Privacy Policy

Who we are

TravelTogether is a group travel planning app currently in early development. When we say "we", "us", or "our", we mean the TravelTogether team. This Privacy Policy applies to the TravelTogether mobile application ("App").

This policy is separate from our website privacy policy, which covers our landing page only.

Current state of the app

The App is in early development and private testing. It currently supports guest sessions, registered accounts, shared trips, invitation flows, and collaborative trip-planning features.

We intend to update this policy incrementally as new data categories, processors, or sharing features are introduced. The "last updated" date at the top will always reflect the latest version.

Data we collect

Depending on how you use the App, we currently collect and process the following categories of data:

• Account and profile data — your display name, email address, hashed password, email verification status, and basic account timestamps.
• Guest session data — if you start without registering, we create a guest account record using the name you provide so you can begin using the App before claiming a full account.
• Authentication and security data — access tokens, refresh tokens, session type, verification codes, password reset codes, and related security records used to keep your account signed in and protected.
• Trip-planning content — trip details, membership records, invite codes, notes, polls and votes, to-dos, bookings, itinerary items, and related edit metadata such as the last editor of a note.
• Invite and communications data — email addresses entered to send trip invitations, plus verification and password-reset emails we send to account holders.
• Collaboration and service-operation data — data needed to authenticate realtime note collaboration, coordinate temporary editing locks on shared notes, and operate, secure, and troubleshoot the App.

How we use this data

• Create and manage guest and registered accounts
• Authenticate sessions and help prevent unauthorized access
• Send verification emails, password-reset codes, and trip invitations
• Display, sync, and manage shared trip-planning content across trip members
• Operate collaboration features, including preventing conflicting edits on shared notes
• Maintain, secure, troubleshoot, and improve the App

We do not sell personal data, do not use App data for advertising profiles, and do not share personal data with third parties for their own marketing.

Third-party services

We currently use Resend to send transactional emails such as trip invitations, email verification codes, and password-reset codes.

If we add App-specific analytics, crash reporting, or other data processors in the future, we will update this policy before or when those services are enabled.

Data storage and security

We store passwords in hashed form rather than plain text. On iOS and Android, authentication tokens are stored locally using device secure storage when available. On web builds, tokens may be stored in browser localStorage as a fallback.

We use reasonable administrative, technical, and organizational measures to protect data, but no method of transmission or storage is completely secure.

Retention

We keep account and trip data for as long as it is needed to operate the App, maintain security, resolve disputes, or comply with legal obligations.

Verification codes and password-reset codes are short-lived. Refresh tokens are revoked on logout and may otherwise remain until they expire or are rotated.

Shared trip content may remain with a trip after a member leaves or is removed if that content is still relevant to the rest of the group. Account deletion or content-removal requests are currently handled manually.

Children's privacy

The App is not directed at children under 13. We do not knowingly collect personal data from children under 13.

Your rights

You can request access to, correction of, or deletion of your account data by emailing us at jointraveltogether@gmail.com. Because the App is still early-stage, these requests are handled manually and we may ask for information needed to verify your identity before processing them.

Please note that deleting an account or asking us to remove data may not automatically remove shared trip content that has already been contributed to a trip and remains relevant to other members. We will review those requests case by case.

Changes to this policy

This policy will be updated as new features are added to the App. The "last updated" date at the top reflects the latest version. For material changes, we will notify users within the App.

Contact

Questions or requests? Email us at jointraveltogether@gmail.com.