Privacy Policy

Effective date: October 17, 2026

1. Introduction

Welcome to tripcode ("we", "us", or "our"). tripcode is a product of zhakura studio GmbH, a company registered in Switzerland (commercial register no. CHE-248.204.588) with its registered office at Winzerhalde 109, 8049 Zürich, Switzerland. zhakura studio GmbH is the data controller responsible for the personal data described in this policy. We operate the tripcode mobile application and website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

Account Information

When you create an account, we collect your email address, name, username, profile photo, travel style preferences, interest tags, and biographical information you choose to provide. You may also choose to add social-media links, your home city and country (we convert the city into approximate map coordinates through our geocoding provider and use your home country, currency and location to tailor trip suggestions and defaults), and your gender. Your gender is optional and is not shown to other users.

During account setup we also collect your date of birth. We use your date of birth for the following purposes:

The legal bases for this processing are the performance of our contract with you (the Terms), our legitimate interest in matching travellers to suitable trips, and — for the optional profile display — your consent, which you can withdraw at any time by toggling the setting off.

Trip Information You Set as a Host

When you create a trip, you may set a preferred participant age range. This range is shown publicly on the trip page so prospective participants can self-select. The age range reflects your preference for the trip and is not derived from any individual user's date of birth.

For trips you have set to public, we display the trip's title, destination, dates, and your first-letter avatar on our public marketing pages (e.g. tripcode.io). This metadata contains no third-party personal data and is licensed to us under our Terms.

Your uploaded cover image is handled separately because it may depict identifiable people. Each time you upload a cover image, we ask you to confirm — with an on-screen notice and prompt at the moment of upload — that you have permission to publish that photo, including any identifiable people in it. A trip cover may appear on our public marketing pages (for example, tripcode.io) once it has been uploaded; only images served from our own approved image hosts are eligible to be shown there. If anyone identifiable in your cover image objects to its display, they (or you) can request removal directly from each card or by emailing hello@tripcode.io; we action removal requests within a reasonable timeframe. Cover images uploaded before this per-upload confirmation was introduced are treated as attested as of that change.

Waitlist Information

If you sign up for our waitlist via the landing page, we collect your email address, the source of your submission, the campaign parameters of the link you used (for example UTM tags) and any referral code.

Trip & Travel Data

When you create or join trips, we collect trip destinations, dates, itineraries, trip status, participant lists, and related planning details.

Social Content

We collect content you post through the Service, including chat messages, trip reviews, ratings, and photos you share in trip albums, group chats, and direct messages.

Financial Data

If you use the expense tracking feature, we collect expense descriptions, amounts, and split details. tripcode does not directly process payments between users.

Purchase & Subscription Data

If you buy a subscription (tripcode Premium or Pro) or a paid tripcode, the purchase is processed as an in-app purchase by Apple (App Store) or Google (Google Play) and managed on our side through RevenueCat. We receive confirmation of the purchase and your resulting subscription or entitlement status; we do not receive or store your full card number. If you are a tripcode creator who receives payouts, those payments are processed by Stripe via Stripe Connect, and Stripe handles your payout and tax-identification data directly.

Device & Usage Data

When you enable push notifications, we store your device's push notification token and its platform (iOS or Android) so we can deliver notifications to you. We do not integrate any third-party analytics, advertising, or crash-reporting SDKs, and we do not track your activity across other companies' apps or websites.

Booking attribution. When you are signed in and open a trip in the tripcode app, on tripcode.io or on a tour operator's tripcode site, we record which trip you opened, where you opened it (app or website), the page address including any link parameters, the website that referred you (domain only) and any campaign parameters, linked to your account. We use this to attribute bookings to tour operators correctly. We do not record this for visitors who are not signed in. These records are deleted about 90 days after your last visit to that trip. If you then book the trip, the attribution details are kept with the booking record (see Data Retention).

Security logs. To prevent abuse we temporarily record the IP address of booking attempts on our website (removed once older than one hour, at the next booking attempt) and of sign-in attempts by connected AI assistants (for rate limiting). Our hosting providers (Supabase, Cloudflare) also log request data, including IP addresses, for security and operations; we retain access to these logs for about 30 days.

With your permission, tripcode accesses your device camera and photo library so you can take or choose a photo — for your profile picture, a trip cover image, or a photo shared in a trip album, group chat, or direct message. Access happens only at the moment you take or select a photo; we do not access the camera or your library in the background, and only the photos you choose to upload are sent to us.

Cookies & Local Storage

tripcode does not use cookies — not on our website, on tour operators' tripcode sites, or in our web app. We store information on your device only where it is needed for something you asked for:

We do not store anything on your device for analytics, advertising, or tracking. To credit a booking to the tour operator page that led to it, campaign and referrer details are carried in the page links themselves, not stored on your device. You can delete this information at any time in your browser settings.

Authentication Data

If you sign in using Sign in with Apple or Sign in with Google, we receive the email address (or relay address, in the case of Apple's private email relay) and the name and profile information you have authorised that provider to share. We do not receive your password.

Sensitive Data

Some of the information you share through tripcode warrants particular care. We treat the following as sensitive and apply heightened safeguards (Row-Level Security, narrow access, transport encryption):

3. How We Use Your Information

We use the information we collect to:

Legal bases

Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases for each purpose:

4. How We Share Your Information

With Other Users

Your profile information, trip activity, reviews, chat messages, and shared photos are visible to other trip participants and, where applicable, the broader tripcode community. Your profile name, photo, and travel style may be visible to other users browsing trips.

With Service Providers

We share information with third-party service providers that help us operate the Service. Personal data is stored primarily in the European Union (see "International Data Transfers" below); some providers are located in, or transfer data to, other countries, for which we apply the safeguards described in that section. Our providers include:

With Connected Applications (AI Assistants)

You can connect third-party AI assistants (such as Claude, ChatGPT, or Gemini) to your tripcode account. Connecting is always initiated by you, through a secure sign-in and consent screen, and you choose what the assistant may do based on the permissions (scopes) you grant. Any data the assistant reads or writes under these permissions is transmitted to that assistant's provider. The available permissions are:

You grant only the permissions you choose, and an assistant can act only within the scopes you approve. A connected assistant acts as you, and can only access data you could already access yourself — the same Row-Level Security rules that protect your account in the app apply to it. We never share your tripcode password with the assistant. Information you send to, or that is retrieved by, a connected assistant is then handled under that assistant provider's own privacy policy and terms, which are outside tripcode's control.

You can review your connected applications and disconnect any of them at any time in Settings → Connected apps. Disconnecting immediately revokes that assistant's access.

For Legal Compliance

We may disclose your information if required to do so by law, in response to a court order or subpoena, or to protect our rights, property, or safety, or that of our users or others.

We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Data Storage & Security

Your data is stored on secure cloud infrastructure provided by Supabase, in the European Union (Ireland region). We implement industry-standard security measures including:

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Breach Notification

If we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay and, where feasible, no later than 72 hours after becoming aware of it. Where required, we will also notify the competent supervisory authority within the same timeframe (revFADP Art. 24, GDPR Art. 33–34).

Notifications will be sent to the email address associated with your account and, where appropriate, surfaced inside the app. They will include the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address it.

7. Your Rights & Choices

Depending on your location, you may have the following rights under applicable data protection laws, including the Swiss Federal Act on Data Protection (revFADP, in force from 1 September 2023), the EU/EEA General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA):

For California Residents (CCPA)

If you are a California resident, you have the right to: (1) know what personal information we collect, use, and disclose; (2) request deletion of your personal information; (3) opt out of the sale of your personal information — we do not sell your personal information; and (4) not be discriminated against for exercising your privacy rights.

To exercise any of these rights, you may contact us at hello@tripcode.io. We will respond to your request within the timeframe required by applicable law.

8. Data Retention

We keep personal data only for as long as we need it for the purposes described in this policy, after which we delete or anonymise it. The main retention periods are:

We may retain limited information for longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

9. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

10. International Data Transfers

tripcode is operated by zhakura studio GmbH, based in Zürich, Switzerland. Your personal data is stored and processed primarily in the European Union (Supabase, Ireland region).

Transfers of personal data between Switzerland and the European Economic Area (EEA) are covered by mutual adequacy: the EU recognises Switzerland as providing an adequate level of data protection, and Switzerland recognises the EEA.

Some of our service providers (see "How We Share Your Information") are located in, or transfer data to, countries outside Switzerland and the EEA, including the United States. Where personal data is transferred to such a country, we rely on appropriate safeguards under applicable data protection law — in particular the European Commission's Standard Contractual Clauses (together with the Swiss addendum recognised by the FDPIC) and, where the provider is certified, the EU–U.S. Data Privacy Framework and its Swiss extension. You can request more information about these safeguards using the contact details below.

11. Beta Service & Data Handling

tripcode is currently offered as a beta service while we finalise the platform. As the Service evolves we may migrate or restructure data, but we will not intentionally delete your user-generated content (trips, photos, chat history, reviews) without first notifying you by email and/or in-app message. Routine schema or infrastructure changes that do not affect your content are made without prior notice.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Effective date" above. We encourage you to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise your rights, please contact the data controller:

zhakura studio GmbH
Winzerhalde 109
8049 Zürich, Switzerland
hello@tripcode.io

Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/15346922624

GDPR Certification: Art 27 representation by Prighter
powered by Prighter