Privacy Policy

1. Who we are and when this policy applies

TripNova is a local-first trip-planning app for iOS, Android, and the web, published by NovaThrive LLC. This policy applies to the TripNova apps, website, accounts, and cloud services. For a privacy question or rights request, contact privacy@tripnova.io.

2. Data we handle now and conditionally in the future

You can build trips and itineraries as a guest without creating an account. What leaves your device depends on the features you choose. Sections 2.1 through 2.5 describe the base practices that apply now. Section 2.2.1 describes the required-birthday signup flow. Section 2.6 describes conditional future features that are not active yet. Section 2.7 describes sign-in codes by text message, which apply only where TripNova offers them.

2.1 Data kept on your device

Your guest profile, trips, itineraries, checklists, documents, reminders, and exports are stored locally on your device or in your browser, and reminders are scheduled on your device. Opening TripNova does not create a cloud account or upload this content. Local data leaves your device only when you use an online feature, such as searching for a place, checking the weather, or signing in so that your trips are backed up. You control local data through the app and your device or browser storage controls.

Booking import: when you import a booking confirmation, such as a PDF, an email, a wallet pass, a photo, or pasted text, TripNova reads it on your device; the file is not uploaded to be read. TripNova does not extract passenger names, ticket numbers, prices, or payment or loyalty details. Only the flights and stays you review and save become trip data. Each source file is kept in the trip's documents unless you switch that off in the review. For a trip in your account, a kept file is backed up and synced with the trip, including everything it contains, such as passenger names and prices.

Text and barcode recognition: TripNova recognizes text in the photos and scans you import, and decodes boarding-pass barcodes, on your device. On iOS it uses Apple's built-in Vision framework. On Android it uses Google's ML Kit text-recognition and barcode-scanning models, which are bundled in the app and run on your device. We use ML Kit to provide on-device reading of booking confirmations on Android. On Android, TripNova asks for your permission before it first uses ML Kit to read a photo, scan, or boarding-pass barcode. If you decline, PDF, email, wallet pass, and pasted-text import still work. You can change your choice in the app's settings. The image or file is not sent to Google or to us to be read. ML Kit does send Google diagnostics: device and app information, a per-installation identifier, performance metrics such as latency, image format and size, and error codes, and API configuration. According to Google's ML Kit documentation, it never sends image content. Google collects the diagnostics to maintain and improve ML Kit. Legal basis for ML Kit: your consent (Art. 6(1)(a) GDPR), which is also the consent required under Art. 5(3) of the ePrivacy Directive and regulation 6 of the UK PECR. The web app does not read text in photos or scans. Section 5 lists Google ML Kit as a provider.

Photos and files: when you add a photo or file, such as a trip cover, an attachment, your profile photo, or a booking to import, you choose it with your device's own photo or file picker, and TripNova receives only the items you select. Your profile photo stays on your device. A cover, photo, or file that you add to a trip is stored with that trip: on your device for a guest trip, and backed up and synced with the trip once it is in your account (section 2.3).

Reminders: reminders are local notifications that your device schedules and shows. The notification itself is not sent to us or to a server; it is built from your trip's activity times and checklist due dates, which are stored with the trip (section 2.3). TripNova schedules one at the start time of each activity that has a time within the trip's dates, and one at 9:00 on the due date of each open checklist item. Each kind can be turned off in Settings under Notifications. TripNova explains reminders in the app first and asks your device for notification permission only when you choose to turn them on. On Android you can also allow exact alarms so that reminders arrive on time; without them they may arrive a few minutes late. The web app cannot show reminders. Push notifications from a server are not active (section 2.6).

Sign-in on your device: when you sign in on iOS or Android, the app keeps an opaque session token in your device's secure, encrypted storage, separate from your trip data, so that you stay signed in. Your data exports never include it. On the web, the sign-in session is kept in cookies instead (section 9).

Legal basis when the app processes this data locally: performance of our contract with you (Art. 6(1)(b) GDPR). Data that never leaves your device is not received by or accessible to us.

2.2 Your TripNova account

Creating an account is optional and is needed only for cloud backup and sync, and for collaborative features when they launch. Our self-hosted identity service, powered by Ory Kratos, stores your sign-in contact, an email address, and your first name (required by TripNova when you create an account with an email address). Your password, if you set one, is transmitted to our self-hosted identity service over an encrypted connection and stored only as a salted hash; we do not store it in plaintext. Phone sign-in is not yet available. Section 2.7 explains how sign-in codes by text message work where TripNova offers them.

Sign in with Google or Apple (optional): where the app offers them, you can sign in or sign up with Google or Apple instead of an email address and password. The provider confirms your identity to our identity service and returns identity details that include your email address and, where it has one, your name. The provider must have verified the email address, and we refuse one that it has not. Apple returns your name only the first time you use it with TripNova. Our identity service keeps the email address and name as your sign-in details and links that provider to your account. Your birthday is never sent to Google or Apple. On the web, a sign-in screen that offers Sign in with Apple loads Apple's sign-in script from Apple's servers when it opens, before you choose a method, so Apple can receive your IP address and browser details even if you sign in another way. Each provider handles your use of its sign-in under its own privacy policy (section 5).

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

2.2.1 Required birthday and age-group statistics

The 18+ signup flow requires your full date of birth, including day, month, and year, before email, Google, or Apple account creation. TripNova checks the declared date against its 18+ account age requirement using the server UTC calendar date. A February 29 birthday qualifies on March 1 in a non-leap year. A date that does not exist, is in the future, or is before 1900 is rejected as invalid. This is self-declared age information, not independent age verification.

Terms acceptance and acknowledging this Privacy Policy do not establish a lawful basis for every use of personal data.

TripNova retains the full calendar date privately in product-account storage, separately from NovaThrive sign-in identity details. It uses the date to check age eligibility, to keep that eligibility on record, and for internal age-group statistics. Birthdays are kept out of public profiles, provider authentication tokens, redirect URLs, and third-party telemetry.

Age-group statistics. Authorized operators produce internal age-group reports on demand; there is no scheduled report. A report contains only counts in fixed age groups, never an individual birthday. If any populated group has fewer than 20 accounts, the entire report, including totals, is suppressed. Accounts that opted out, deleted accounts, and accounts under 18 are excluded. Accounts are included in those reports by default; Privacy & data lets you opt out of the statistics, and an opted-out account is left out of all later reports.

Legal basis: the age eligibility check, and keeping your birthday so that your account remains eligible, rely on contract necessity (Art. 6(1)(b) GDPR). Internal age-group statistics rely on our legitimate interests in understanding the age profile of our users in aggregate (Art. 6(1)(f) GDPR). You can object at any time by opting out in Privacy & data.

Retention. TripNova keeps your birthday while your TripNova account exists. It is deleted when you delete your TripNova account or when your NovaThrive identity is erased; copies in encrypted backups are overwritten within the 30-day backup window in section 7. Eligible signup drafts expire after at most 10 minutes and are removed by the next once-per-minute cleanup during normal operation. Invalid or under-18 dates create no stored signup draft.

Corrections. You can correct your birthday in Privacy & data after a recent sign-in. The corrected date is checked against the same 18+ requirement. If a correction shows that you are under 18, ordinary account access stops while access to privacy requests remains available, and your existing data is not automatically erased. Access resumes automatically once the stored birthday shows that you are 18 or older.

Birthday, eligibility, acceptance records, and statistics preferences are included in product export and deletion. Individual exports do not include internal statistics reports. Excluding age statistics removes your account from subsequent reports; it does not itself erase the account birthday. You can separately request restriction, objection, or erasure where applicable. The in-app deletion action erases your TripNova account data while preserving your NovaThrive identity. Contact us for other privacy requests.

2.3 Trips in your account

Trips in your TripNova account are backed up and synced automatically; there is no per-trip setting. For each account trip we store its name, destinations, dates, itinerary, activities, notes, checklists, reminders, flight and hotel details, activity locations, cover images, attachments, and other files you upload. We also store record identifiers and update times needed to sync. Trips you plan as a guest stay on your device; after you sign in, TripNova may offer to move them into your account, and they move only if you accept.

A trip may contain personal data about a companion that you enter, such as their name and optional contact details. Only add what is needed for the trip, make sure you are entitled to share it, and tell them that it will be handled under this policy. When shared trips launch, we will also store a shared trip's members, invitations, and roles so invited people can access it.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). For companion data supplied by a user, our legitimate interest is to provide the trip-planning feature the user requested (Art. 6(1)(f)), balanced against the companion's rights and the data-minimization rules above.

2.4 Place, route, and map requests

When you use destination search, geocoding, routing, or points of interest, the place or route query is sent through our Cloudflare proxy to Geoapify. Weather requests are sent through the same proxy to OpenWeather. We do not attach your TripNova account ID to either upstream query. Cloudflare processes network data such as your IP address to deliver and rate-limit the request; this is not a promise of total anonymity. Map tiles are OpenStreetMap-derived/Protomaps tiles served by TripNova through Cloudflare. Directions open your device's maps app, such as Apple Maps or Google Maps, with the stop's name and location; that app's own privacy terms apply.

Legal basis: performance of our contract with you (Art. 6(1)(b)) and our legitimate interest in protecting the service from abuse (Art. 6(1)(f) GDPR).

2.5 Security and operational records

To keep the service available and protect it from abuse, our servers and edge network process limited technical records such as IP addresses, request times and routes, account or request identifiers, error details, and rate-limit counters. Application logs are designed not to contain trip content, email addresses, phone numbers, birthdays, precise coordinates, or chat text. Where an account reference is needed, we use an internal identity ID rather than your email address.

Legal basis: our legitimate interest in securing and operating the service (Art. 6(1)(f) GDPR).

2.6 Conditional future sharing and communication features

Live GPS sharing: if and when you enable it, the person sharing location must accept each sharing session. Location is relayed only to the selected participants, is never persisted or logged by TripNova, and is session-scoped and short-lived.

Coarse last-seen: if and when you separately opt in, TripNova may keep only your latest coarse location stamp for trip interactions. This consent is distinct from live sharing and from whether another person can ask to find you. The latest-only stamp will be cleared after the configured short retention TTL; the precise period will be published before this feature is activated.

Trip chat: if and when account-backed shared-trip chat launches, messages and related account/trip context will be processed to let members communicate and coordinate the trip. The planned default is 365 days for live messages and three years for the archive, subject to trip or account deletion.

Shared trips, polls, shared photos and files: if and when these launch, a shared trip's content, membership, votes, and shared media will be visible to its members according to their roles.

View-only links: if and when this launches, a trip owner will be able to create a link that shows the trip, read-only and without an account, to anyone who has it, until the owner revokes it or it expires.

Push notifications: if and when server push launches, we will process a device push token only after you allow notifications.

Peer-to-peer (P2P) media: if and when enabled, sharing on a local network or nearby mobile devices will require its own consent. Media may transfer directly and recipients keep copies on their own devices. TripNova cannot remotely delete copies already transferred; cloud or account deletion covers cloud data and the initiating user's own device only.

2.7 Sign-in codes by text message (SMS)

Where TripNova offers sign-in codes by text message, NovaThrive LLC sends them under the TripNova name. A code is a one-time code to sign up or sign in with your phone number. We send one only when you request it in the TripNova app, and we use text messages for no other purpose: no marketing and no promotions. The phone number you use is held by our self-hosted identity service as your sign-in contact, like an email address (section 2.2).

Opt-in. Before the first code of each request, the app shows an opt-in with an unchecked checkbox, the notice that message and data rates may apply, the HELP and STOP instructions, and links to the SMS terms and to this section. Codes you ask us to resend during the same request rely on that same opt-in, and a new request shows it again.

Legal basis for sending the code: performance of our contract with you, including steps you ask us to take before it begins (Art. 6(1)(b) GDPR). The checkbox is the opt-in record that mobile carriers require. It is not consent under the GDPR, and we do not rely on consent to send the code.

Opt-in record. Each time we send a code, we add a record to a log: the time, your phone number, the purpose (sign-up or sign-in), the version of the opt-in text you were shown, and your account ID when we know it. We keep it to demonstrate that each text followed a request and an opt-in, as mobile carrier rules require.

Legal basis for the opt-in record: our legitimate interest in being able to demonstrate that our text messages meet mobile carrier opt-in requirements (Art. 6(1)(f) GDPR). The record holds only the fields listed above and is kept for a fixed period.

Retention. We keep each opt-in record for 365 days and then delete it. We keep it for that period even if you delete your TripNova account or your NovaThrive identity is erased, because Art. 17(3)(e) GDPR allows us to retain data we need to establish, exercise, or defend legal claims.

Access and export. Opt-in records that match your NovaThrive identity or the phone number currently on your account are included in your NovaThrive identity data export. Section 8 explains how to ask for it.

Delivery and sharing. Messages are delivered through AWS Notify (AWS End User Messaging), our processor (section 5). AWS handles the request in the EU (eu-west-1, Ireland), and the message then reaches you through mobile carriers in the country of your number, which may be outside the EEA. In particular:

• No mobile numbers will be shared with third parties or affiliates for marketing or promotional purposes.
• Text messaging originator opt-in data and consent will not be shared with any third parties.
• Messages are delivered through AWS Notify. AWS does not share end user phone numbers with third parties for marketing or promotional purposes.

Countries. Sign-in codes by text message are not available in every country. If your number is not supported, no code is sent and you can use email instead.

3. How we use data

We use the data described above only to:

• run the app, and back up and sync the trips in your account across your devices;
• create and secure your account, verify your sign-in contact, and recover access;
• where TripNova offers it, send you a one-time sign-in code by text message when you request one, and keep a record of that opt-in (section 2.7);
• check account-age eligibility and produce internal age-group counts on demand;
• enable shared trip planning with people you invite, when that feature launches;
• provide place search, routing, points of interest, and maps;
• support you and diagnose errors you report;
• keep the service secure, available, and free from abuse.

We do not sell personal data or use it for advertising or targeted marketing. The required-birthday flow automatically decides account-age eligibility from the submitted date. You can correct an inaccurate birthday and contact us to request review of an eligibility decision. The rights in section 8 remain available.

4. When we disclose data

We disclose data only as needed to operate features you request, to the providers in section 5, when you share a trip once sharing launches, when disclosure is required by law, or in the business transfer described below.

When shared trips launch, members of a shared trip will see its content, including companion details, files, and membership information included in that trip, and their access will depend on their assigned role. A member may export or copy information onto their device; those independent copies cannot be remotely erased by TripNova.

Business transfers: if NovaThrive LLC is involved in a merger, reorganization, financing, or sale of the Service, personal data we hold may be transferred as part of it, subject to applicable law.

5. Service providers, storage, and transfers

Cloud account and trip data are hosted in the European Union, primarily in Ireland, and our team may also access it from the United States, as described after the table. Our processors (AWS, Cloudflare, Geoapify, and OpenWeather) are bound by contract to protect personal data to at least the standard this policy sets. Google and Apple sign-in and Google ML Kit are not our processors: each acts as an independent controller under its own privacy policy.

Ory Kratos runs on our infrastructure and is not a third-party processor. Cloudflare operates a global edge network, so transient request data may be processed outside the EEA. NovaThrive LLC is based in the United States, and our team may access personal data from there. For transfers from the EEA or UK to the US, we rely on the EU-U.S. Data Privacy Framework and its UK Extension where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses, with the UK Addendum for UK data. Geoapify processes place queries under a data processing agreement; OpenWeather is in the UK, which has an EU adequacy decision. To ask for a copy of the safeguards, email privacy@tripnova.io.

6. How we protect data

We use safeguards appropriate to the data and risk, including encrypted connections, access controls, data minimization, separation of identity and trip data, and encrypted off-site backups. Passwords are stored as salted hashes. No internet service can guarantee absolute security, so use a strong, unique password and tell us if you suspect misuse.

7. How long we keep data

Local-only data remains on your device until you delete it through the app or your device or browser controls. We keep account and synced-trip data while your account exists, unless you delete a synced trip sooner. The conditional future retention periods below are planned defaults, not currently enforced because those features are not active.

8. Your rights and choices

Subject to applicable law, you may:

• Access the personal data we hold about you;
• Export a portable copy of local and cloud data;
• Rectify account or trip data that is inaccurate;
• Erase a trip or your account, subject to the backup window and independent copies described above;
• Restrict or object to certain processing;
• Withdraw consent at any time where we rely on consent, without affecting earlier lawful processing;
• Complain to the data-protection authority where you live or work, or where you believe a violation occurred.

Complaints. If you are in the UK, you can complain to us at privacy@tripnova.io; we acknowledge complaints within 30 days. You can also complain to the ICO (ico.org.uk). In the EU, you can complain to the authority for your country listed at edpb.europa.eu.

Account deletion

In the TripNova app, open Settings and use Delete TripNova account to erase TripNova product data (synced trips, media quota objects, account birthday and eligibility records, statistics preferences, and this account's local data on that device). Device-only guest trips and other accounts are kept. You can also export a copy first from the same Settings screen. That product delete does not erase your NovaThrive identity, which other NovaThrive apps may still use.

Without the app: you can also ask us to delete your TripNova account by email. You may email privacy@tripnova.io from any address with the subject "TripNova account deletion". Tell us the email address on your TripNova account, including an Apple Hide My Email address if you use one. We send a confirmation code to that address, and replying to confirm completes verification. We then delete the TripNova account's data, exactly what Delete TripNova account in the app deletes, and complete the request without undue delay and at the latest within one month of verifying it.

Data held only on your own devices is not part of this request; Erase data on this device in the app covers it. Deleted data follows the backup window in section 7. We keep the correspondence about a deletion request, and a short record of it (a reference, dates, and your account ID), for 3 years after the request is closed (section 7). Your NovaThrive identity stays unless you also ask for it to be erased (below).

To erase the shared NovaThrive identity (Kratos account), email privacy@tripnova.io or use the operator path documented for NovaThrive identity erasure. We will verify the request and complete erasure without undue delay and at the latest within one month of verifying it. Copies already on another person's device cannot be remotely removed. Where TripNova offers sign-in codes by text message, the opt-in records described in section 2.7 are kept for their 365 days even after erasure.

To exercise another right, email privacy@tripnova.io. We may need to verify your identity. We will respond without undue delay and ordinarily within one month; where the law permits an extension, we will explain it.

9. Cookies

The public website at tripnova.io sets no cookies and uses no analytics or advertising trackers. The web app at app.tripnova.io stores strictly necessary sign-in state. Browser authentication uses the NovaThrive identity service's session and security cookies to keep you signed in and protect sign-in requests.

Those cookies are first-party: our identity service sets them from a TripNova address (auth.tripnova.io), not from a third party. The session cookie keeps you signed in. The security cookies carry a sign-in or sign-up flow from one step to the next and protect each form against cross-site request forgery (CSRF). While you are redirected to Google to sign in on the web, the web app also notes the attempt in your browser tab's session storage: the provider, the page you came from and, for sign-up, an opaque attempt reference with the document versions you accepted, never your birthday. It is removed when the attempt ends. The iOS and Android apps do not use cookies for this: they keep a session token in secure storage on your device (section 2.1).

If non-essential cookies are introduced, we will update this policy and ask for consent before setting them.

10. Children

TripNova is intended for adults aged 18 and older. We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us so we can investigate and delete it where appropriate.

11. Changes to this policy

We may update this policy as TripNova evolves, especially when a feature changes what data is handled. We will revise the date above and provide prominent or advance notice of material changes where appropriate or required by law. We will seek consent before new processing where consent is the applicable basis. We will not use personal data we already hold in a materially different way from what this policy described when we collected it without your consent.

12. Contact

Questions or requests can be sent to privacy@tripnova.io. NovaThrive LLC is the controller for TripNova.