What we keep, and why.

The short version

Who we are

TripStash (the app and this website, tripstash.site) is made and run by Rachit Jain, an individual based in India ("we", "us"). He decides how and why your personal data is used, which makes him the controller under the GDPR and UK GDPR, the business under the CCPA, and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023.

For anything about your data, including the rights below, write to support@tripstash.site. That address also reaches our grievance officer for India: Rachit Jain.

What we collect

You can use TripStash without an account. Until you sign in, what you add stays on your phone and isn't sent to us (apart from the anonymous usage counts described below). Once you sign in, it's backed up to your account so it's on every phone you use and can be shared.

Your account

• Your email address and password, handled by Google Firebase Authentication. We never see your password; Google stores it in scrambled form.
• Whether your email is verified, when the account was made, and when it was let in to document reading and backups (new accounts may wait a day or so when lots arrive at once).

Your profile

• The name you give (a nickname is fine), your home city, and the countries of your passports. The passport countries help the app say which visas and documents a trip needs.

Your trips and plans

• Each trip's name, destinations, dates (or a rough month), who's going (a party type and how many adults and children), what it's for, and what's already booked.
• Plan items: flights, stays, trains, car hire, tours and restaurants, with their kind, title, times and time zones, places and countries, provider, booking reference, booking link, your notes, the documents that go with them, how many people a booking is for, and the travellers' names as printed on it. Those names may be other people's: only add bookings you're entitled to share with the people on your trip.
• Packing lists (what's on them, and who ticked what) and any document types you make up.

Your documents

• The files you add: tickets, bookings, receipts, insurance, and identity papers like passports, ID cards, driving licences and visas. Also any health records you choose to add, like vaccination certificates.
• Each document's details: its kind, title, file type and size, which trip it's in (or your bag), and who added it.
• What reading it found: its kind, and for passports, ID cards, licences and visas only the issuing country, whether a visa is a Schengen visa, and the expiry date (see How documents are read).
• Photos are re-saved on your phone before they're uploaded, which strips camera metadata such as GPS location. If your phone can't process a photo, it's uploaded as it is.

Forwarded emails (Inbox)

• Each account can have a private forwarding address. Emails sent to it are kept in your Inbox: the sender's address, the subject, when it arrived, the email's text (encrypted, up to 100 KB) and up to ten PDF or image attachments (encrypted, stored as documents, with their original file names).
• If you ask TripStash to read one, the bookings it suggests are kept with the email.
• You can change your forwarding address at any time; the old one stops working.

Usage limits

• Daily counts of how many documents you've had read, uploaded, and so on, so the daily limits work.

Anonymous usage counts

• The app sends a small set of events: when an onboarding step is shown or done, a trip is created, sign-in is shown, done or put off, a first document is added, a document read finishes, a loose end is ticked, or the sample trip is opened. Each comes with a few fixed details (such as which onboarding step) and the time.
• They carry a random install ID made on your phone. It's never sent with your sign-in and never stored next to your account, so these counts can't be linked to you. No names, places, trip contents or IP addresses are stored with them. There isn't a setting to turn them off yet.

Technical data

• Like any internet service, our servers see your IP address and basic request details. We use the IP address only to count requests for rate limits; we don't store it in our database. Cloudflare, which runs our servers, keeps short-lived logs, and errors are logged for a few days so we can fix them.

Things that stay on your phone

• Reminders are scheduled by your phone. We don't use push notifications and receive nothing about them.
• City and country information (from GeoNames, Wikipedia, Wikidata and mledoze/countries) is built into the app, so looking up a place doesn't contact anyone.
• Map links open Google Maps only when you tap one.

How documents are read

Reading is what turns a ticket into a day on your plan, so after you add a document the app asks our server to read it. It's done on Cloudflare Workers AI: open models (currently GLM, Gemma and Mistral) running on Cloudflare's own hardware, the same company that stores your files. The companies that made the models never receive your documents, and no other AI company is involved. Cloudflare says it does not use content processed by Workers AI to train models, and doesn't keep inputs or outputs once a request is done.

• Tickets, bookings and everything else get a full read: what kind of document it is (with a few other guesses, in case it's unclear) and any bookings in it, with their times, places, provider, booking reference, how many people they're for and the travellers' names as printed. Those bookings go back to your phone and become items on your plan. Only the document's kind is kept with the document.
• Passports, ID cards, driving licences and visas filed as one get a short check only: what kind it is, the issuing country, whether a visa is a Schengen visa, and the expiry date. Only those are kept. The model is told never to return names, document numbers or dates of birth.
• Health records you file as health (vaccination or medical) are never read. Our server refuses to send them.
• A file added without saying what it is is read once to find out. If it turns out to be a health record, only that label is kept, nothing else from it.
• Bookings you type in yourself are never sent to AI.
• Forwarded emails are read only when you tap Read. Then the subject, sender, text and attachments are read together, to suggest bookings.
• A document may be read again if you change what kind it is, tap Try again, or when the app re-files it.

To make a cover picture for a trip, only the destination's name (like "Kyoto, Japan") is sent to Workers AI, which draws a picture of the place. Covers are shared by everyone going there and contain nothing about you.

Machines get things wrong. Check what reading suggests before you rely on it; the Terms say more.

Who can see what

Only you, and the people you choose. In detail:

• Your bag (the documents that come on every trip, like your passport) and your profile's home city and passport countries are never shared.
• People you invite to a trip see that trip: its plan, its documents and their files, and the group packing list. Co-authors can also change things; viewers can only look. They see your name, your role, and your email address once you've verified it. Your personal packing list stays private unless you share it.
• Invite links work for 14 days or 10 uses, whichever comes first, and joining needs an account. Owners and co-authors can cancel open links at any time.
• Plan links ("Send the plan") show a web page to anyone who has the link: the trip's name and dates, "Shared by" with the trip owner's name, and the times, titles and places of planned and booked things. Never booking references, providers, notes, booking links, documents, files or travellers' names. The owner and co-authors can turn the link off at any time, and it stops working. The page asks search engines not to list it.
• Files added to a shared trip belong to that trip. They count against the trip owner's storage, and they stay with the trip if the person who added them leaves it or deletes their account (with that person's name taken off). If the owner deletes the trip, everything in it is deleted for everyone.

Beyond that, we share personal data only with the service providers below, when the law requires it, to protect people's safety or our rights, or if TripStash moves to a company Rachit sets up or to a new owner (who would be bound by this policy, and we'd tell you first). We don't sell or rent personal data, and we don't share it for advertising.

Who else handles it

These companies process data for us, under their own data processing terms:

Exchange rates come from ExchangeRate-API (open.er-api.com). Our server fetches them about once a day; your phone never contacts that service, and nothing about you is sent. Apple and Google run their app stores under their own privacy policies.

Why we use it

We use your data only to run TripStash for you and the people you share with, to keep it secure, and to see, in aggregate, whether it works. Under the GDPR and UK GDPR, our legal bases are:

• Contract: storing and syncing your account, trips, plans and documents, reading documents to file them, sharing what you choose to share, and answering support requests. Without this data, the app can't do its job.
• Legitimate interests: keeping the service secure and fair (rate limits, daily limits, error logs), and the anonymous usage counts. We've weighed these against your privacy; they're kept minimal and can't be linked to you.
• Consent: the waitlist email, and any health record you choose to add. You can withdraw consent at any time by deleting the record or leaving the waitlist.
• Legal obligation: when the law requires us to keep or disclose something.

Under India's DPDP Act, we process your data on the basis of your consent, given when you create an account or join the waitlist, and for the legitimate uses the Act allows. You can withdraw consent at any time by deleting your account; it doesn't affect what was done before.

How long we keep it

Deleting things

• Any document or file: delete it in the app at any time. Its file is deleted from storage.
• A trip you own: deleting it deletes everything in it, files included, for everyone on it.
• Your account: in the app, go to You → Delete account. That deletes your account and your sign-in (at Firebase), your profile, bag and Inbox, and every trip you made, files included. What you added to other people's trips stays with those trips, without your name. The Delete your account page has the details, and how to ask by email if you can't get into the app.
• Signing out isn't deleting: it removes your data from that phone, and it stays in your account for next time.

Keeping it safe

• Everything travels over encrypted connections (HTTPS).
• Every file, and every forwarded email's text, is encrypted at rest with a 256-bit key unique to it. The keys are worked out from a secret held only by our server code; the storage service never keeps them.
• Every request to our server must carry a sign-in token signed by Google and less than an hour old. Every query is limited to your own data and the trips you're a member of, and roles are checked on every change.
• Invite links are stored only as a one-way hash, and plan links are long random codes that can be switched off.
• Files are only ever sent as downloads, never cached. Co-travellers see your email address only once it's verified.
• Rate limits and daily ceilings stop anyone from flooding the service.

No system is perfectly secure. If we learn of a breach that affects you, we'll tell you and the relevant authorities as the law requires. Found a security problem? See Reporting a security issue.

Where it's stored

Your data is stored and processed by Cloudflare and Google, which run data centres around the world, including outside your country. We run TripStash from India. When personal data from the European Economic Area, the UK or Switzerland is transferred elsewhere, we rely on our providers' safeguards: the European Commission's Standard Contractual Clauses (with the UK addendum) and, where they're certified, the EU–US Data Privacy Framework.

Your rights

Wherever you live, you can ask us to:

• Access: tell you what we hold about you and send you a copy.
• Correct: fix anything that's wrong. Most of it you can edit in the app yourself.
• Delete: delete your data. You can do most of this in the app; see Deleting things.
• Portability: give you your data in a common, machine-readable format. You can already open and share each file from the app; for everything else, ask us.
• Object or restrict: stop or pause a use of your data that relies on legitimate interests.
• Withdraw consent: at any time, for anything that relies on it.

For any of these, email support@tripstash.site from the address on your account (so we know it's you; we may ask you to confirm). We'll answer within 30 days, and it's free.

EEA and UK

You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to sort it out first.

California

In the last 12 months we've collected the categories described in What we collect: identifiers (email address, install ID, IP address), account and trip records, and the contents of documents you add, which can include sensitive personal information such as passport or ID details and health information. We use them only to provide the service, as described here. We don't sell or share personal information (as the CCPA defines those words), and we don't use sensitive personal information to infer anything about you. You have the right to know, delete and correct, and not to be discriminated against for using your rights. You can use an authorised agent; we'll ask them for proof.

India

Under the DPDP Act you can ask for a summary of your data and how it's used, correction, completion, updating or erasure, and you can nominate someone to act for you if you die or can't act yourself. Write to our grievance officer, Rachit Jain, at support@tripstash.site. If you're not satisfied with the answer, you can complain to the Data Protection Board of India.

This website and the waitlist

• No cookies, no trackers, no analytics. This site sets no cookies and loads nothing from other sites, apart from the robot check below. Its fonts are served from this site, not Google.
• The waitlist: if you join, we keep your email address (in lower case), when you joined, which version of the sign-up wording you agreed to, and a scrambled (hashed) copy of your personal removal link. It's kept in a database of its own, apart from the app. We'll send you one email, when TripStash launches, and then delete the list. Nothing else, and we don't share it.
• Leaving the list: use the link you're shown after signing up (each sign-up makes a new one and retires the old), the link in the launch email, or write to us.
• The robot check: when you start filling in the waitlist form, Cloudflare Turnstile loads from challenges.cloudflare.com and looks at signals from your browser and device to tell people from bots. We only receive a pass or a fail. Cloudflare's own privacy policy covers what Turnstile handles.
• Opening a plan or invite link on this site passes the request to our app server, as described above.

Children

TripStash is for people aged 13 and over. We don't knowingly collect personal data from anyone younger, and if we find we have, we delete it.

If you're 13 or older but under the age of digital consent where you live (the age at which you can agree to the use of your personal data yourself), a parent or guardian needs to agree on your behalf before you create an account. That age is 16 in some EU countries and lower in others, 13 in the UK, and 18 in India, where the DPDP Act needs a parent's or lawful guardian's consent for anyone under 18. Your parent or guardian can use the rights on this page for you, including asking us to delete your account.

TripStash has no ads, no tracking and no profiling for anyone, children included.

Bookings and documents for a family trip will sometimes include a child's name or papers: only add them if you're their parent or guardian, or have their parent's or guardian's permission.

If you think a child has given us personal data without the consent they needed, write to support@tripstash.site and we'll delete it.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change matters, for example a new kind of data or a new company handling it, we'll tell you in the app or by email before it takes effect.

Contact

Rachit Jain, TripStash: support@tripstash.site. A person reads every email.