What we collect
When you use TrekUnity, we collect:
- Account info — name, email, password (hashed), avatar.
- Trip content — destinations, dates, activities, expenses, photos, chat messages, packing lists, and other details you add.
- Travel preferences — likes, dislikes, home airport, travel notes.
- Usage data — pages viewed, clicks on outbound affiliate links, errors.
How we use it
- To provide and improve the Service.
- To personalize AI suggestions (your travel preferences are passed to Anthropic's API to generate trip itineraries).
- To send essential account notifications and (if enabled) trip-related emails.
- To track affiliate-link clicks for revenue attribution. We log the platform clicked and the destination, not personally identifiable behavior beyond that.
Who we share it with
We do not sell your data. We share limited data with these subprocessors only as needed to operate the Service:
- Supabase — database, auth, file storage.
- Vercel — application hosting.
- Anthropic — AI trip generation (we send your trip details, not your name or email).
- Google Maps Platform — location autocomplete and place data.
- Travelpayouts / partner networks — affiliate click attribution.
- Resend / email providers — transactional email.
Trip collaboration
When you invite others to a trip, the data on that trip (activities, expenses, chat, photos, etc.) is visible to all accepted members. Don't add private info to a shared trip you don't want collaborators to see.
Cookies
We use first-party cookies for authentication and theme preference. Third-party affiliate networks (e.g., Travelpayouts) set cookies when you click through their tracked links so commissions can be attributed.
Your rights
You can access, edit, or delete your data anytime from your profile page. Account deletion removes your trips, content, and personal info. Contact us if you need help or want to export your data.
Live location sharing ("Who's Where")
TrekUnity includes an opt-inlive-location feature available on the Map tab during a trip's scheduled dates. When you turn it on:
- What we collect:your device's approximate GPS coordinates (latitude, longitude, accuracy) while sharing is active.
- Who can see it: only accepted members of the trip in which you enabled sharing. Each trip is isolated — sharing in one trip does not share with members of any other trip. No one outside the trip, including TrekUnity staff, accesses your live position in normal operation.
- Retention: each position auto-expires 30 minutes after it is posted. We do not store location history — only your most recent fix is visible, and only while it is fresh.
- Eligibility: users must be at least 18 years old to enable live location sharing, even if the rest of the app is available to younger users.
- Lawful basis (EU/UK users): your explicit consent (GDPR Art. 6(1)(a) and Art. 9 where applicable). You may withdraw consent at any time by toggling sharing off — your position is deleted immediately.
- Audit record: when you first agree to use this feature we record the date/time, your user agent, and a partial network identifier (first two IP octets) as evidence of consent. This record is not used for any other purpose.
- How to stop: tap the toggle off — that is the only off-switch, so sharing keeps running across tabs and app restarts until you flip it back. Your last reported pin also auto-expires after 30 minutes if the client stops posting (for example, if the app has been closed for that long).
Government requests
If a government, law-enforcement agency, or other public authority requests access to your personal data, we:
- Review every request for legal validity before responding.
- Challenge requests we believe are unlawful, overbroad, or improperly issued.
- Disclose only the minimum information strictly required by the request — never more.
- Document each request, our response, and the legal reasoning involved. We will notify affected users when legally permitted to do so.
Data retention
We retain your personal data for as long as your account is active. When you delete your account, we delete your trips, content, and personal info promptly. Limited records may persist in backups or for tax/legal compliance for a reasonable period before secure destruction.
International data transfers
Our infrastructure (Supabase, Vercel) is based in the United States. If you access TrekUnity from the EU/EEA or UK, your data is transferred to and processed in the U.S. under Standard Contractual Clauses (SCCs) signed with our subprocessors.
Children
TrekUnity is not directed at children under 13 (or 16 in the EEA/UK). If you believe a child has created an account, contact us and we will delete it.
Changes
We may update this policy. Material changes will be communicated via email or in-product notice. Continued use after changes take effect constitutes acceptance.