Privacy Policy

Last updated: May 15, 2026

ZipTrips LLC ("ZipTrips," "we," "us," "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

1. Information we collect

We collect the following categories of information:

Account information: mobile phone number, optional email, optional display name and avatar URL, handle (your public identifier).
Itinerary data: trips, stops, places, notes, timestamps, sharing settings (public, friends-only, or private), and friend relationships you create within the Service.
Location data: if you grant location permission, your device's approximate location is used to center the map, sort trips by proximity, and provide turn-by-turn navigation. Location is processed on-device and is not stored on our servers unless you choose to add a location to a saved itinerary.
Usage data: features used, API request metadata, AI-feature usage counts (for rate-limiting), error logs.
Device data: device type, operating system, browser type, IP address (used for rough region detection on the AI Picks feature), and time-zone.
Advertising data: if you use the free, ad-supported tier, our advertising partners may collect device or advertising identifiers, IP address, approximate location, and ad-interaction data to serve and measure ads. This never includes your mobile phone number. See "Advertising and analytics" below.
Subscription data: if you purchase a paid subscription, the App Store or Google Play processes your payment and provides us with a purchase identifier and subscription status. We do not receive or store your payment-card details.

2. How we use your information

To authenticate you via SMS one-time passwords (OTP);
To provide core Service features — trip planning, navigation, search, sharing, and AI-generated recommendations;
To enforce rate limits and prevent abuse of paid third-party APIs;
To respond to support requests;
To send transactional messages (authentication codes, account-security notifications);
To comply with legal obligations.

SMS and mobile information — no sharing: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties or affiliates for any purpose. We do not sell, rent, lease, or otherwise transfer your mobile phone number, SMS opt-in, or consent data to anyone. Your mobile phone number is used solely for account authentication and account-security communications, and is disclosed only to the service providers that deliver those messages on our behalf (see Section 3), who are contractually prohibited from using it for their own purposes. This SMS and mobile data is excluded from every other category of data use or sharing described in this policy, including the advertising activities described below.

SMS program details

If you provide your mobile phone number, you are enrolling in the ZipTrips SMS program, which is limited to authentication and account-security messages:

Program type: transactional only — one-time passwords (OTP) for sign-in and account-security notifications. No marketing or promotional messages.
Message frequency: recurring, varies by usage. Typically one message per sign-in attempt; expect approximately 1–5 messages per month for a typical user, more if you sign in frequently from new devices.
Cost: Message and data rates may apply. ZipTrips does not charge for SMS, but your mobile carrier's standard messaging and data rates apply to messages you send or receive.
Help: reply HELP to any ZipTrips SMS for assistance, or email legal@ziptrips.app.
Opt out: reply STOP to any ZipTrips SMS to opt out at any time. Because SMS OTP is the sole authentication method, opting out will prevent future sign-ins.
Supported carriers: messages are delivered via major U.S. carriers. Carriers are not liable for delayed or undelivered messages.

3. How we share your information

We share information only as needed to operate the Service:

Service providers (processors):
- Supabase — authentication, database hosting, real-time sync;
- Twilio — SMS delivery of one-time passwords (via Supabase Auth's SMS provider integration);
- Vercel — application hosting and edge functions;
- Google — Maps, Places API for geocoding and place data, Directions API for routing, Gemini for AI-generated content;
- Google AdMob and Google AdSense — serving and measuring advertising in the free, ad-supported tier;
- Viator (a Tripadvisor company) — surfacing bookable tours and activities; you are directed to Viator to complete any booking;
- App Store / Google Play — payment processing for subscription purchases.
Other users: if you make an itinerary public or share it with friends, the itinerary content, your handle, and your display name become visible to those audiences.
Legal: we may disclose information when required by law, valid legal process, or to protect the rights, safety, or property of ZipTrips, our users, or the public.

We do not sell your personal information for money. Depending on your jurisdiction, the use of advertising partners described in "Advertising and analytics" below may be treated as a "sale" or "share" of personal information under state privacy laws; where it is, it involves only advertising and device identifiers and never your mobile phone number, SMS opt-in, or consent data. You can opt out as described in that section.

Advertising and analytics

The free, ad-supported tier of ZipTrips displays advertising served by Google. We use Google AdMob in our iOS and Android apps and Google AdSense on the web. To serve and measure these ads, Google and its partners may collect and process device or advertising identifiers, IP address, approximate location, and information about how you interact with ads. Google's handling of this data is governed by Google's Privacy & Terms.

Your choices:

iOS — App Tracking Transparency: we ask your permission before allowing personalized (cross-app) advertising. If you decline, you will still see ads, but they will not be personalized using cross-app tracking.
Consent: where required (for example, in the EU and UK), we present a consent prompt and default to non-personalized ads until you consent.
Ad personalization: you can limit or reset ad personalization in your device settings (iOS: Settings → Privacy & Security; Android: Settings → Google → Ads) or via Google Ad Settings.
Paid tier: the paid subscription tier removes all advertising.

To opt out of any "sale" or "share" of personal information for advertising, use the controls above or contact legal@ziptrips.app.

Affiliate bookings

ZipTrips surfaces bookable tours, activities, and experiences from Viator (a Tripadvisor company) alongside relevant stops in your itinerary. When you choose to book, you are directed to Viator to complete and pay for that booking — ZipTrips does not process the payment and does not receive your payment-card details. ZipTrips participates in the Viator affiliate program and may earn a commission on bookings made through these links, at no additional cost to you. Information you provide during checkout is handled by Viator under its own privacy policy.

4. Data retention

Account and itinerary data are retained for as long as your account is active. When you delete your account, your account row and all linked itineraries, stops, friendships, and saved trips are deleted via cascade. Some logs may persist for up to 90 days for security and abuse-prevention purposes.

5. Security

We use industry-standard measures to protect your data, including TLS in transit, encrypted credentials at rest, row-level security policies on the database, and server-side handling of API keys for third-party services. No system is perfectly secure, however, and we cannot guarantee absolute security.

6. Your choices and rights

Access & deletion: you can delete your account at any time from the Profile screen, which removes your account and all linked data.
Location: you can revoke location permission at any time in your device's settings; the Service will continue to work, with reduced map and proximity features.
SMS opt-out: reply STOP to any SMS to opt out. Note that opting out will prevent future sign-ins, since SMS OTP is the sole authentication method.
Marketing: we do not currently send marketing messages. If we ever begin doing so, you will have the ability to opt out.
Regional rights: depending on your location (e.g., California under CCPA/CPRA, EU/UK under GDPR), you may have additional rights including access, correction, portability, and deletion. Contact us at legal@ziptrips.app to exercise these.

7. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. International users

The Service is operated from the United States. By using the Service from outside the U.S., you consent to the transfer of your information to and processing in the U.S., which may have different data-protection rules than your country.

9. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated in the app or by email.

10. Contact

Questions about this Privacy Policy or how we handle your information? Email legal@ziptrips.app.