When you create an account, we collect your phone number to verify your identity and enable you to be found by trip leaders who invite you.

When you set up your profile, you may optionally provide your name, profile photo, home airport, and social handles. These are visible to other members of your trips.

When you use trip features, we store trip data you create — polls, votes, expenses, itinerary items, timeline updates, and photos you upload — to power the shared trip experience.

We use your data exclusively to provide the Tripora service:

• Verifying your identity via phone number OTP
• Displaying your profile to trip co-members
• Delivering trip invites sent to your phone number
• Syncing trip data in real time across devices
• Sending push notifications for trip activity (only if you grant permission)

We do not sell your data. We do not use your data for advertising. We do not share it with third parties except as required to operate the service (e.g., our cloud infrastructure provider).

Tripora may request access to your contacts solely to let you select a contact when inviting someone to a trip. We do not upload, store, or sync your contact list. Only the phone number of the specific contact you select is used, and only for the purpose of creating a trip invitation.

When you upload a profile photo, trip wallpaper, or memory photo, the image is stored securely in our cloud storage. These images are accessible to members of the relevant trip (for trip photos/wallpapers) or publicly accessible at a private URL (for profile photos).

We do not access your photo library beyond the specific images you choose to upload.

Your data is retained as long as your account exists. If you delete your account through the app (Profile → Delete Account), all your personal data — including your profile, trip participations, and any content you created — is permanently deleted within 30 days.

Trip data you contributed (polls, expenses, timeline posts) may remain visible to other trip members under an anonymized form after account deletion.

All data is transmitted over HTTPS. Authentication uses Supabase's phone OTP system — we never store passwords. Database access is protected by row-level security policies ensuring users can only access data for trips they belong to.

Tripora is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this privacy policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. For significant changes, we'll notify you through the app.

If you have questions about this privacy policy or how we handle your data, reach us at privacy@trytripora.com.