Privacy Policy

Last updated: September 28, 2026

1. Controller

The controller responsible for processing personal data under the General Data Protection Regulation (GDPR) is:

Mathis Heywinkel
Billhorner Kanalstr. 49 c/o 409
20539 Hamburg
Germany
Email: info@tripklar.app

2. Overview

tripklar. is an app for planning trips together. For accounts, shared trips, the expense splitter, packing lists, calendar and bookmarks we use Google Firebase (Authentication and the Firestore database) as a technical service provider, plus a few other services for cover photos, weather and place search.

We do not use analytics or tracking software and no advertising networks. We do not access your contacts or your device's location.

3. Registration and account

Using tripklar. requires an account. When you register we collect:

• Email address
• Password (stored hashed by Firebase, never visible to us in plain text)
• A display name of your choice

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

Your display name is visible to the members of your trips. Technically, it can only be retrieved by someone who knows your randomly assigned user ID – a list of all users cannot be retrieved.

Your email address is stored only in Firebase Authentication (sign-in, password reset), not additionally in our database.

Sign in with Apple: if you use “Sign in with Apple”, Apple gives us a user identifier, an email address (optionally an anonymous relay address from Apple) and, on your first sign-in, your name if you choose to share it. There is no password in that case. When you delete your account, we revoke tripklar.'s access to your Apple ID. Apple's privacy policy applies as well.

4. Shared trip planning

When you create a trip or join one with an invite code, we process:

• Trip details: title, destination, dates, chosen travel styles, whether children are coming along
• Names and user IDs of all trip members
• Events, bookmarks, packing-list items and expenses you add

This data is visible to every member of the same trip — that is the core of the app. Private packing-list items are visible only to you. Legal basis: Art. 6(1)(b) GDPR.

Expense splitter: expenses record who paid how much for whom. All trip members can see this, as it is needed to settle up.

Free-text fields: please don't enter personal data about people outside your travel group without their consent.

5. Processing by Google Firebase

For accounts (Firebase Authentication) and the database (Cloud Firestore) we use Firebase by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under a data processing agreement pursuant to Art. 28 GDPR.

International transfers: processing may also take place on servers of Google LLC in the United States. Google is certified under the EU-U.S. Data Privacy Framework; the European Commission's Standard Contractual Clauses apply in addition.

6. Other services in the app

Cover photos (Pexels)

For trip cover photos we send the destination name as a search term to the Pexels photo search (Canva Germany GmbH, Pappelallee 78/79, 10437 Berlin, Germany). No user identifiers are sent; Pexels technically receives your IP address. Legal basis: Art. 6(1)(f) GDPR.

Weather (Open-Meteo)

For forecasts and climate data we send the coordinates of your destination (not your own location) and the travel dates to Open-Meteo, which technically receives your IP address. Legal basis: Art. 6(1)(f) GDPR.

Place search (Apple MapKit)

Place search uses Apple MapKit with only the text you type, never your device location. Apple's privacy policy applies as well.

Calendar export (Apple EventKit)

When exporting to your iPhone calendar, iOS asks for your permission. The export is one-way and happens entirely on your device; we receive no data from it. Legal basis: Art. 6(1)(a) GDPR (consent via the system prompt).

Purchases (Apple App Store)

You buy tripklar Plus and single trips through the App Store. Payment is handled entirely by Apple; we receive no payment or card data. The app checks whether a purchase exists directly on your device through Apple (StoreKit). We don't store your purchases on our servers. Apple's privacy policy applies. Legal basis: Art. 6(1)(b) GDPR.

7. Share extension and local storage

Links you share into tripklar. from other apps are briefly kept in a local storage area on your device (App Group) until you save them to a trip. We also keep a few technical settings locally (e.g. the last opened trip). This data never leaves your device.

8. Retention

We keep your data as long as your account exists. A trip's content remains until the trip is deleted; deleting a trip also deletes its events, bookmarks, expenses and packing-list items.

9. Deleting your account

You can delete your account at any time in the app under “Profile → Edit account → Delete account”. This:

• deletes your sign-in account and your profile (display name),
• removes you from trips you joined, including your name in the member list,
• deletes trips you created on your own, with all their content,
• hands trips you created with others over to another member, so the group can keep planning,
• deletes your private packing-list items.

Expenses, shared packing-list items, events and bookmarks you added to shared trips remain. They are then only linked to a pseudonymous user ID and shown as “Former member”. This serves the other members' legitimate interest in a complete shared plan and settlement (Art. 6(1)(f) GDPR). If you want these removed too, delete them in the app before deleting your account, or contact us.

10. This website

This website is hosted by GitHub Pages by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you visit it, the host processes technically necessary data such as your IP address, date and time and the requested page in server logs, to deliver and secure the site. Legal basis: Art. 6(1)(f) GDPR.

The website sets no cookies, uses no analytics and loads no third-party content (not even external fonts).

Contact by email: if you write to us, we process your address and message to reply, and delete them once the request is dealt with. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering requests), or 6(1)(b) where it concerns your account.

11. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the Hamburg Commissioner for Data Protection and Freedom of Information.

To exercise your rights, simply email info@tripklar.app.

12. Changes

We update this policy whenever our data processing changes. The current version is always available on this page and in the app.