. Once you sign in, these are linked to your Tripami account ID, and signing in on the web also lets the trip changes you make (such as creating a trip or joining one) be counted, as they are in the app. Before you sign in, an invite page’s view is counted without a profile. They never include your name, email, your trips’ titles, places or messages, and there’s no autocapture of what’s on the page and no screen recording. Turn it off any time from the account menu in the web app → Share usage data.
• This website: its only cookies are the two ad measurement cookies described below. Outside Europe, it keeps a random identifier and the campaign details of the link you arrived on in your browser’s storage. If you join early access, they’re saved with your address as described above.
• Website analytics: we use PostHog, an analytics service, to see how people find and use this website. When you visit, PostHog receives the pages you view and which parts of them you see, the links and buttons you click, whether you start or send the early-access form and whether it goes through, how far you scroll and how long you stay, the site or campaign link that sent you, your browser, operating system, language, time zone, device type and screen size, and your approximate location (city and country), which it estimates from your IP address. It uses the random identifier to tell visits apart. It doesn’t record what you type, and we don’t send it your email address. PostHog stores this information in the United States.
• Visitors in Europe: the app and the web app don’t collect usage analytics in the European Economic Area, the UK or Switzerland, going by your device’s time zone. On the website, if you’re in the European Economic Area, the UK or Switzerland, the site doesn’t load PostHog or the ad measurement pixel and doesn’t store anything in your browser. Instead, the campaign details of the link you arrived on stay in the page address as you move around the site, so they can be saved with an early-access signup. It goes by your device’s time zone, so this applies to any device set to a European time zone, or to one it can’t place, such as UTC.
• Privacy signals: if your browser sends a Global Privacy Control or Do Not Track signal, the site doesn’t load PostHog or the ad measurement pixel and doesn’t keep the identifier or your campaign history, and the web app sends no usage analytics.
• Ad measurement (ads in ChatGPT): we advertise Tripami in ChatGPT, and this website uses OpenAI’s ChatGPT Ads measurement pixel to count how often a visit from one of those ads leads to a tap on an App Store or Google Play button. Outside Europe, and unless your browser sends a privacy signal, the pixel loads on each page and tells OpenAI the page’s address (without its query string) and that the page loaded. When you tap an App Store or Google Play button or link, it tells OpenAI which store you chose. If you came from one of our ads in ChatGPT, it also sends that ad click’s reference. The pixel keeps that reference in a cookie (__oppref) for 30 days, and a random browser identifier in another (__obref) for a year. Like any service a page loads, OpenAI also receives your IP address and browser details. OpenAI also builds the pixel to look for contact details on a page, such as an email address typed into a form, and to send them in hashed (scrambled) form, so a tap can be matched to an ad click when the click reference is missing. OpenAI doesn’t let us turn this off, but this website has no forms that ask for contact details, and in our tests the pixel sent none. Each tap is marked so OpenAI doesn’t use it for personalization. A tap isn’t a download: we don’t learn from it whether you install the app. OpenAI handles this information under its own privacy policy. If we add another analytics or advertising tool, we’ll update this policy first.

3. How we use information

• To create your account, sign you in and keep your account secure, including sending sign-in codes to your phone.
• To run Tripami: build and sync the shared trip, create each person’s timeline, estimate leave-by times, show when the group meets back up, and power notifications, widgets and Live Activities.
• To find the travel plans you’ve asked us to find, and show them to you for review.
• To keep track of the expenses and balances you create.
• To show tours and activities that suit your trip and partners’ searches for nights without a stay, and to match partner bookings and commission to the booking links they came from.
• To share the invites you ask us to share, and let invited people see a preview of the trip.
• To understand how people find and use our website, such as which pages and campaigns lead to early-access signups.
• To measure whether our ads in ChatGPT lead people to the App Store or Google Play.
• To keep Tripami secure, prevent abuse and fix problems.
• To contact you about your account, support requests and important changes.
• To comply with the law.

We don’t sell your personal information, and we don’t use it for targeted advertising.

Legal bases (EEA and UK)

We process personal information to provide the service you asked for, for our legitimate interests in keeping Tripami secure and working well and in understanding how our website is used, with your consent (for example, for Gmail, contacts and notifications), and to meet legal obligations. You can withdraw consent at any time without affecting processing that already happened.

4. How information is shared

• With your trip: people on a trip can see that trip’s shared details, including who’s going, the plans, and the expenses they’re part of. They also see your name and profile photo. Attachments are visible to everyone on the trip unless you limit one to specific travelers.
• With people you invite: anyone with an active invite link can see a limited preview of the trip, such as where, when and who’s going, before they join. Invite links expire, and you can revoke them.
• With service providers: companies that help us run Tripami. They may use your information only to provide their services to us, and they’re required to protect it.
  • Google Cloud and Firebase (Google LLC): sign-in, including texting sign-in codes; our database and server functions; and notifications on Android devices.
  • Apple: Sign in with Apple, and notifications on Apple devices.
  • Netlify: hosting for this website and its early-access form.
  • Resend: sending our emails.
  • PostHog: website, app and web app usage analytics, as described in section 2.
• With OpenAI, for ad measurement: the website’s ad measurement pixel sends OpenAI the page visits and store taps described in section 2, so it can report how our ads in ChatGPT perform.
• With booking partners: to find tours and activities, we send our partner (Viator, part of Tripadvisor) the destination, the kinds of experience and the dates being searched, never your name or your trip’s details. A search for a place to stay on Expedia or Vrbo (both part of Expedia Group) or Booking.com carries the place, the dates, the number of travelers and, for a stay already on your trip, the hotel’s name, and nothing else about your trip. When you open a booking page or search, you go to the partner’s own site with Tripami’s partner ID and the link’s random code, and the partner uses cookies to credit a booking to Tripami for up to 30 days. What you share there, and how you book and pay, is covered by the partner’s own terms and privacy policy.
• With services you connect: if you connect another app or an AI assistant to Tripami, it can access trip information only with your permission, and only what it needs for what you ask it to do.
• For legal reasons: when the law requires it, or to protect the rights, safety and property of our users, the public or Tripami.
• If our business changes: if Tripami is part of a merger, acquisition or sale of assets, information may be transferred as part of that deal, and this policy will continue to apply to it.

We don’t sell personal information. Apart from the website’s ad measurement with OpenAI described above, we don’t share it with advertising companies or data brokers.

5. Google user data

This section explains what Tripami accesses from your Google Account, and how we use, share, store, protect, keep and delete it. It covers Sign in with Google and, if you choose to connect it, Gmail. Connecting Gmail is optional and separate from signing in.

Sign in with Google

• What we access: your name, email address, profile photo and Google account identifier, which Google shares when you choose Sign in with Google. Signing in doesn’t give Tripami access to your Gmail, contacts, calendar or files.
• How we use it: to create your Tripami account and sign you in, to show your name and photo to the people on your trips, and to contact you about your account.
• Who we share it with: the people on your trips see your name and photo. Google processes it for us as our sign-in and database provider. We don’t share it with anyone else.

Gmail (optional)

• What we access: with your permission, Tripami uses read-only access to Gmail to look for travel messages, such as flight, hotel, rental and train confirmations, itinerary changes and cancellations. Tripami can’t send, delete or change your email.
• How we use it: we extract travel details from those messages, such as dates, times, places and confirmation numbers, and show them to you as suggestions to review. Nothing is added to a trip until you confirm it. If you turn on ongoing detection, new travel messages are shown for review in the same way.
• What we store: the travel details you review, and a reference to the message they came from (its Gmail message ID), so we can avoid duplicates and recognize updates. When you look for a stay, the stays found (names, dates, addresses and links) are kept for up to 6 hours so we don’t read your email again, then deleted. We don’t keep the content of your email. Tripami reads a travel message only to pull out its travel details.
• Who we share it with: travel details you add to a trip are shared with the people on that trip, like any other plan. To pull out travel details, the text of each travel message is sent to OpenAI, which processes it for us and returns the details; under OpenAI’s API terms it isn’t used to train OpenAI’s models. We don’t share Gmail data with anyone else, except Google Cloud, which processes it for us, or when the law requires it.

How we protect Google user data

Google user data is encrypted in transit and when stored. Gmail access tokens are encrypted on our servers and never reach the app. Only the systems that run these features can access Google user data, and people at Tripami see it only when you ask us for help, when it’s needed for security, or when the law requires it.

How long we keep it, and how to delete it

• Sign-in details: kept while your account is open, and deleted when you delete your account.
• Gmail: when you disconnect Gmail in Tripami, we stop checking for new messages, revoke our access, delete the stored access tokens and delete any suggestions you haven’t reviewed. Travel details you added to a trip stay there as plans until they’re deleted from the trip.
• Removing access: you can also remove Tripami’s access anytime in your Google Account, under third-party apps and services.

What we don’t do

We don’t use Google user data for advertising, sell it, or transfer it to data brokers or information resellers. We don’t use it to decide on credit or lending, and we don’t use it to develop, improve or train generalized AI or machine-learning models. People at Tripami don’t read your email unless you ask us to (for example, for support), it’s needed for security, or the law requires it.

Tripami’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Location

Tripami works from your plans, so it doesn’t need your location to show where you’re headed, and the Map tab shows your trip’s stops and plans, not where anyone is.

Discover can show places near you. It asks for your location the first time you choose “Near me”, and uses it only while Discover is open on your screen, never in the background. To search, the app sends us your position rounded to about 100 meters; we send Google an area of about a kilometer around it to find places, and use the rounded position to measure distances. We don’t store your location, keep a history of it, or show it to the people on your trip. You can turn location off at any time in your phone’s settings and choose a city instead.

If we ever add location sharing, it will be off until you turn it on, and we’ll update this policy before it’s available.

7. Money and payments

Tripami keeps a record of shared expenses and balances. It doesn’t hold funds, process payments or store bank or card details. When you settle up, you pay in your own payment app, and that app’s terms and privacy policy apply.

8. How long we keep information

We keep your information while your account is open. When you delete your account, we delete your account details, your settings, your connected-account access and content only you can see. Shared trip details you added may stay on trips with other people, without your account attached, so their plans and balances still add up.

We keep records of partner booking links, and the bookings and commission reported for them, so our accounts with partners add up. When you delete your account, they stay without your account attached.

Copies may remain in backups for up to 30 days. We may keep limited information longer when the law requires it.

We keep early-access email addresses, and the signup details saved with them, until you unsubscribe or ask us to delete yours.

PostHog keeps website, app and web app analytics data for 1 year. The ad measurement cookies expire after 30 days (__oppref) and a year (__obref), and OpenAI keeps the events it receives under its own terms.

9. Security

We encrypt information in transit and when stored, limit who can access personal information, encrypt connected-account tokens on our servers, and make invite links unguessable, time-limited and revocable. No system is perfectly secure, so keep your devices secure, and tell us right away if you think something’s wrong: security@tripami.io.

10. Your choices and rights

• Update your profile and trip details in Tripami.
• Turn notifications on or off.
• Disconnect Gmail or other connected services.
• Stop website analytics and ad measurement by turning on Global Privacy Control or Do Not Track in your browser, app analytics under Profile → Share usage data, and web app analytics from the web app’s account menu → Share usage data. For visitors and travelers in Europe, all of them are always off.
• Delete your account. Here’s how.

Depending on where you live, you may also have the right to access, correct, delete or get a copy of your personal information, to object to or restrict some processing, and to withdraw consent. To make a request, email privacy@tripami.io. We won’t treat you differently for using these rights. If you’re in the EEA or UK, you can also complain to your local data protection authority.

California residents: we don’t sell personal information. The website’s ad measurement with OpenAI (section 2) is the only time we share it with an advertising company. If that counts as sharing for cross-context behavioral advertising under California law, you can opt out by turning on Global Privacy Control: we treat it as a request to opt out of sale and sharing, and the website then doesn’t load the pixel.

11. Children

Tripami isn’t meant for anyone under 16, and we don’t knowingly collect personal information from anyone under 16. If you believe someone under 16 has given us personal information, contact us and we’ll delete it.

12. International transfers

Tripami is operated from the United States, and we store information in the United States: our database and server functions run on Google Cloud in the US, and our other service providers are based in the US. If you use Tripami from another country, your information is transferred to and processed in the United States. When the law requires safeguards for international transfers, we use them.

13. Changes to this policy

If we make material changes, we’ll tell you in the app or by email before they take effect. The date at the top shows when this policy was last updated.

14. Contact us

Email privacy@tripami.io, or write to Mythfit Corporation, 17814 N. 35th St., Phoenix, AZ 85032, USA.