Privacy Policy - OurTrips

1. Data we collect

Account data: name, email address, and profile photo obtained from your Google sign-in.
Trip data: trip names, dates, points, notes, photos, captions, check-in records, and member lists you create within the app.
Usage data: device type, browser type, IP address, pages visited, and analytics events collected via Google Analytics.
Location data: geographic coordinates you provide or choose to share (e.g., map clicks, typed addresses, or "My location" GPS).
Google Photos data: when you connect a Google Photos album to a trip, we store the album ID and access tokens necessary to display and contribute photos.

2. How we use data

Deliver core features: maps, points, notes, photos, check-ins, and trip sharing.
Maintain security, detect abuse, and troubleshoot service issues.
Improve reliability and guide product decisions using aggregated, anonymized insights.
Send important notifications about your account or changes to this policy.

We do not sell your personal data to third parties, and we do not use your data for targeted advertising.

3. Sharing and visibility

Trips are private by default. You control who can access your content:

Private: only you and people you explicitly invite can view the trip.
Private-link sharing: anyone with the link can view the trip (read-only). Review what you share before enabling this option.
Collaborators: invited members may view or contribute based on the permissions you grant.

We do not share your personal data with other users beyond what you explicitly choose to make visible through trip sharing.

4. Third-party services and data processors

We rely on the following third parties to operate OurTrips. Each may receive data necessary to provide their service:

Google — Authentication & Analytics

We use Google OAuth 2.0 to authenticate your account (receiving your name, email, and profile photo). We also use Google Analytics (property ID: G-HXDEGG1VK3) to collect anonymized usage statistics. Google's Privacy Policy governs their handling of this data: policies.google.com/privacy. You may opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

Amazon Web Services (AWS S3) — File Storage

Photos and media files you upload are stored on AWS S3 servers located in the United States. AWS Privacy Notice: aws.amazon.com/privacy.

OpenStreetMap / OSRM — Routing

When calculating routes between trip points, geographic coordinates are sent to the OSRM routing service. No account data is shared. License: openstreetmap.org/copyright.

Open-Meteo — Weather Forecasts

When you view weather for a trip point, coordinates are sent to Open-Meteo to retrieve forecast data. No account data is shared. Terms: open-meteo.com/en/terms.

Google Photos — Album Integration (Optional)

If you connect a Google Photos album to a trip, OurTrips accesses that album via the Google Photos API on your behalf. Google's Terms and Privacy Policy apply to this data. You can disconnect the integration at any time.

5. Cookies and local storage

We use cookies and browser local storage for authentication, preferences, and analytics. The table below describes what we set:

Name	Purpose	Duration	Type
ourtrips_token	Keeps you signed in (JWT session)	7 days	Strictly necessary
ourtrips_pending_invite	Remembers invite link before login	30 minutes	Strictly necessary
ourtrips_post_login_return	Redirects you after login	30 minutes	Strictly necessary
ourtrips_theme (localStorage)	Remembers your theme preference	Persistent	Preference
_ga, _ga_*	Google Analytics usage statistics	Up to 2 years	Analytics

You can block or delete cookies via your browser settings. Blocking strictly necessary cookies will prevent sign-in from working. To opt out of Google Analytics across all sites, install the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout).

6. Data storage and international transfers

OurTrips is operated from and stores data in the United States (AWS S3, US regions). If you access OurTrips from outside the United States, your data is transferred to and processed in the US. By using OurTrips, you consent to this transfer. We take appropriate steps to protect your data in transit and at rest.

7. Data retention

We retain account and trip data for as long as you use OurTrips. When you delete content (a trip, point, or photo), that data is removed from our systems. When you request account deletion, we remove or anonymize all associated personal data, except where retention is required by law or legitimate security needs (e.g., fraud prevention logs, which are retained for up to 90 days).

8. Security

We use reasonable security measures including encrypted connections (HTTPS), HTTP-only signed cookies, and access controls. However, OurTrips is an early beta product, and no internet-based service can be guaranteed to be completely secure. You use the service with this understanding and should avoid uploading highly sensitive or irreplaceable information. If you suspect unauthorized access to your account, notify us immediately at privacy@ourtrips.app.

9. Your rights

Depending on where you live, you may have the following rights regarding your personal data. To exercise any right, email privacy@ourtrips.app — we will respond within 30 days.

Right to Access (GDPR Art. 15 / CCPA)

Request a copy of the personal data we hold about you. You can also export individual trip data directly from the app using the export feature on each trip.

Right to Correction (GDPR Art. 16)

Your name, email, and profile photo are managed through your Google account. Contact us if other data needs correction.

Right to Erasure / Deletion (GDPR Art. 17 / CCPA)

You can delete individual trips, points, and photos from within the app. To delete your account and all associated data, email privacy@ourtrips.app with the subject "Account Deletion Request." We will complete the deletion within 30 days.

Right to Data Portability (GDPR Art. 20)

Export your trip data in JSON, CSV, or archive format directly from each trip, or request a full account export by emailing privacy@ourtrips.app.

Right to Object / Restrict Processing (GDPR Art. 21–22)

You may object to or request restriction of certain processing (e.g., analytics). Email privacy@ourtrips.app. You may also opt out of Google Analytics at any time using the opt-out link above.

CCPA — Right to Know & Non-Discrimination

California residents may request disclosure of the categories of personal information we collect, the purposes for which it is used, and any third parties with whom it is shared. We do not sell personal information and will not discriminate against you for exercising your privacy rights.

10. Children

OurTrips is not directed to children under 13. We do not knowingly collect personal data from children under 13. If we learn we have done so, we will delete that data promptly. Contact us at privacy@ourtrips.app if you believe a child's data was collected.

11. Changes to this policy

We will update this page with a new effective date when the policy changes. For material changes, we will notify you through the app or by email at least 14 days before changes take effect. Continued use after the effective date means you accept the updated policy.

12. Governing law and contact

This Privacy Policy is governed by the laws of the State of California, without regard to its conflict of law provisions. For privacy inquiries, contact us at privacy@ourtrips.app. We aim to respond to all requests within 30 days.

OurTrips Privacy Policy