Privacy Policy

1. Who is responsible (data controller)

• Controller: Tripi Tech, S.L.
• Tax ID (NIF): B05754742
• Registered address: Calle Mirlo, 1, 28250 Torrelodones (Madrid), Spain
• Privacy contact: legal@tripiapp.es

2. What data we process

Account data: email address, username, optional nickname, optional bio, optional profile photo, preferred language, account type, and month and year of birth (see section 10). Credentials are managed by Firebase Authentication (Google). When you sign in or change your password with your email, the password passes encrypted through our server only so it can be checked with Firebase: we neither store it nor log it.

Sign in with Google or Apple: if you choose these options, we receive your account identifier and the email address each service shares with us (Apple lets you hide your real email). We do not ask Apple for your name.

Content you create: trips (name, destination, dates, participants and cover photo), album photos, spots on the map (a coordinate with a photo and/or a note), reactions, visited countries and the messages you send us through the feedback form.

Blasts: a photo you share with your friends for 24 hours, with an optional location and, if you choose, linked to a Tripi; it is deleted automatically once that time is up (or sooner, if you delete it yourself).

• We record which blasts you have viewed and, if you react, your reaction. Who has viewed your own blast (and their reaction) is visible only to you as its author.

Albums you open: we record which already-revealed albums you have opened and when you first opened each one. It is what stops us telling you about an album you have already seen, and what tells us whether those notices are worth sending at all (section 3). It is a single record per album and person: we do not store how many times you open it, or how long you look, and we never show it to anyone, including whoever created the album.

Location (map and spots): only if you grant the permission, we use your device location to centre the map. Spots you choose to create store their coordinates as part of their content. When you take a photo in a tripi with the location permission granted, we store where it was taken. That place does not appear in the album: it is used for the map. When the tripi is revealed, each of your photos with a location becomes a pin at the exact place you took it, unless you turn this off in Settings → Privacy & password; and the other members can pin your photos, unless you set that tripi to “Only me” (see section 4).

Location shared during a Tripi: this feature is off by default. Only if you turn it on, and only while a Tripi of yours is under way, do we store your approximate position, so that the other people on that Tripi can see it on the map.

• Before anything is sent, your phone rounds your position to a cell of about 500 m: your exact coordinates never leave your device and are never stored.
• We keep one row per user, your latest known position, and every update replaces the previous one. We keep no record of where you have been.
• You are visible only to the other people on a Tripi that is happening right now, and only while it is: when the Tripi ends, sharing stops and what was stored is deleted. There is no way to share your location with anyone outside a Tripi, and no feature that lets anyone ask where a particular person is. If you block someone on that Tripi, they stop seeing your location and you stop seeing theirs.
• We use that same approximate position to tell you when you are near a pin your friends recommend (you can turn this alert off in Settings → Notifications → Pins near you). Because your position is only ever collected during a Tripi, this alert can only reach you then, and it is not shown to anyone else for this.
• You can turn it off at any time in one tap from Settings → Location in a Tripi, with no confirmation and immediate effect: what was stored is deleted at once.
• It refreshes when you open or return to Tripi. If you additionally grant the “Always” permission, it also refreshes as you move with the app in the background, and only while the Tripi is under way; you can revoke that permission in iOS settings without turning off the rest.

Social data: your friends (a friendship is mutual: requested, then accepted), friend requests sent and received, who you follow if they are an influencer account (and who follows you if yours is), and your membership in shared trips.

Reports and blocks: if you report content or a user, we store what you reported, the reason, any text you add and the date, plus the users you have blocked. The person you report is never told it was you. If content of yours is reported, the report and our decision are kept with your account.

Technical and security data: push notification token, the tokens of a Tripi’s Live Activities and device platform; and, in our server’s technical logs, the IP address, your user identifier and the request made, which we use for security and to diagnose faults.

Diagnostics: error and crash reports, and performance data (how long screens and requests take), with the device model, OS version and technical stack trace, linked to your numeric user identifier, never to your name or email, processed with Sentry on European Union servers, only in the production version of the app.

Photo library: with your permission, Tripi saves the photos you take, and the albums revealed to you, to a “Tripi” album on your device, and shows that album in the in-app gallery. To pin a recent photo, the pin camera shows your latest photos from the library. If a photo you choose to pin has the place and date it was taken stored in it, we read them to put the pin at that place. Photos stay on your device; only the ones you choose to post or pin are uploaded.

Waitlist (website): if you sign up at www.tripiapp.es to hear when Tripi launches, we keep your email and language to send you a single email the day it is on the App Store.

What we do NOT do: we use no product analytics tools; we do not access your contacts or your microphone; we do not track you for advertising; we show no third-party ads; we never sell your data.

3. Why we use your data and on what legal basis

• Providing the service (your account, your content, connecting with friends, essential notifications): contract performance (art. 6.1.b GDPR).
• Suggesting people you may know and highlighting your “best buddies”, based on the friends and trips you have in common: contract performance (art. 6.1.b).
• Service emails (email verification, password reset code, moderation notices): contract performance (art. 6.1.b).
• Sharing your approximate location with the other people on a Tripi that is under way, and alerting you to recommended pins nearby: consent (art. 6.1.a), withdrawn by turning the feature off.
• Turning a tripi’s photos into map pins when it is revealed, for the people who can see that tripi through you: performance of the contract (art. 6.1.b). You can turn it off in Settings → Privacy & password.
• Security and abuse prevention (technical logs with IP, rate limiting): legitimate interest (art. 6.1.f).
• Error diagnostics so the app works: legitimate interest (art. 6.1.f).
• Optional push notifications about social activity: consent (art. 6.1.a), revocable in Settings.
• Telling you that a friend has revealed an album you have not opened yet, or that one you did open has new reactions: consent (art. 6.1.a), the same consent you give by allowing notifications, revocable in Settings → Notifications → Catch up. These notices are always about something that genuinely happened among your friends: they are not commercial communications or app promotions.
• Knowing whether those notices are worth sending: we count how many go out and whether you then open the album, in aggregate and compared with a small group that is sent none: legitimate interest in improving the service (art. 6.1.f). It is computed on our own server; no analytics tool is involved.
• Content moderation (reviewing reports, refusing on posting texts that contain offensive words from a list, removing content that breaks the Terms, blocking, suspending accounts): legitimate interest in keeping Tripi safe (art. 6.1.f) and, where applicable, legal obligation (art. 6.1.c).
• Sending you the launch email if you joined the waitlist: consent (art. 6.1.a); you can withdraw it by writing to legal@tripiapp.es.
• Compliance with legal obligations: legal obligation (art. 6.1.c).

We do not use your data for personalised advertising and we make no automated decisions with legal effects on you.

4. Who sees your content inside Tripi

• Every trip has a per-member privacy setting: “Only me” or “My friends”. Influencer accounts also have “Followers” (people who follow them without being friends). It controls who can find the trip through you. A trip is shared: the other members’ friends can still see it, and its album, through them.
• Members of a revealed trip can pin each other’s photos to their own map, where the pinner’s friends see them with their author credited. If you set a trip to “Only me”, the other members cannot pin your photos from it.
• When a trip is revealed, your photos with a location appear as pins on the map, at the exact place you took them. They are seen by the same people who can find that trip through you: your friends (on an influencer account with “Followers”, your followers too) or, if you chose “Only me”, only you; if you change that setting, your pins change with it. Photos from the same trip taken less than 30 m apart share a pin, and each person only sees the photos they are allowed to see. You can turn this off for trips revealed from then on (Settings → Privacy & password) and delete any of your pins.
• Your profile (username, nickname, bio, profile photo and public counters) is visible to other Tripi users. The profile photo is served from a public, hard-to-guess link: anyone who has the link can see it.
• Members of a trip see the photos shared in that trip. Spots are different: only your friends can see them (on an influencer account, its followers too), including on the map of a trip you took together. Being in a trip grants no access to other members’ spots.
• Blasts are seen by your friends (on an influencer account, their followers too) while they’re active, same as spots. Only you, as the author, see who has viewed it and their reactions.
• If you share a trip link, recipients can open it according to the trip’s privacy setting.
• Your approximate location is seen only by the other people on a Tripi of yours that is under way, and only while it is. It is independent of both the trip privacy setting and your profile setting: making your profile public does not make your location public.

5. Who we share data with

We use providers that process data on our behalf under contract (processors):

• Microsoft Azure — service hosting, photo storage and service emails — EU (Germany); the static website is also delivered through its global network.
• Neon — main database (PostgreSQL, hosted on Amazon Web Services) — EU (Frankfurt, Germany).
• Google (Firebase Authentication) — authentication and credentials — EU / USA.
• Expo — push notification delivery and app updates — USA.
• Sentry — error and performance reporting — EU (Germany).
• Zoho — email for info@tripiapp.es and legal@tripiapp.es, where we receive your questions, your rights requests and content reports — EU.
• Cloudflare — DNS for the tripiapp.es domain and the redirect of web traffic sent to that address; it processes the IP address of whoever makes the request — EU / USA (global network).

Other services that receive data in order to work:

• Apple — Sign in with Apple, notification delivery (APNs) and maps and place names (Apple Maps; to show a place’s name, your phone sends its coordinates to Apple) — EU / USA.
• Wikimedia Foundation (Wikipedia and Wikimedia Commons) — city photos and their credits — USA.

Destination search: when you type a place while creating a Tripi, the search runs on our own servers against a list of places from GeoNames (geonames.org, CC BY 4.0); what you type is not sent to any third party. To show a photo of the city, your phone asks Wikipedia and Wikimedia Commons for it directly, by the city’s name or coordinates, never yours. Like any internet connection, that request carries your device’s IP address; we do not send your name, your account or any other data about you.

Beyond these cases, we only disclose data where the law requires it.

6. International transfers

Your content and the database are stored in European Union data centres. Some providers (Google, Apple, Expo, Cloudflare and Wikimedia) may process data in the USA; in those cases we rely on the EU-U.S. Data Privacy Framework (DPF) or the European Commission’s Standard Contractual Clauses.

7. How long we keep your data

• Active account: for as long as you keep your account.
• Account deletion: you delete it from Settings, without writing to us. It is deactivated immediately and your email and username are anonymised. We delete your profile photo, your friendships, your spots, blasts, notifications, feedback and badges, and the Tripis where you were the only member, with all their photos. You choose whether the photos and reactions you contributed to Tripis shared with others are deleted too or stay in their albums, without your name or profile photo. Deleting the photos is completed within 24 hours.
• Deleted Tripis: a Tripi you delete (or that we remove through moderation) can be restored for 30 days; after that we delete it permanently with all its photos. A Tripi whose members have all deleted their accounts is deleted as well.
• A Tripi’s pins: deleting a photo from the album deletes its pin, and deleting the Tripi (or removing it through moderation) deletes all its pins at once, without waiting for those 30 days.
• Shared location: the latest position only, replaced on every update; never a history. It is deleted when the Tripi ends or you leave it, when you turn the feature off, and when you delete your account.
• Blasts: deleted automatically 24 hours after posting (or sooner, if you delete them yourself); the list of who has viewed it is removed along with the blast.
• Server technical logs (IP, user identifier): up to 12 months.
• Reports: up to 12 months after they are decided. Blocks: until you unblock the person or delete your account.
• Emails you send us or that we receive about you (questions, rights requests, reports): up to 12 months after they are resolved.
• Waitlist: we delete your email when we send you the launch email or, if it is never sent, after 6 months.
• Backups: up to 30 days.
• Error reports (Sentry): 90 days.
• Which albums you have opened: for as long as both the album and your account exist; deleting either one removes it.
• Record of the notices sent: 90 days.

8. Security

All communications are encrypted (TLS). Your credentials are managed by Firebase Authentication; we do not store your password. Private photos are served through signed, time-limited links. Access to production systems is restricted to the people who operate the service.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time:

• In the app: edit your profile, adjust each trip’s privacy, manage notifications or delete your account and your content in Settings.
• By email: legal@tripiapp.es, for example to ask for a copy of your data (we reply within 30 days; we may ask you to confirm the account is yours).

You can also withdraw consent (for example by turning off location sharing in a Tripi, notifications or the location permission in iOS Settings) without affecting the lawfulness of prior processing.

If you believe we have not handled your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.

10. Minimum age

Tripi is intended for users aged 16 or older. We do not knowingly create accounts for children under that age; if we detect one, we will delete it. If you are a parent or guardian and believe a child under 16 is using Tripi, contact legal@tripiapp.es.

To check this, we ask for your date of birth when you create your account (and once, before you continue, if your account is older or you signed in with Google or Apple). Your age is worked out on your device: only the month and year reach our servers, and we keep them for as long as your account exists; the day never leaves your device. If the date shows you're not old enough yet, no account is created and your device pauses sign-up for 24 hours (it stores only when that pause ends, never your date of birth). If an existing account turns out to be under the minimum age, we deactivate it at once and delete it, with its content, 30 days later; if it was a mistake, write to legal@tripiapp.es before then and we'll restore it. On iPhones with iOS 26 or later, the app may also check the age range you've declared to Apple; that answer is used only on your device, and we never store or receive it.

11. Changes to this policy

If we make material changes, we will notify you inside the app before they take effect. The date of the latest update always appears at the top of this document.

12. Contact

For any privacy question: legal@tripiapp.es.