LAST UPDATED NOVEMBER 14, 2026

Your trips, kept personal.

TrippedU is operated by Create Business Solutions. We collect account email addresses, profile names, usernames, bios, followed-profile connections, visited-trip choices, planning conversations, itineraries, assignment and invitation information, billing references, trip content you upload, reviewed song briefs and lyrics, generated recordings, movie choices and saved movies, and the technical data needed to operate the service.

How we use information

If you choose Google or Apple sign-in, that provider verifies your identity and shares basic account information, such as your name, email address and provider account identifier. We use it to sign you in and connect your TrippedU account. Apple may supply a private relay email address if you choose to hide your email. Email-code sign-in remains available.

For Apple sign-in, we keep a verified Apple authorization grant in encrypted server storage so we can revoke your app authorization when you delete your account. It is restricted to account operations and is excluded from trip exports and recovery deletion records. You can freshly verify your linked Apple account for deletion without receiving an email code; this does not switch your signed-in TrippedU account.

We use this information to sign you in, generate and save trip plans, deliver trips and invitations, store private journals, manage trip-pack purchases and legacy subscriptions, handle support and abuse reports, and maintain the service. Planning and optional lyric-writing requests are processed using OpenAI. Do not include unnecessary sensitive information in a planning conversation or song brief.

Before using AI tools, you choose whether OpenAI may process your planning answers, conversation, trip details and private planning notes, cover descriptions and previous AI covers you ask to edit, and reviewed song briefs and lyrics; and whether Runpod may process reviewed lyrics, musical direction, title, duration and a temporary song-saving link to create a recording. Information is sent when you use the relevant tool. A picture or screenshot you attach to the planning conversation is sent to OpenAI only after you separately allow pictures; it is used for that reply and is not kept with your trip. You can review or revoke this permission in Account & data. Revoking stops new requests; information already sent cannot be recalled. Viewing trips, using memories and playing saved songs do not require permission for new AI requests.

Who can see what

Your itinerary creator can see the itinerary workspace and the client name and email associated with the trip they created. That relationship does not give them access to your photos, videos, movie replays, or unrelated trips. Trip planners control sharing with contributors and viewers. Bearer invitation links grant the access described when they are created; keep those links private and revoke them if needed.

Business administration uses subscription, client assignment, and report records. Client media is excluded from ordinary partner and administration views. Limited safety investigation, support authorized by a traveler, or legal obligations may require separately restricted access.

Your profile and shared moments

New hearts added while signed in can show your profile name or username to people with access to that trip. Comments also show your account’s profile name. Earlier anonymous hearts remain anonymous; we do not match them back to accounts. Reaction lists do not expose email addresses or sign-in identifiers.

Your profile is private by default. If you turn on profile sharing, anyone with its link can see your display name, username, bio, and the published itineraries you choose to include. Those links also show the selected itineraries’ viewer-visible photos and videos. Private journal drafts, private traveler notes, and live location are not included in the public profile. Review your itinerary’s viewer and location settings before adding it to your profile.

Following a profile saves that connection to your account. The profile’s owner sees how many accounts follow it, not who they are. When a trip planner shares a trip with your account, we email your account’s address to tell you; the planner is not shown that address. Saving an itinerary invitation adds the permitted trip and its shared moments to your own map and feed. Access is checked when content is requested; revoked invitations, blocked authors, and withdrawn sharing can remove content from those views. You can edit your profile, unfollow travelers, remove selected trips, or turn profile sharing off. Turning it off revokes the trip links created for that profile. Copies someone already downloaded or captured cannot be recalled.

Custom songs and saved movies

When you request a custom song, the reviewed brief and lyrics are used to write and refine words, and the reviewed lyrics and musical direction are sent to our music worker hosted by Runpod to generate audio. We do not send that worker your full itinerary, journal photos or videos, or account sign-in credentials. Names and trip details are included in a song request only when you choose them for the reviewed words and direction. Generated recordings are saved with the trip in private storage.

The movie studio processes your selected trip content to make a movie. A finished movie saved to the trip is private to its planner by default. The planner can separately enable access for current trip viewers. Access is checked when playback or download is requested, and playback links expire. Revoking access does not recall copies already downloaded or prevent an unexpired playback link from working until it expires. Saving a movie does not automatically publish it to a public profile.

Service providers

We use Supabase for authentication, database and storage, Vercel for website hosting and website visit counts, OpenAI for AI planning and lyrics, Runpod for optional song generation, and Postmark for transactional email. Stripe handles website billing and Google Play handles purchases in the Android app. Google Workspace handles our support mailbox, Cloudflare holds encrypted independent recovery backups, and GlitchTip receives filtered operational error reports. Stripe and Google Play collect payment details through their checkout services. TrippedU stores payment references, credits, purchase and refund records, and subscription status. Complete payment card details stay with the payment provider. Google Play purchase tokens are verified on our server and stored as receipt hashes to prevent duplicate credit grants. These providers process information needed to provide their services.

Diagnostic reports use a limited set of technical fields, such as the app release, error type and source-file position. We exclude planning conversations, journal photos and videos, private notes, addresses, account email, sign-in tokens and request contents from these reports. Providers can receive connection information, including IP addresses, needed to deliver their services. We do not enable session recording or advertising tracking in our error reporting. Website visit counts and page-speed measurements use no cookies and leave out invitation links, trip and profile addresses and account details. Pages opened inside the TrippedU app are not counted.

Google Maps provides maps, satellite imagery, address lookup and place photos. The relevant place name, address or map position is sent to Google to provide these features, under the Google Privacy Policy. Photo lookups do not include your planning conversation, private notes or uploaded media. Wikimedia also supplies attributed destination photographs. Your location-sharing controls determine which places contributors and viewers can access.

Photos and location

Photos can contain capture times and location metadata. The app may use those details to place memories along a trip. Live location is shared only through the trip’s location controls and permissions. Review both your uploads and the access you grant to invitees.

Retention and your choices

We retain account and trip information to provide existing trip access, meet legal obligations, handle billing issues, and maintain service security. We currently have no automatic three-year trip deletion schedule. You can delete individual journal posts and revoke invitations using the trip controls. Your web account provides account and data controls, including a separate account deletion page with a warning and fresh email verification. Contact support to request access or correction of your account information; some billing or safety records may need to be retained where required.

Your web account also offers a trip download: a ZIP containing the itinerary PDF, stored photos and videos you can access, and a read-only offline viewer. The download respects your trip role and location permissions. Copies already downloaded to a device are not recalled when online content is changed or deleted. Contact support for account or billing records outside the trip archive.

Canceling your subscription stops future renewal and preserves your existing trips and uploaded content. Uninstalling the companion app does not delete your cloud account or cancel a subscription. Encrypted recovery backups are kept separately from ordinary product access; deletion from live systems does not immediately erase older recovery copies.

Saved songs and movies are part of trip content. Their controls let authorized users listen, watch and download. Account deletion includes that account’s saved movies; outstanding upload links must expire before final movie cleanup can finish. Recovery copies remain subject to the separate backup retention process described above.

Account deletion stops recurring TrippedU subscription billing before erasing account content. Trips already assigned to and owned by other travelers remain theirs. Contributions made anonymously through a shared link may not be identifiable as yours; contact support about a specific item. We keep a limited encrypted recovery record so an older backup cannot restore deleted account content into service. It contains account and deleted-record identifiers, a deletion time, and a hash of the normalized email address. That hash is still a personal identifier. The record excludes trip content, payment card details and the readable email address.

Teens and family trips

Accounts are for people aged 13 and older. Users under 18 need a parent or guardian’s permission; purchases and Creator subscriptions require an adult aged 18 or older. We do not request a full birth date or claim to independently verify a user’s age. We do not offer accounts for children under 13. If you believe a child under 13 has created an account, contact support so we can restrict it and address removal. Adults may include family photos in their own private journals.

We do not sell your personal information or use your trip content to target advertising. We use local browser storage for sign-in sessions, invitation access, and offline trip features. To ask a privacy question or make a request, use Support & safety.