Your trip stays yours.

This Privacy Policy explains what TripBook AI ("TripBook," "we," "us") collects when you use our iOS app, and what we do with it. Plain English. If anything is unclear, write to support@tripbookai.travel.

1. Photo access and local processing

You can select photographs using Apple's Photos picker. If you grant broader Photos permission, TripBook can inspect the permitted library on your device to suggest journeys. You can change that permission in iOS Settings. Imported photo information can include capture dates, saved GPS coordinates, orientation, and locally derived scene or text details. These help arrange your book and its map. TripBook does not request or track your live location. Apple may process photo coordinates when the app looks up city names.

2. Personal books and backups

Personal books, edits, imported assets, and local exports are saved in the app's storage. Optional iCloud backups use your Apple account and Apple's storage services. Device backups may also be managed by your system settings. Deleting a local book does not automatically delete a separately saved backup or export; manage those copies where you saved them.

3. AI writing

Before AI writing, the app asks permission to send the necessary trip and photo-derived details to our Cloudflare-hosted service and OpenAI. These can include dates, places, descriptions or text recognized locally in selected photos, confirmed memories, notes, and your requested writing style. Notes may contain personal information you choose to include. Original photo files are not sent for this writing step. You can withdraw AI-sharing permission in the app's Settings; this stops future requests and does not recall information already processed.

Our service processes requests to produce your book, enforce usage limits, and diagnose failures. OpenAI and Cloudflare may retain operational or security data under their service policies. Do not include information you do not want processed by these providers. See OpenAI's privacy policy and Cloudflare's privacy policy.

4. Optional accounts and private book sharing

You do not need a sharing account for personal books. When you sign in for sharing, Apple provides an account identifier and may provide a name or email according to your choices. The sharing service uses an internal account identifier, the display name you supply, session credentials, invitation and membership records, and access permissions. Apple authorization credentials are retained securely to validate access and revoke the Apple grant when you delete the account.

Sharing uploads finished pages and their visible assets. When you enable full access, editable book structure and the photo assets needed to edit the book are also transferred. Cloudflare Workers, D1, and R2 host the service and its stored data. Approved readers can access the book; permitted Premium editors can change it. Changes may record the editor's display name and revision details so participants can see what changed. Only share photographs and information you have permission to share.

Shared books, revisions, and membership data are retained while needed to provide sharing. Owners can remove a reader or stop sharing. These actions block future service access but cannot recall PDF exports, screenshots, or personal copies already saved by others. Book protection on your device uses system authentication; it does not protect copies outside the app.

5. Purchases and Premium verification

Apple handles payment and subscription billing; we do not receive your payment-card details. RevenueCat processes purchase and entitlement information, including app user identifiers and transaction or product information, to verify Premium access. Sharing permissions and Premium entitlement are checked separately: permission from an owner does not give a friend a paid subscription. See RevenueCat's privacy policy. Manage or cancel subscriptions in your Apple account's subscription settings.

6. Your controls and deletion

You can delete personal books in the app and manage Photos and iCloud permissions in system settings. For sharing data, use “Delete sharing account” in the sharing account menu. Successful deletion revokes the Apple authorization, deletes account and session records, removes access and invitations, and makes books owned by that account inaccessible. Stored assets of deleted owners are removed by scheduled cleanup after a delay; this is not an immediate physical purge. Change history in another person's book may remain with the name replaced by “Former friend,” and previously saved copies cannot be recalled.

Deleting a sharing account does not cancel an Apple subscription or erase your local personal books. For questions, access requests, corrections, or deletion help, contact support@tripbookai.travel. Apple, RevenueCat, and your backup provider may retain records according to their own legal and service requirements.

7. Service providers and security

Apple, Cloudflare, OpenAI, and RevenueCat process information needed for the features described above. Processing may take place outside your country. We use authenticated access, permissions, and encrypted network connections to protect private sharing. No internet service can guarantee absolute security. We do not sell personal information or use it for third-party targeted advertising.

8. Children's privacy

TripBook is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided information through a sharing account so we can investigate and remove it.

9. Changes and contact

We update this page when our data practices change. Privacy questions can be sent to support@tripbookai.travel or through our contact page.