Privacy policy

What we keep

• Account: your email address, your name, and your password stored only as a secure hash. If you sign in with Google, your name, email and profile picture come from Google.
• Sign-in sessions: the session's IP address and browser type, to keep you signed in and spot misuse.
• Your deal settings: home airports, dream places, trip styles, travel months, trip length, cabin, alert settings and price limit.
• Passport country only, used to filter out trips you cannot take. Never passport numbers.
• What you do in the app: saved deals, the deal alerts we sent you and the trip plans you created.
• Push notifications: if you allow them, your browser's push address and keys, your language and time zone, so alerts arrive at a sensible hour.
• Waitlist: your email, language and the country you joined from.
• Billing: your plan, subscription status, renewal date and the customer and subscription IDs from Dodo Payments. We never see or store your card details.
• Email delivery: whether an email to you bounced or was marked as spam, so we stop sending to that address.

What we do not keep

We read your approximate country and location from your connection to suggest nearby airports and the right prices. We use it for that request only and do not store it. To stop misuse we count requests per connection using a one-way hash, which is deleted after a short time. Only your country is kept, in the usage statistics below.

Cookies

We use only cookies the site needs to work: your sign-in session, your language, your quiz answers until you finish signing up, and your waitlist place. We use no analytics or advertising cookies.

Usage statistics

To see which features help and fix what doesn't, we count how the site is used: pages and screens opened, buttons tapped, deals shown and opened, clicks to booking sites, sign-up steps, page speed, and your country, device type and language. Members are recorded under a scrambled code made from their account, never their name, email or IP address; visitors who aren't signed in get a code that changes every day. No analytics cookies, no third parties: the data stays with our host Cloudflare and is deleted after about three months.

Why we use it

• To provide the service you signed up for (account, deal alerts, trip plans, paid plans): to perform our contract with you.
• To keep Tripdaash secure and prevent misuse and fraud: our legitimate interest.
• Push notifications: your consent, which you can withdraw at any time in your browser or in Alerts.
• Billing and tax records: legal obligations.
• We do not sell your personal data or share it for advertising, and we make no automated decisions with legal or similarly significant effects about you.

Who processes data for us

• Cloudflare: hosting, our database (stored in eastern North America) and the gateway our AI requests pass through.
• Amazon Web Services (SES): sending emails.
• Google: sign-in, only if you choose Sign in with Google.
• Google (Gemini API): writes AI trip plans from the trip details you enter. Please do not put personal details in a trip request.
• Dodo Payments: our merchant of record for checkout, payments, invoices and tax. It processes your payment details under its own privacy policy.
• Push services run by your browser's maker (for example Google, Apple or Mozilla) deliver push notifications.

International transfers

Our providers may process data outside your country, including in the United States. Where the GDPR or UK GDPR applies, these transfers rely on adequacy decisions, such as the EU-US Data Privacy Framework, or on standard contractual clauses.

How long we keep it

• Account data: as long as your account exists. Delete your account, or ask us, and we delete it.
• Sign-in sessions: until they expire or you sign out.
• Waitlist: until you join or ask us to remove you.
• Billing records: as long as tax and accounting law requires, even after you delete your account.

Security

Data is encrypted in transit, passwords are stored only as hashes, and access is limited to the people who run Tripdaash. If a breach puts your data at risk, we tell you and the authorities as the law requires.

Children

Tripdaash is not meant for children under 16, and we do not knowingly collect their data. If you think a child has given us data, email hello@tripdaash.com and we will delete it.

Your rights

You can ask for a copy of your data, correct it, delete it, take it with you, restrict or object to how we use it, and withdraw consent at any time. Email hello@tripdaash.com. You can also complain to your data protection authority. If you live in a US state with a privacy law, such as California, you have similar rights; we do not sell or share personal information.

Changes

If we change this policy in a way that matters, we tell you by email or in the app before it applies.