Your family’s information. Your choices.

This notice covers signing in, saving or sharing a trip, adding booking confirmations, and using trip tools at app.tripfigured.com. Access to those features depends on your trip. The free preview includes a route and nights, one change to try, one question about a change, and one change to keep. Paid purchases are not open yet. The payment section describes what is kept when paid access opens.

An account is an email address. There is no password, ever. You sign in with a link sent to that address, and you can add a passkey after the first sign-in. We store the address, the sign-in events, and a hash of each link token — never the token itself. A sign-in link is displayed for confirmation before it is used, so a mail scanner that pre-fetches the URL cannot consume it.

Planning a family trip means telling us who is travelling. Names and labels are what a parent types. Ages are stored as the age at the time of the trip, or as a band — never a date of birth, and never a live age we would have to keep correct forever. Diets, allergies, and mobility limits are held apart from the rest of the trip: referenced rather than copied, encrypted separately, and erasable on their own without unpicking the trip's history. That separation is the reason withdrawing one detail later is possible at all.

Children do not have accounts. There is no child email address, no child login, and no identifier for a child beyond the label a parent sets, like Leo, 10. The wish link lets a child send a wish for one trip. The child's Today link shows today and tomorrow without prices. These links stop working when the trip is frozen. We do not count those screens at all. A parent's invitation is the record of permission.

A trip holds what you pinned, the versions built around those pins, the decisions each adult kept, comments, and a record of what changed and why. Two adults on one trip see each other's decisions; that audit trail is the point of each adult having their own sign-in rather than sharing one.

Families change, and we would rather say the plain thing than a soft one. One email address belongs to one household, and we cannot cut a household in two. So nothing splits on its own: the trip stays where it was planned, with the household that holds it. If you are the adult leaving and you want to keep the trip you helped plan, write to us from the address on your account and ask for a copy. That is the same kind of request as the others under Your choices below, and we answer it the same way. A copy is yours to read; it takes nothing away from the other adult's trip, and it does not change when theirs does. The children's links belong to the trip, not to either adult, so they still show today and tomorrow, still show no money, and still stop working when the trip is frozen. When you want your side of it gone, ask. This page already says what we can do: a trip can be deleted and brought back, and a whole household can be deleted for good with a code.

After a trip, the service keeps short notes about how your family travels — one at a time, each agreed to individually, each carrying the sentence that produced it, such as observed on France 2026. You can delete any single note immediately. Notes survive the trip that produced them, which is why they are stored apart from the trip.

If you talk through a plan instead of typing it, the audio and the transcript are discarded the moment you confirm what they produced. What remains is the short source phrase attached to each confirmed note. There is no retained recording and no second copy.

When you record a booking you made with a supplier, the service stores the confirmation number and the traveller name as you type them, in encrypted columns, under the same household boundary as everything else. The field refuses input that looks like a passport number or card digits. Confirmations never appear on a child's Today view, appear in the printed pack only if you turn that on, and are deleted 180 days after the trip ends, or with the trip, whichever comes first.

When you paste a booking or upload a PDF or picture, its text or pages are sent to OpenAI to read the trip details. The app does not keep the uploaded file. Check and correct the details before adding them.

If you forward a booking to your trip's address, Postmark delivers it to the app. We keep the extracted details as an encrypted draft for you to review, not the original email or attachment. The draft uses the trip's confirmation expiry date. Adding the draft records the details you checked; it does not look up or change a supplier booking.

Payment runs through Stripe's hosted checkout. Card numbers, security codes, and bank details never reach our servers — you enter them on Stripe's page. We keep Stripe's identifiers, the amount, currency, status, timestamps, any refund or dispute reference, and the access it granted. We do not keep a payment method to charge later, because there is no later charge.

Location is off until you turn it on, at the first moment on the trip where knowing where you are standing changes the answer. It is used to work out the adjustment in front of you and is never kept as a trace of where your family went.

If you email us, we receive the address, the message, and anything attached, and we use it to answer you. Do not send payment-card data, government identification, passport details, or children's full names.

Our servers log the request, the time, an address, and a browser identifier, kept briefly to keep the service up and to investigate abuse. These are operational records, not a profile.

• Card numbers, security codes, PINs, or bank account numbers.
• Passport numbers, national identification numbers, or known-traveler numbers — the parser drops them at the boundary rather than storing them and redacting later.
• Dates of birth.
• Any contact detail for a child.
• A saved payment method for future charging.
• Sign-in tokens in readable form.

We count how many times each page is opened here on our website. We use Cloudflare Web Analytics to do it.

The trip planner is not counted. The screens made for kids are never counted.

It does not use cookies. It cannot follow you to another site. It does not know your name and it does not tell us who you are. It counts the page, not the person, so there is nothing here for you to turn off.

We read it to see which pages help families and which ones do not. That is all we do with it.

No ads follow you around. Nobody builds a picture of you. We do not sell what we know about you.

Pages load typefaces from Google Fonts, so your browser connects to that service to fetch the files. The application stores your light or dark preference in your own browser; that setting never reaches us.

• Cloudflare — delivers this site and sits in front of the application.
• netcup — the German data centre where the application and its database run.
• Stripe — takes the payment.
• Our mail provider — sends sign-in links and carries your replies.
• Postmark — delivers forwarded booking emails to the trip address you choose.
• OpenAI — reads the trip requests, booking text and document pages you submit to the app.
• Groq or OpenRouter — turns a voice note into text when you choose to speak.
• Our customer records system — holds the emails you send us.

Each handles the data to do that job and nothing else.

Some links out to hotels, rail operators, and other suppliers carry a parameter that tells the supplier we sent you, which is how a commission is paid. Those links are labelled where they appear, and under California law that referral may count as sharing your information. The affiliate disclosure sets out how it works and why it never changes which route is recommended.

• Audio and transcripts — discarded as soon as you confirm what they produced.
• A trip you planned but never bought — kept for twelve months after your last edit, then purged along with the profiles attached to it.
• A trip you bought — archived and readable free, indefinitely, until you delete it.
• A single memory note — gone the moment you delete it.
• A deleted trip — leaves your archive and is restorable from Deleted trips; the notes it produced remain.
• A deleted household — hard deletion, confirmed with a code: profiles, notes, voice-derived phrases, trips, and the identifiers behind them.
• Imported confirmations — 180 days after the trip ends, or with the trip.
• Invoices — survive a household deletion with identity reduced to what tax records require. They are the only survivor.

From your account you can read and export what we hold, correct a profile, delete one memory note, delete a trip, or delete the household outright. Deleting the household is deliberate and confirmed with a code, because it is not reversible.

Depending on where you live you also have the right to ask what we hold and why, to have it corrected or erased, to receive a portable copy, to object to or restrict a use, to opt out of the sharing described under booking links, and to be treated no differently for asking. Californians hold those rights under the CPRA; residents of the European Union and the United Kingdom hold them under the GDPR — including the right to complain to your supervisory authority — and Canadian residents under PIPEDA, with Quebec's own rules on top. Email hello@tripfigured.com from the address on the account and say what you want done. We answer within the period the applicable law sets.

Traffic is encrypted in transit. The database is encrypted at rest. Household boundaries are enforced in the database itself rather than trusted to application code, so one household's rows cannot be read through another household's session. Sensitive profile fields carry their own encryption. Invitations are single-use, short-lived, tied to one trip and one email address, and only the hash of the token is stored.

Rivalta, Inc. is a company in the United States and the application's server and database are in Germany, so your information crosses the Atlantic in the ordinary course of running the service.

This notice is dated at the top. When what we collect or how we use it changes, the date changes with it, and a change that affects you materially is announced in the application rather than quietly published here.

Email hello@tripfigured.com. The contact page lists the separate routes for corrections, accessibility, and press.