Privacy Policy

This policy explains what data typeatrip.com, our apps and our travel tools process, why, and what rights you have. Controller: Daniel Rose, c/o IP-Management #9520, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany, contact@typeatrip.com.

The short version: we collect only what we need to create and deliver your travel plan, we use no advertising trackers, and we never sell your data.

1. What we process and why

Account and login. Your email address, and if you sign in with Google or Apple, the email address and basic profile they pass to us (Google Ireland Limited, Dublin, Ireland; Apple Distribution International Ltd., Cork, Ireland). We never store a password. Sign in with Apple lets you hide your email address; we then receive an anonymized relay address from Apple instead of your real one, and your plan is delivered through it. Note that for us a relay address is a separate account, so plans bought under it do not show up if you later sign in another way; just write to us and we merge the accounts. Legal basis: performance of contract.

Your trip input. The trip description you enter, your answers to our questions, and your revision requests. Used to research and write your plan. Unpaid trip drafts stay in your account until you delete them or your account. Legal basis: performance of contract.

Payment. Payments are processed by Stripe Technology Europe, Limited, 25/28 North Wall Quay, Dublin 1, D01 H104, Ireland. If you choose PayPal at checkout, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, also processes the payment as an independent controller. We receive confirmation of payment and the amount, never your card or account number. Legal basis: performance of contract.

Plan generation (AI). Your trip input and your entries in our AI-based travel tools are processed by Anthropic, PBC, San Francisco, USA (Claude models). Email addresses, phone numbers and bank account numbers (IBAN) that you type into your texts are removed automatically before anything is sent, because a plan never needs them. We send no payment data. Anthropic acts as our processor under a data processing agreement; transfers to the USA are based on the EU standard contractual clauses. Under Anthropic's API terms, content sent through the API is not used to train its models. Legal basis: performance of contract.

AI labelling. Travel plans and tool results are created with artificial intelligence. We say so in the document itself and additionally label PDF and Word files as AI-generated in their file properties, in a machine-readable way (Article 50 of the EU AI Act).

Health details and other sensitive data. We do not ask for health data or other special categories of personal data, not even in our follow-up questions. Please enter such details only if they really matter for your trip, for example a food allergy or step-free access. If you provide them voluntarily, for example in your trip description, your answers or the allergy field of the travel first aid kit tool, we use them only to tailor your plan or tool result and mention them there only briefly and in general terms. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give by deliberately entering them. You can withdraw it at any time for the future by deleting your account or writing to us; we then delete the details. Like all trip input, they are processed by Anthropic (see above).

Travel tools and services. Our free tools require an account with an email address. We store your entries and results in your account (history) so you can open them again. The packing list, travel first aid kit, trip budget calculator, road trip planner, school trip checklist, travel documents check, RV departure checklist and rental handover checklist create their result with AI; the long weekend planner, jet lag planner and tolls overview work without AI. In the family trip vote, the person who creates a vote stores its title and options in their account and gets a link to share; people voting through the link need no account and enter only a name of their choice (up to 30 characters) and their vote, which everyone with the link can see. A vote is deleted together with the account of the person who created it, and we delete single votes on request. For paid extras with suggestions near you, we send only the location you enter (no name or email address) to map services based on OpenStreetMap to find shops and sights nearby: the Nominatim place search of the OpenStreetMap Foundation (United Kingdom, covered by an EU adequacy decision) and the Overpass servers overpass-api.de (Germany) and overpass.kumi.systems (Austria). Service inquiries (name, email address, details about your property, your message) are delivered to our mailbox via Resend. Legal basis: performance of contract, for voluntary health details your consent.

Apps for Android and iOS. This policy applies to our apps as well. In-app purchases are handled by Google Play or the Apple App Store; we receive no payment data, only a purchase token or transaction number, which we verify with Google or Apple to unlock your plan and store with your order. In the iOS app you can buy without signing up: we then create an anonymous account without an email address, tied to the app on your device, and you can add an email address later so your plans are also available on the web. The apps use no tracking and no advertising. The optional fingerprint or face unlock runs on your device only; we receive no biometric data. You can delete your account right in the app or at typeatrip.com/account.

Email delivery. We send transactional emails (login codes, follow-up questions, your plan, status updates) via Resend (Plus Five Five, Inc., San Francisco, USA) under a data processing agreement with standard contractual clauses; Resend is also certified under the EU-US Data Privacy Framework. No marketing emails without your separate consent.

Contact and support. If you email us or use the contact form in your account, we process your email address, your message, its category and an optional reference to one of your trips to handle your request. Messages reach our mailbox via Resend. Legal basis: performance of contract or legitimate interest in answering your request.

Hosting and database. The website runs on our own server at Hostinger International Ltd. (Larnaca, Cyprus), located in a data center in Frankfurt, Germany; our mailboxes are also hosted by Hostinger. Technical logs (IP address, timestamps, requested page, browser) are processed to operate and secure the service and are deleted automatically after 14 days; daily backups of the database and stored files stay on the same server and are deleted after 14 days. Your account data, tool results and plans are stored with Supabase (contracting party Supabase Pte. Ltd., Singapore) in its EU region in Frankfurt, Germany (Amazon Web Services data center); where Supabase or its subprocessors access data from outside the EU, for example for maintenance and support, this is covered by the EU standard contractual clauses. Data processing agreements are in place with Hostinger and Supabase. Legal basis: legitimate interest in a secure, working service, and performance of contract.

Audience statistics. We count page views anonymously in our own database: only the page path, the domain of the referring site, the language version of the page and the time. No cookies, no IP addresses, no link to your account. Legal basis: legitimate interest in basic audience statistics.

2. What we do not do

No advertising trackers, no third party analytics profiles, no sale or sharing of personal information for advertising. Only cookies and similar storage that are strictly necessary to run the site: login cookies, set only when you sign in, and browser storage for things you trigger yourself (the trip wish you started typing so it survives signing in, the package you picked, and whether you closed a notice). If you install the web app, it additionally stores an offline page and its icons on your device.

3. How long we keep data

Your account, plans, tool results and revision history stay until you delete your account or ask us to delete it; deleting your account removes them all. Server logs and server backups are deleted after 14 days. Records we must keep for tax and commercial law (invoices, payment records) are kept for the statutory retention periods (up to 10 years under German law) and then deleted.

4. Your rights

You can request access, a copy of your data, correction, deletion, restriction and portability, you can withdraw consent at any time, and you can object to processing based on legitimate interest. You can delete your account with all trips yourself at any time; for everything else, email contact@typeatrip.com. You can also complain to a data protection authority; the authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany).

California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we honor access and deletion requests as described above.

5. Changes

We will update this policy when the service changes and publish the new version here.