Privacy policy

1. Who we are

TripBaddie ("TripBaddie," "we," "us") is operated by Opsmith LLC, a Michigan limited liability company. It provides tripbaddie.com and related apps, emails, shared pages and PDFs (the "Service"), an AI travel planner that builds day-by-day itineraries and helps you track what to book.

This policy explains what personal information we collect, how we use and share it, how long we keep it, and your choices. Opsmith LLC is the controller of your personal information.

Contact: Opsmith LLC, Attn: Jaclyn Curtis, 2492 Browning Dr., Lake Orion, MI 48360 · privacy@tripbaddie.com

2. Information we collect

Information you give us

• Account details: name, email address, and password, or your basic Google profile if you sign in with Google.
• Trip answers: destinations, dates, where you're traveling from, how you're getting there, budget, pace, interests, touring, lodging and dining style, and anything you type into the planner or trip chat.
• Travel party details: number of travelers, whether children are coming and their age ranges, dietary needs, and accessibility or mobility needs, if you choose to provide them.
• Passport country, if you use visa and entry guidance.
• Saved content: trips, traveler profiles, loyalty program names and numbers, booked-item status, confirmation numbers, notes, and files or photos you upload.
• Guest email, if you ask us to email a plan you built without an account. We keep it after your guest plan is deleted, until you unsubscribe or ask us to delete it.
• Messages you send to support.

Payments. Stripe processes payments. We never receive your full card number. We receive your plan, payment status, and limited card details such as brand and last four digits. When you buy, we record that you accepted the Terms, when, and which version.

Information collected automatically

• Device and usage data: browser and device type, pages viewed and actions taken. Detailed analytics run only if you accept analytics cookies.
• IP address: used for security, rate limits, and free plan limits. For free plan limits we store a salted one-way hash of your IP address (or its network prefix), never the address itself.
• Guest session cookie: a signed cookie that ties a guest's plan to their browser.
• Bot check signals: Cloudflare Turnstile processes browser and device signals to tell people from bots when you generate a plan.
• Booking link clicks: when you use a Book button, we record which provider you went to and when.
• Share link opens: we record that a shared plan was opened, without identifying who opened it.

Information from others

• Google, if you sign in with Google.
• People you travel with, if a collaborator you invited edits a shared trip.
• Stripe, about the status of your payments and subscription.

3. How we use your information

• Build, change, save and display your itineraries, packing lists and trip costs
• Match stops to real places and, on paid plans, re-check opening hours for your planned day and time
• Show visa and entry guidance for your passport country, on paid plans
• Run your account, saved trips, traveler profiles, loyalty vault and bookings manager
• Process payments and subscriptions, and keep a record of the Terms you accepted
• Enforce plan limits and prevent abuse: one free plan per person, rate limits, and bot checks
• Send service emails and, where you haven't opted out, trip emails (Section 9)
• Show shared plans, recap pages and published trips as you choose (Section 8)
• Keep the Service secure, fix problems, and improve it, including aggregated analytics if you accept analytics cookies
• Comply with law and enforce our Terms

We don't sell your personal information, and we don't use it for targeted advertising.

Legal bases (EEA and UK). We rely on contract to provide the Service you ask for; consent for analytics cookies and for sensitive details you choose to add; legitimate interests for security, abuse prevention and improving the Service; and legal obligation for tax and accounting records.

4. How AI processes your trip inputs

TripBaddie uses AI models to generate and change itineraries, answer trip chat, and build packing lists. When you do those things, we send your trip answers and travel party details to Lovable's AI Gateway, which routes the request to OpenAI's models. We send what the model needs to plan the trip. We don't send your name, email address or payment details.

These providers process the data as our service providers under their commercial terms, which don't allow them to use it to train their models.

AI can be wrong. Hours, prices and availability change, so confirm details before you rely on them or book.

5. Who we share it with

We share personal information only with the providers that run the Service, under contracts that limit their use to our instructions, and in the cases below.

Also shared:

• People you share with. Anyone with a share link can see that plan. Collaborators you invite can edit it.
• Booking providers. When you use a Book button, you leave TripBaddie for that provider's site, which may know you came from us. Your booking with them is under their privacy policy.
• Legal and safety. When required by law, or to protect the rights and safety of TripBaddie, our users or others.
• Business transfers. As part of a merger, acquisition or sale of assets, under this policy.

6. Cookies, analytics and abuse protection

Essential cookies and storage keep you signed in, hold a guest's plan in their browser, remember your cookie choices, and keep the Service secure. They can't be turned off.

Analytics cookies (Google Analytics and PostHog) run only if you accept them in the cookie banner. You can change your choice anytime in Cookie settings. We treat a Global Privacy Control signal as a refusal of non-essential cookies.

Creator referral links. When you arrive through a TripBaddie creator's link, we remember which creator sent you for up to 60 days so that creator can be paid a commission if you buy. We keep it that long only if you allow marketing cookies; otherwise we remember it just for that visit. No personal data is shared with the creator.

Abuse and bot protection. To keep free plans fair and stop automated abuse, we:

• Count free plans per browser, per verified account, and per network, using a salted one-way hash of the IP address that can't be turned back into the address
• Apply daily rate limits to plan generation, changes and email sending
• Use Cloudflare Turnstile, which checks browser and device signals when you generate a plan. Cloudflare processes this data under its own privacy policy.

We use these signals only for security and abuse prevention, not for analytics or advertising.

7. Sensitive information and children

Sensitive information. Dietary needs and accessibility or mobility needs can reveal health information. You don't have to provide them; you add them to get a better-fitting plan, and by adding them you consent to our using them for that. You can edit or remove them anytime in your trip or traveler profile. We don't use them for anything else.

Children. The Service is for adults 18 and older. It isn't directed to children, and we don't knowingly collect personal information directly from anyone under 13, or under the minimum age where you live.

An adult may enter limited information about children traveling with them, such as whether children are coming and their age ranges, to plan the trip. That information stays under the adult's control, and the adult confirms they have the right to provide it. We never include children's details in recap pages or published trips. If you believe a child has given us personal information directly, email privacy@tripbaddie.com and we'll delete it.

8. Share links, recaps and publishing your trip

You decide what's visible beyond your account.

• Share links. A view-only link lets anyone who has it see that plan, and they can forward it. You can turn a link off anytime. When someone other than you opens it, we may email you that it was opened. We never tell you who opened it.
• Collaborators. People you give edit access can change the trip, and each change is logged with who made it.
• Recap pages. After a trip, we may create a recap card and recap page showing the destination, length, cities, number of stops and a few highlights. They never show costs, names, ages, travel party details or bookings. The recap page stays private until you share it, and you can make it private again anytime. Downloading the card doesn't make the page public.
• Publish my trip. If you choose to publish, we first remove names, ages, travel party details, anything about children, notes, bookings, confirmation numbers, costs and chat, and we review it before it goes live as a sample itinerary. You can withdraw it anytime.
• Branded PDFs. PDFs include a QR code that opens the planner with only your trip's destination, length, pace and style. A link to your live plan is added only if you tick that option.

9. Emails we send

Service emails you can't turn off while you have an account: sign-in links, email confirmation, receipts, renewal reminders, and account notices.

Trip emails you can turn off one by one in Settings → Email preferences, or with the link in each email:

• Booking reminders before a booking window closes
• Countdown emails before a trip starts
• A recap email after a trip ends
• A notice when someone opens a plan you shared

Some trip emails include offers to upgrade. We don't sell or rent your email address.

10. Your rights and choices

In your account, anytime:

• View, edit or delete trips, traveler profiles, loyalty numbers, uploads and booked items
• Change email preferences and cookie settings
• Delete your account and data from Settings. We remove your trips, profiles, bookings, loyalty numbers, uploads, share links, plan records and email history, close your login, and send one confirmation email. Stripe keeps its own record of past payments as tax law requires, and we keep a note of your email address so we don't email you again.

Rights by law. Depending on where you live, you may have the right to know what we hold, get a copy in a portable format, correct it, delete it, restrict or object to some processing, and withdraw consent. Email privacy@tripbaddie.com. We'll verify your request and respond within the time the law requires, usually 30 to 45 days. We won't treat you differently for using these rights.

California residents. In the last 12 months we collected the categories in Section 2: identifiers, customer records, commercial information (purchases), internet activity, approximate location from IP address, and sensitive information you chose to add. We use them for the purposes in Section 3 and disclose them only to the providers in Section 5. We don't sell or share personal information for cross-context behavioral advertising, and we honor Global Privacy Control signals. You can use an authorized agent to make a request.

EEA and UK residents. You can also complain to your local data protection authority.

11. How long we keep it

12. Security, transfers and other sites

Security. Data is encrypted in transit. Your trips are protected by per-user access rules, uploads are kept in private storage behind short-lived links, and card data goes directly to Stripe. No system is perfectly secure, so we can't guarantee it.

International transfers. We're based in the United States, and our providers may process data in the US and other countries. Where required, we rely on safeguards such as Standard Contractual Clauses.

Other sites and affiliate links. Book buttons and maps take you to other companies' sites, such as hotels, airlines, tour operators and Google Maps. Some links are affiliate links, so the provider may know you came from TripBaddie. What you share with them is covered by their privacy policies, not this one.

13. Changes and contact

We reserve the right to update this policy at any time. Updates take effect when we post them on this page, and the date above shows when it last changed.

Questions or requests about your personal information:

Opsmith LLC, d/b/a TripBaddie · Attn: Jaclyn Curtis · 2492 Browning Dr., Lake Orion, MI 48360 · privacy@tripbaddie.com

Contact

Questions about this policy or your data: hello@tripbaddie.com, or privacy@tripbaddie.com.