Privacy Policy

Pinphy is a travel planning service operated by Pinphy. This policy explains how we handle personal information when you use our website, our apps and any related services (together, "the Service").

If you have a question about anything in this policy, email us at privacy@pinphy.app and a real person will reply.

You give us information directly when you use the Service. This includes:

• Account details — your email address, display name and profile photo.
• Trip content — trips, saved places, itineraries, notes, checklists, budgets, bookings, packing lists, journal entries and photos you upload.
• Imports — Google Maps saved-place exports, links you share into the Travel Inbox, and places friends share with you.
• Collaboration — comments, votes, reactions and messages you post in shared trips.
• Payment details — handled by our payment provider; we receive the plan, status and last four digits, never your full card number.
• Support messages — anything you send us by email or in-app.

• Device and browser type, operating system, language and screen size.
• Approximate location derived from your IP address, used for currency, weather and regional defaults.
• Usage events such as pages viewed, features used and errors encountered.
• Cookies and similar technologies, described in our Cookie Policy.

We do not track your precise GPS location in the background. Location is only used while you are actively using a feature that needs it.

We only use personal information where we have a lawful basis to do so:

• To provide the Service — creating trips, syncing devices, sharing itineraries with people you invite (performance of our contract with you).
• To keep the Service safe — preventing fraud, abuse and unauthorised access (legitimate interests).
• To improve the Service — understanding which features are used and fixing problems (legitimate interests).
• To communicate with you — service notices, security alerts and replies to support requests (contract and legitimate interests).
• To send optional marketing — only where you have opted in, and you can opt out at any time (consent).
• To meet legal obligations — tax, accounting and lawful requests (legal obligation).

Some features — trip suggestions, destination guides, itinerary summaries, translations and trip stories — use AI models operated by third-party providers on our behalf.

• We send only the content needed to complete the request, such as a destination name, a place list or the text you asked us to translate.
• We instruct our AI providers not to use your content to train their general-purpose models.
• AI output is generated text and can be wrong. See the AI Disclaimer for details.

We never sell your personal information. We share it only in these situations:

• People you choose — trip members, people you send a share link to, and anyone who can view a public trip page you publish.
• Service providers — hosting, database, storage, email delivery, payment processing, maps, weather, currency and AI providers, all bound by contract to protect your data.
• Legal reasons — where we are legally required to disclose information, or to protect the rights, property or safety of people using the Service.
• Business transfers — if the Service is acquired, your information may transfer with it, subject to this policy.

Our providers may process data in countries other than yours. Where personal information leaves your region, we rely on recognised safeguards such as standard contractual clauses and providers with equivalent protections.

We keep your information for as long as your account is open, and for a limited period afterwards. Full timeframes are set out in our Data Retention Policy.

Depending on where you live, you may have the right to:

• Access a copy of the personal information we hold about you.
• Correct information that is wrong or incomplete.
• Delete your account and associated content.
• Export your trips in a portable format.
• Object to or restrict certain processing.
• Withdraw consent for optional processing, such as marketing email.
• Complain to your local data protection authority.

Most of these are self-service in Settings. For anything else, email privacy@pinphy.app. We respond within 30 days.

We use encryption in transit, access controls, row-level database security and audited administrative access. No online service can promise perfect security, so please use a strong, unique password.

To report a vulnerability, email security@pinphy.app rather than posting it publicly.

Pinphy is not designed for children under 13 (or under 16 where local law requires). If we learn we have collected information from a child, we delete it.

If we make a material change, we will update the version number and last-updated date on this page and notify you in-app or by email before the change takes effect.