Privacy Policy

1. Introduction

LetsPickaTrip ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our trip-planning platform.

2. Information We Collect

Information you provide

• Account information: name, email address, and username.
• Trip data: destinations, dates, itineraries, checklists, and notes you create.
• Communications: messages you send to us or through the Service.

Information collected automatically

• Device and browser information (type, operating system, screen size).
• Usage data (pages visited, features used, interactions).
• IP address and approximate location (country/region level).
• Cookies and similar technologies for session management and preferences.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Create and manage your account.
• Enable collaboration features such as shared trips and checklists.
• Improve and personalize your experience.
• Send you service-related communications (account verification, security alerts).
• Analyze usage trends to improve the Service.

4. Sharing Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• With collaborators: Trip data you share with other users (via share links or invitations) will be visible to those users.
• Service providers: We use third-party services for hosting, payments, email delivery, sign-in, and AI features. These providers process data on our behalf under contractual obligations and are listed in Section 5.
• Legal requirements: We may disclose information if required by law or to protect the rights, property, or safety of LetsPickaTrip, our users, or others.

5. Service Providers (Sub-processors)

We rely on the following third parties to run the Service. Each receives only the data needed for its role, and we do not share your data with them for their own advertising.

• Amazon Web Services (AWS): application hosting, our database, file storage, backups, and transactional email delivery (Amazon SES).
• Stripe: payment processing and subscription billing for Premium purchased on the web. We never see or store your full card number.
• Apple: In-App Purchase for Premium on iOS, push notifications (APNs), and Sign in with Apple.
• Google: Sign in with Google, Google Play Billing for Premium on Android when available, and Google Maps / Places for location search and place details.
• OpenAI: AI itinerary generation, extracting trip details from content you import, and chat assistance. The trip details and prompts you submit to these features are sent to OpenAI to generate a response.
• Amadeus: flight and hotel search. Your search parameters (destinations, dates, traveler counts) are sent to retrieve results.
• OpenStreetMap: map tiles for the maps in the app. Your browser requests tiles directly from OpenStreetMap's tile servers, which see your IP address and the map area you view.
• Komoot Photon, Nominatim, and Overpass: geocoding and place lookup built on OpenStreetMap data. The place names and map areas you search for are sent to resolve coordinates and nearby places.
• Ticketmaster: event discovery. Destination and date ranges are sent to list events near your trip.
• Open-Meteo: weather forecasts. Destination coordinates and trip dates are sent to retrieve the forecast.
• Wikimedia: destination summaries and imagery from Wikipedia and Wikimedia Commons. Only the place name is sent.
• SmugMug: hosting for gallery and destination images.
• Meta: Facebook and Instagram sign-in, if you choose to sign in with those accounts.

Sign-in providers (Apple, Google, Meta) only receive data when you choose to use them, and we receive only the profile fields you authorize (such as name and email address).

6. Data Retention and Deletion

We retain your account and trip data for as long as your account is active. You can delete your account at any time from your account settings (or in the iOS app), after re-confirming your identity. When you do, the following happens:

• Deleted immediately: your user record (name, email address, password hash, sign-in links, sessions, and two-factor settings), the trips you own together with their itineraries, checklists, notes, votes, chat, and uploaded files, and other records tied to your account such as favorites, journals, saved destinations, and notification settings. Deletion is a single transaction: it either completes in full or, on error, nothing is removed.
• Unlinked, not deleted: payment records for Premium purchases are kept for tax and accounting purposes, but the link to your account is removed. On trips owned by other people, content you contributed (for example an itinerary item you added) remains for those collaborators, with the reference to your account cleared.
• Confirmation email: we send one final email to your address confirming the deletion. It is queued for delivery and then handled like any other transactional email.
• Backups: deleted data may persist in encrypted database backups until those backups expire under our retention schedule, after which it is gone.

Separately from account deletion, a scheduled cleanup periodically removes short-lived data that has expired: email verification and password reset tokens, expired crew invitations, and community photo submissions that were never approved. Server logs are retained for a limited period for security and debugging.

7. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing of your data.
• Export your data in a portable format.

To exercise these rights, contact us at privacy@letspickatrip.com.

9. Cookies and Analytics

We use a small number of cookies and similar browser storage that are strictly necessary to run the Service: keeping you signed in, protecting forms against cross-site request forgery, and remembering your preferences (theme, language, and the analytics choice below). You can control cookies through your browser settings, but the Service may not work correctly without the essential ones.

First-party analytics only

To understand reliability and improve the product we record first-party product-usage and performance events (for example which pages and features are used, page load timing, and whether the app was offline). With your consent, a page view also carries the page path, the referring site and any utm_* campaign parameters from your first visit, and a random session identifier stored in your browser so anonymous visits can be linked to an eventual sign-up. The identifier is not derived from your account or device. These events are sent only to our own servers, are kept for 90 days, and are then deleted. We do not use third-party advertising trackers, ad networks, or cross-site tracking pixels, and we do not sell or share analytics data for advertising.

Your analytics choice

Optional analytics are off until you opt in: nothing is recorded, and no session identifier is created, until you choose "Accept" in the consent banner shown on your first visit or turn on the toggle below. You can change your choice at any time here; declining deletes any queued events. We also honor the Global Privacy Control (GPC) signal and the browser Do Not Track setting.

10. Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service or by email. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at privacy@letspickatrip.com.