We Tripped Privacy Policy
The short version
We Tripped is a trip planner you share with the people going on the trip. To do that it needs an account and a place on the internet to keep the trip, so, unlike our other apps, it stores what you enter on servers run for us by Google Firebase. Only people you add to a trip can see it, followers see only what you switch on, and a plan you choose to publish is a separate copy without names, notes or bookings. There is no advertising and no analytics, and nothing is ever sold. You can delete your account and its data from inside the app at any time.
Your account
You sign in with your Google account. The app receives your Google name, email address, profile photo link and an account ID. Your name and photo are shown to the people on your trips. Your email address is kept so the trip inbox can recognise mail you forward. The app also keeps a Firebase Cloud Messaging push token with your account so it can send your phone a notification when someone adds you to a trip or joins a trip you own. We never see your Google password.
What a trip holds
Everything you and the other members enter is stored with the trip:
- the trip's name, places, dates, home currency and time zone, and the destination's map location
- the day-by-day plan, including times, addresses and notes such as door codes
- bookings, including confirmation codes, booking links and details read from forwarded email
- costs and expenses, which owners can hide from other members
- ideas, links and photos found for them, and everyone's votes
- journal lines and the checklist
- the members' names, photos, roles, and, for the person who created the trip, their email address
- photos you choose from your phone: a cover photo, photos on journal lines, and receipt photos on expenses (seen only by members who can see costs)
Whoever you add to a trip can see it. Owners decide who is on it and what each person may see and change. People who aren't on a trip can't read it.
The trip inbox
The app can give you a personal address at trips.ischtafer.com for forwarding booking confirmations. Mail sent there passes through Cloudflare Email Routing, which hands it on without keeping it, to our server. There the booking details (such as the name, dates, confirmation code and amount) are read and added to the matching trip, where its members see them. A copy of the whole email is stored for you alone. Mail that isn't filed to a trip is deleted after 30 days. Only mail forwarded from your own sign-in address is accepted. Anything else is refused, and only its sender, subject and time are logged.
Followers and shared plans
- Followers, such as grandparents, never need an account. An owner gives each one a name and a private link or calendar feed. The follow page shows the trip's name and status, plus only what the owner's switches allow: the places and each day's highlights; the plan and its times; the journal (each line with its writer's name and mood); and, only if "Addresses and confirmation numbers" is switched on, the plan's notes and the bookings with their dates and confirmation codes. We do not store followers' email addresses or phone numbers. A follow link stops working 30 days after the trip ends, or as soon as an owner removes it.
- Shared plans. If you share a trip as a template, a copy is made at that moment: its days and stops, ideas (with their links and the pictures from those web pages) and checklist. It never carries bookings, confirmation codes, booking emails, photos you added, journal lines or the names of the people on the trip. Notes go as you wrote them, except that sentences that look like codes (such as a lockbox code) are removed. Costs come along only as you choose: none, totals by category, or every expense line. Anyone with the link can view the copy and copy it into their own trip.
- Community Trips. If you choose to publish a shared plan, the copy is also listed in the app for every signed-in user to browse and copy. A published copy leaves out all notes and idea descriptions, and its costs, if any, are totals by category only. Day and stop titles go as you wrote them, so they may name places, such as where you stayed. You can unpublish it at any time; anyone who already has its link can still open it. Other users can report a published plan; a report stores the reporter's account ID, the reason and the time so we can review it, and a plan reported by several people is taken down until it is reviewed.
The follow and template pages load fonts from Google Fonts, which sees the visitor's IP address.
Services the app talks to
To fill in the trip, the app or our server sends small, specific requests to these services. None of them receive your name or account:
- Weather: our server asks MET Norway for the forecast at the destination's map location, rounded to about a kilometre, and keeps the answer until MET publishes a new one. Your phone asks NASA POWER for typical weather by month.
- Exchange rates: Frankfurter and ExchangeRate-API get currency codes.
- Cover pictures: Wikipedia and Wikimedia Commons get the trip's place names.
- Maps: the trip map is drawn by Google Maps, which loads the area shown. Google Maps also collects, for its own purposes, information about your device (model, Android and Maps versions), your IP address, a pseudonymous Maps identifier, how you pan and zoom the map, and crash reports from the map component. Using the map means accepting the Google Maps Additional Terms of Service, and the Google Privacy Policy covers what Google does with this information. Your phone's built-in place search finds the places you type.
- Drive times: to work out leave-by times, our server sends the map locations of two consecutive plan items to Google's Routes service. The request comes from our server, so Google does not see who asked. Google's answer is not stored on our server; the app remembers it only while it is open. We count how many drives each account looks up per day, to keep the service from being misused, and keep one running total for the whole app each month, which names nobody.
- Link previews: when you add a link to an idea, the app opens that web page itself to read its title, picture and description, and loads the picture from the site that hosts it.
Like any website, the services your phone contacts also see its IP address. Their own privacy policies cover what they do with it.
Where it is kept and who processes it
- Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions and Cloud Messaging) stores and processes account and trip data in the United States (South Carolina) on our behalf, and delivers push notifications when you are added to a trip or someone joins your trip. It is encrypted in transit and at rest.
- Cloudflare receives and hands on mail sent to the trip inbox.
- Backups: a copy of the trip database is taken every day and kept for 28 days, so a mistake can be undone. Backups stay with Google Firebase in the same location.
- On your phone, the app keeps copies of your coming trips and saved emails so they work offline, plus the home-screen widget's next trip and your settings. Android may include these in your Google account's device backup.
The only device permissions the app uses are internet access and, optionally, notifications (so your phone can alert you when you are added to a trip even when the app is closed; if you decline notifications, the app shows an in-app banner when you open it instead). It does not use your location, camera, microphone or contacts. Picking a cover, journal or receipt photo uses Android's photo picker, which hands over only the photo you choose. Saving the inbox address as a contact opens your contacts app with the address filled in; the app does not read your contacts.
What we do not do
We Tripped contains no advertising, no analytics and no third-party tracking or crash-reporting tools of our own; the only outside component that reports anything is the Google Maps map, as described above. Your information is never sold or rented, and it is never shared except with the people and services described above. Ischtafer LLC looks at stored data only when you ask us to help with a problem, or when the law requires it.
What Google Play collects
Google Play may provide Ischtafer LLC with aggregated, anonymous statistics about installs, crashes and app performance. These are used only to fix problems. They do not include anything you entered in the app.
Deleting your account and data
In the app: open Tools, find the card with your name, and tap Delete account. It takes effect immediately and cannot be undone:
- your account, trip inbox address, stored emails and push notification tokens are deleted
- trips that only you are on are deleted, with their follower links and files
- trips you share stay with the other members, without your name, journal lines or votes. If you were a trip's only owner, the next member on the trip becomes its owner. Bookings and plans you added to a shared trip remain part of that trip
- plans you shared as templates (published or not), reports you made, invitations you made, and your daily drive-time count are deleted
- copies in the daily backups are erased as those backups expire, within 28 days
- the app then erases everything it kept on your phone
Without the app: email support@ischtafer.com from the Google account you sign in with and ask us to delete your We Tripped account. We'll do exactly the same as the in-app button within 30 days and reply when it's done.
To leave a single trip without deleting your account, ask one of its owners to remove you.
Children
We Tripped is not directed at children under 13, and children should not sign in. Parents may mention their children in a trip's plan or journal; that information is treated like the rest of the trip.
Changes
If the app starts handling information in a way this page does not describe, this page will be updated first and the effective date above will change.
Contact
Questions about this policy: support@ischtafer.com
Ischtafer LLC, 6650 Rivers Ave Ste 100, Charleston, SC 29406, United States.