1. Scope
This policy describes the current TripDo web product. It applies to the public website, the authenticated planning workspace, and the server APIs used by that workspace. It does not describe future booking, payment, collaboration, or public-sharing features that have not shipped.
2. Information TripDo processes
- Account data: Firebase user ID, anonymous-account status, and Google profile information if you choose to save a guest account with Google.
- Trip data: destinations, dates or duration, preferences, constraints, routes, itinerary items, stays, budget targets, edits, and finalized plans.
- Assistant data: messages, structured answers, tool results, feedback, and bounded conversation context needed to continue planning.
- Technical data: browser capabilities, authentication state, service events, errors, and provider-usage records. The server-side provider ledger excludes user IDs, prompts, place names, and raw search text.
3. Accounts and storage
TripDo starts with an anonymous Firebase Auth session so you can plan before linking a provider. If you link Google, TripDo attempts to retain or safely merge the guest trips associated with that action. User-owned trip records are stored in Firestore beneath the authenticated owner UID at users/{uid}/trips/{tripId}. Access controls are designed around that owner boundary.
Browser storage is used for authentication persistence, preferences, recent app state, offline support, and caches. A guest session is browser-bound unless it is saved with a linked account, so clearing browser data may make that guest account unavailable.
4. Maps and place providers
TripDo uses Google Maps Platform services, including Places and Routes, to resolve place identities, retrieve place details or photos, and calculate travel routes, times, and distances. Relevant place queries, coordinates, and route inputs are sent through TripDo server proxies, except for browser-side map rendering with a restricted public Maps key. Google processes that data under its own terms and privacy practices.
5. AI-assisted planning
Relevant trip context and assistant messages may be sent to model providers to produce planning suggestions, structured outputs, or explanations. The current reasoning loop and ordinary structured helpers use DeepSeek. Eligible outing-duration research can use Google Vertex AI with Google Search grounding. Credentials remain on the server.
AI output is assistive and may be incomplete or wrong. TripDo does not treat model prose as a guarantee of availability, safety, opening hours, price, route conditions, or suitability. Review important details with official sources before travel.
6. Analytics, cookies, and similar technology
When supported, the app uses Firebase Analytics for bounded product events such as session start, trip creation, account linking, currency changes, export, and deletion start. Authentication providers may use cookies or browser storage. TripDo also uses a service worker and cache storage for progressive-web-app behavior. No advertising or cross-site profiling feature is described by the current implementation.
If new analytics, advertising, or consent-sensitive technology is introduced, this policy and any required consent surface must be updated before that use is enabled.
7. Why the data is used
TripDo processes this information to authenticate users, save and restore trips, calculate routes, build and revise itineraries, finalize plans, protect owner-scoped records, diagnose failures, measure bounded product usage, and prevent abuse. Trip data is not presented as a public profile or shared plan under the current product contract.
8. Retention, export, and deletion
Trip and account data remains associated with the account until it is deleted or no longer needed for the purposes described here, subject to operational backups, security records, and legal obligations. The app provides Export data and Delete account actions under Planning settings → Account. Deletion removes user-owned Firestore data and then attempts to remove the Firebase Auth account.
If an authenticated deletion cannot complete, follow the current instructions on the Contact page. A real support inbox still needs to be configured before public launch; until then, the in-app authenticated deletion action is the available request path.
9. Security and children
TripDo uses authenticated server boundaries and owner-scoped access controls, but no online service can guarantee absolute security. Do not place passwords, payment-card details, government identifiers, or other unnecessary sensitive information in trip or assistant fields. The service is not designed for children to create accounts without appropriate parental or guardian involvement.
10. Changes and contact
Material changes should be reflected on this page with a revised date. Questions, access requests, or unresolved deletion requests should follow the Contact and support page.