Last updated: 2026-11-03
This policy explains what Trip Quill collects, why, who it is shared with, how long it is kept, and how you can delete it. For the specific AI providers your travel documents are processed through, see the companion AI Providers disclosure, which you accept separately before your first document upload.
Trip Quill is an AI-assisted travel planning app. For privacy questions or to exercise any right described below, email privacy@tripquill.app.
Account information, created when you sign in: - Your name, email address, and profile photo URL, as provided by Google or Apple Sign-In. - A provider identifier from Google or Apple, used to recognize you on return visits. We never receive or store your Google/Apple password.
Profile information you enter: - Home country and passport country codes. - Optional travel preferences: pace, who you travel with, budget band, and interests. - Destinations you save to your "Want to go" list. - Destinations you have opened in the app ("explored"), so their sketches show in colour on every device you sign in on.
Places you've been ("Been there"), only what you choose to add: - The destinations you mark as visited, either by hand or by answering "Did you go?" after a trip ends. - For each place, the years you went and an optional short note (up to 120 characters). Please don't put sensitive details in the note. - Your answer to "Did you go?" for each finished trip: yes, no, or stop asking. - Journal notes the app writes for you when you reach a milestone (your first place abroad, a number of places, a new continent, your furthest place yet), with the date you earned them.
Postcards and journal pages you share are made on your phone. The line you write on a card and the names of people you went with stay on your phone and leave it only inside an image you choose to share; we never receive them.
We keep this so your travel record is yours on every device you sign in on. We process it because it is the service you asked for. It is never used for advertising or targeting, never shared with the AI providers, and never compared with other users.
Trip content you create: - Trips you add and their metadata (titles, dates). - Documents you upload to a trip (booking PDFs, screenshots) and the structured itinerary data our AI extracts from them.
Shared trips, only if you invite someone or accept an invite: - Everyone on a shared trip sees the whole trip, every document included, and can add and delete documents and invite others. The person who created the trip can remove people; anyone can leave. - The others on the trip see your first name and initials. When you leave or delete your account, your first name stays on that trip so the others know what happened (for example, "Mari saiu da viagem"). - An invite link works for one person and stops working after 7 days (8 hours for a QR code shown in person). We store only a scrambled form (a hash) of it. - The trip summary is written once for everyone on the trip, so the members' first names (full names when two share a first name) go to the AI to tell the travellers apart.
Trip links, only if you create them: - A "Follow from home" link lets anyone you send it to see a trip's destination, dates and day-by-day plan: the kind and time of each item, and flight numbers and airports. It never shows your documents, names, booking codes, hotel addresses or anything the AI wrote about your trip. Anyone holding the link can see this, so it tells them when you are away. On a shared trip any member can share or turn it off, and it stops working when the trip's creator removes someone. - An "Add to calendar" link puts your own trip, with its item names, in your calendar app. Treat it as private. On a shared trip each member has their own, and it stops working when that member leaves. - We store only a scrambled form (a hash) of each link, when you made it, when you turned it off, and how many times it was opened. We can't see or recover the link itself.
Link activity: daily totals of links shared from the app, opened in the app and viewed on tripquill.app, per kind of link. Totals only: no person, link, device or address is stored with them.
Operational records generated automatically: - AI processing logs (which feature ran, token counts, latency, success or error) used for cost and quality monitoring. These do not store your document contents. - Upload-attempt records used to enforce per-user rate limits.
Usage analytics, on unless you turn it off: which screens and features you use (for example, that you opened Freedom or shared a card), with the app version, device model and language, tied to your account. Never what you write, search or upload, document details, or anyone's name. We use it, under our legitimate interest in improving the app, to see what works. A random session id in these events and in our server's request logs lets us trace a problem. Events are deleted after 90 days. You can turn this off in Profile, under "Help improve TripQuill"; turning it off, or deleting your account, erases your events. Before you sign up, the app records which onboarding steps you see and how your sign-in went under a random id it creates (not your device's id), attaches them to your account when you sign up, or deletes them after 30 days if you don't finish; there's no switch before sign-up, and turning the Profile switch off afterwards erases them.
Wait list, only if you join it on tripquill.app: your email address and the language of the page you used. We use it only to tell you when the app launches and to invite you to test it early. It is never shared or sold, and it is deleted after launch, or sooner if you ask at privacy@tripquill.app.
We do not collect location data, contacts or advertising identifiers.
Assistant conversations, only if you accept the assistant's own disclosure and ask it something: - Your questions and the assistant's answers, kept by trip (or on their own for questions about a destination and open questions), and a thumbs rating you may give an answer. - To answer, each question goes to the AI provider with the profile fields it needs (home country, passports, app language and, if you allow it, your travel preferences), the trip details our tools read from your documents and, on a shared trip, what the other members uploaded and their first names; for questions about destinations, the destinations you saved ("Want to go"). No original file goes. The provider's paid terms apply: your conversations are never used to train its models and never for ads. - With "Keep history" off, new conversations are not kept after they close; the ones you already have stay until you delete them. - The assistant can make mistakes: check entry rules and bookings at the source before deciding. It is for people aged 16 and over, per the store ratings and the Terms of Use.
To keep the service reliable and within fair-use limits (rate limiting, error monitoring).
To answer your questions to the assistant from your own trips, our visa and travel-advisory records and general travel knowledge, through the AI provider named in the assistant's disclosure.
We do not sell your personal data, and we do not use it for advertising.
Trip Quill relies on a small set of service providers ("subprocessors"):
Your document files and account data stay within Trip Quill's own infrastructure (Cloudflare R2 for files, a Postgres database for everything else) except for the specific data sent to the AI providers described in the disclosure. We do not transfer your data to any other third party except where required by law.
You can delete an individual document or trip at any time from the app; the file and its extracted data are removed promptly. You can remove a place you've been, with its years and note, at any time from that place's page. You can delete one conversation with the assistant, or all of them, from the app; they go at once.
Deleting your account removes, in one operation: your account record, all your trips, all uploaded document files, all extracted document data, synthesized itineraries, your assistant conversations, your saved and explored destinations, the places you've been with their years and notes, and rate-limit records. AI processing logs are retained but unlinked from your identity (and then deleted on the 90-day schedule above). After account deletion, your Apple sign-in authorization is also revoked where applicable.
On a shared trip you created, the trip passes to the person who joined first, without the documents you added; the documents the others added stay with them. On trips you joined, the documents you added are removed and your first name stays on the trip, as described above.
Backups. For disaster recovery we keep encrypted database and file backups on a rolling schedule. Deleted data persists in those backups until they rotate out, which takes up to 30 days, after which it is permanently gone.
Depending on where you live (for example, under Brazil's LGPD, the GDPR or similar laws), you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. You can exercise deletion directly in the app, and for any other request email privacy@tripquill.app. Until the app has an export button, we send you a copy of your data, including the places you've been, when you ask by email. Withdrawing consent to AI processing means we can no longer extract or summarize newly uploaded documents.
Trip Quill is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their data.
If we change what we collect or who processes it, we update this page and its "last updated" date. Adding or changing an AI provider additionally re-prompts your consent on the next document upload — the service will not ship a release that adds a provider without first updating the AI Providers disclosure.
Questions or requests: privacy@tripquill.app.