Last updated: March 30, 2026
This Privacy Policy explains how Trippin Osterried GbR ("Trippin", "we", "our", "us") collects, uses, stores, and protects your personal data when you use the Trippin mobile application and website. This policy is provided in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR / DSGVO).
The controller responsible for data processing within the meaning of the GDPR is:
Trippin Osterried GbR
Alt Schürkesfeld 29
40670 Meerbusch
Germany
Authorized representatives (Vertretungsberechtigte Gesellschafter): Melanie Osterried, Marc Osterried
Email: trippintravel@outlook.com
Phone: +49 160 93078269
Trippin Osterried GbR is a small business exempt from VAT pursuant to § 19 UStG (Kleinunternehmerregelung).
We are not required to appoint a data protection officer. For all data protection inquiries, please contact us at the email address above.
We collect and process the following categories of personal data:
We process your personal data for the following purposes, each with a specific legal basis under Art. 6(1) GDPR:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation & authentication — Creating your account, verifying your identity, maintaining your session | Account data, device data (IP address) | Art. 6(1)(b) — Performance of a contract (Terms of Service) |
| Trip planning & collaboration — Enabling group trip creation, shared itineraries, availability coordination, expense tracking, Vibe Checks, quests, and activity feeds | Trip & collaboration data, financial data, photo data | Art. 6(1)(b) — Performance of a contract |
| In-app purchases & subscriptions — Processing payments for Trippin Pro, Group Bundles, and Per-Person unlocks | Purchase records, account data | Art. 6(1)(b) — Performance of a contract |
| AI-powered suggestions — Generating destination recommendations, itineraries, packing lists, quest ideas, conflict analysis, and Vibe Check synthesis | Trip-level context only (destination, dates, budget, group size, preferences). No personal data (name, email) is sent to AI providers. | Art. 6(1)(b) — Performance of a contract (core app feature); Art. 6(1)(f) — Legitimate interest in providing relevant travel suggestions |
| Push notifications — Sending trip updates, reminders, and group activity alerts | Push notification tokens, account data | Art. 6(1)(a) — Consent (you can enable/disable notifications in your device settings at any time) |
| Smart Nudges — Sending psychology-driven notifications to encourage group participation and prevent planning stalls | Behavioral data (screen views, participation status, peak activity hours), notification logs | Art. 6(1)(a) — Consent (Smart Nudges are opt-in and can be disabled in notification preferences) |
| Analytics & app improvement — Understanding feature usage, improving the user experience, identifying bugs | Usage data, analytics events, device data | Art. 6(1)(f) — Legitimate interest in improving our service. You have the right to object (see Section 10). |
| Error reporting — Detecting and fixing crashes and bugs via Sentry | Device type, OS version, anonymous error/crash data, stack traces | Art. 6(1)(f) — Legitimate interest in maintaining app stability and security |
| Waitlist — Collecting email addresses from interested users via the landing page | Email address | Art. 6(1)(a) — Consent (you voluntarily submit your email and can request deletion at any time) |
| Content moderation & user safety — Processing reports and blocks to maintain a safe community | Content moderation data | Art. 6(1)(f) — Legitimate interest in user safety and community standards |
| Affiliate link pre-filling — Passing destination, dates, and passenger count to booking partners when you click affiliate links | Trip destination, travel dates, group size (no personal data such as name or email) | Art. 6(1)(b) — Performance of a contract (facilitating bookings you initiate) |
| Currency conversion — Converting expense amounts using real-time exchange rates | Currency codes and amounts only (no personal data sent to the exchange rate API) | Art. 6(1)(b) — Performance of a contract |
Your personal data may be shared with the following recipients:
Trip data, availability, Vibe Check responses (displayed anonymously), expenses, photos, activity feed events, and quest data are shared with members of your trip group who you have invited or who have joined via your trip's invite code. Vibe Check responses are shown anonymously to the group — no member can see who submitted which response.
When you click an affiliate link, the destination, travel dates, and passenger count may be shared with the respective booking partner to pre-fill your search. No personal information (name, email, account data) is shared with affiliate partners through these links.
We do not sell your personal data to third parties.
Some of the service providers listed above are based in the United States. We ensure that adequate safeguards are in place for each transfer in accordance with Art. 44–49 GDPR:
| Service Provider | Country | Safeguard |
|---|---|---|
| Supabase | EU servers | No third-country transfer — data is stored and processed within the EU |
| Sentry (Functional Software Inc.) | USA | EU-US Data Privacy Framework (adequacy decision by the European Commission, July 2023) |
| RevenueCat (RevenueCat Inc.) | USA | Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR |
| Viator / TripAdvisor (TripAdvisor LLC) | USA | Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR |
| Google (Google LLC) | USA | EU-US Data Privacy Framework |
| Groq (Groq Inc.) | USA | Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR |
| Expo (650 Industries Inc.) | USA | Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR |
| Apple (Apple Inc.) | USA | Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR |
You may request a copy of the applicable safeguard documentation by contacting us at trippintravel@outlook.com.
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law:
| Data Category | Retention Period |
|---|---|
| Account data | Until you delete your account. After account deletion, data is permanently erased within 30 days. |
| Trip & collaboration data | Until the trip is deleted by its creator or you delete your account. Contributions to others' trips are removed upon your account deletion. |
| Photos (Sync Shot, quest proofs) | Until the associated trip is deleted, you remove the photo, or you delete your account. |
| Financial data (expenses) | Until the trip is deleted or your account is deleted. Purchase records may be retained for up to 10 years to comply with German tax retention obligations (§ 147 AO, § 257 HGB). |
| Analytics & usage data | Aggregated and anonymized after 12 months. Raw event data is deleted after 12 months. |
| Smart Nudge logs | Retained for 90 days for rate limiting purposes, then deleted. |
| Error reports (Sentry) | Automatically deleted after 90 days by Sentry. |
| Content reports & blocks | Retained for the duration of your account plus 6 months after deletion for safety purposes. |
| Waitlist email | Until you request removal or 24 months after submission, whichever comes first. |
| Push notification tokens | Until you uninstall the app, revoke notification permissions, or delete your account. |
When you use AI-powered features (destination suggestions, itinerary generation, packing lists, quest generation, scheduling conflict analysis, Vibe Check synthesis), the following applies:
The Vibe Check feature allows trip groups to collectively gauge preferences on topics such as budget, activities, accommodation style, and more. Your Vibe Check responses (budget preferences, activity ratings, commitment levels, and concerns) are displayed anonymously to your group — no member can see who submitted which response. However, responses are stored linked to your user account in our database for AI synthesis and to prevent duplicate submissions. The AI synthesis only produces aggregated group-level insights and never reveals individual responses.
Trippin uses a Smart Nudge system to help your group make decisions and avoid planning stalls. To deliver effective and timely nudges, we collect and process:
Smart Nudges are opt-in. They are rate-limited to a maximum of 4 per day per user and can be managed via your notification preferences in the app. You can disable Smart Nudges at any time without affecting other app functionality.
Under the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at trippintravel@outlook.com. We will respond within one month of receiving your request.
You have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR if you believe that our processing of your personal data violates the GDPR. The competent supervisory authority for our company is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de
Trippin uses limited profiling in the following context:
We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22(1) GDPR.
Trippin participates in affiliate programs with the following partners:
When you click an affiliate link, the destination, travel dates, and passenger count may be shared with the respective booking partner to pre-fill your search. No personal information (name, email, account data) is shared with affiliate partners through these links.
Trippin is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, please do not use the app or submit any personal data. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that data promptly. If you believe we have inadvertently collected data from a child under 16, please contact us immediately at trippintravel@outlook.com.
The Trippin website (trippintravel.app) does not use tracking cookies, analytics cookies, or advertising cookies. No cookie consent banner is required because we do not set any non-essential cookies. The Trippin mobile app does not use cookies. Essential technical data (such as authentication tokens) is stored locally on your device using secure storage mechanisms provided by the operating system.
We implement appropriate technical and organizational measures to protect your personal data, including:
We may update this Privacy Policy from time to time to reflect changes in our data processing practices or legal requirements. In the event of material changes, we will notify you through one or more of the following methods:
We encourage you to review this Privacy Policy periodically. Your continued use of Trippin after changes are posted constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your account at any time.
If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have concerns about how your personal data is processed, please contact us:
Trippin Osterried GbR
Alt Schürkesfeld 29
40670 Meerbusch
Germany
Email: trippintravel@outlook.com
Phone: +49 160 93078269