Privacy Policy

1. What data we collect

When you use GroupTrip, we collect the following information:

• Account information: your email address and display name, provided when you sign up.
• Trip data: trip names, dates, destination details, categories, and options you or your group members create.
• Voting preferences: your ranked votes within each trip category (stored as anonymised ranking arrays and not shared with other members individually).
• Usage data: basic analytics such as pages visited and features used, collected in aggregate.

2. How we use your data

• Account management: to authenticate you, maintain your session, and let you manage your profile and settings.
• Trip planning: to display trip content to you and your group members and to compute fair voting results via Borda count.
• Email notifications: to send you invites, trip updates, and account-related messages (e.g. password reset). You can opt out of non-essential emails in Settings.
• Product improvement: to understand how features are used and where we can improve the experience.

We do not sell your personal data to third parties.

3. Cookies

GroupTrip uses cookies strictly for authentication and session management. Specifically:

• Supabase auth session cookies: set when you log in to keep you authenticated across pages. These are essential for the application to function and cannot be disabled while you are signed in.

We do not use advertising or tracking cookies.

4. Third-party services

We rely on the following trusted third-party providers to operate GroupTrip:

• Supabase — database and authentication. Your data is stored in Supabase's managed PostgreSQL service. See Supabase's Privacy Policy.
• Paddle — payment processing for Pro subscriptions. Paddle acts as the merchant of record and handles all payment card data. We never store card details. See Paddle's Privacy Policy.
• SendGrid — transactional email delivery. Your email address is shared with SendGrid solely to deliver messages you have requested or that are necessary for the service. See SendGrid's Privacy Policy.
• Vercel — hosting and deployment. Application traffic is served through Vercel's infrastructure. See Vercel's Privacy Policy.

5. Data retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal data (including trip data you created and your voting history) within 30 days, except where retention is required by law or legitimate business purposes such as resolving disputes or preventing fraud.

6. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: update inaccurate or incomplete data. You can update your name and email directly in Settings.
• Deletion: request deletion of your account and associated data via the Settings page or by contacting us.
• Portability: request an export of your data in a machine-readable format.
• Objection: object to or restrict certain processing of your data.

To exercise any of these rights, contact us at support@grouptrip.app.

7. Security

We use industry-standard security measures including encrypted connections (TLS), row-level security on our database, and secure session handling to protect your data. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Children

GroupTrip is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes, we will notify you by email or by a notice within the application.

10. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@grouptrip.app.