Privacy policy

In short

• You can use TripBite without an account. You only need one to save trips and ratings.
• Your traveller profile (diets, allergies, kids, budget) stays on your phone. It only leaves it as a filter for each search, and we do not store it.
• Your diets and allergies are never used for ads or statistics.
• We do not sell data. We do not use analytics or tracking tools.
• Data is stored on servers in Frankfurt (Germany).
• For any question or request: hola@tripbite.app.

1. Who is responsible

The controller of your data is:

• Name: José Antonio Cueto Mengana
• Tax id (NIF): 56077641F
• Address: Subida Gurugú, 4, 4.º izquierda, 39004 Santander (Cantabria), España
• Contact email: hola@tripbite.app

2. What data we process, why and on what legal basis

Account

What: your email, your password (we only keep a bcrypt hash, never the password itself), the date you signed up and the date you confirmed your email. The name you type when you sign up stays on your phone.

Why: to identify you and keep your trips, favourites and ratings.

Legal basis: performance of a contract, that is, giving you the service you ask for when you create the account (Art. 6(1)(b) GDPR).

Sessions

What: the session data that keeps you signed in on your phone. On the server we only keep a hash of the refresh token, which expires after 7 days.

Why and legal basis: to keep your session secure (Art. 6(1)(b) GDPR).

Email confirmation code

What: a 6-digit code we email you. It expires after 15 minutes. We only keep a hash of the code (not the code), the address we sent it to, when it was created and the failed attempts.

Why: to check the email is yours before you can save data or send road reports, and to prevent abuse.

Legal basis: Art. 6(1)(b) GDPR. The email is sent by Resend (see section 4).

Traveller profile

What: how many adults are travelling, the children's ages, diets and allergies, budget per person, pace, minimum rating, whether you need parking, whether a dog is coming and your fuel type.

Where it is kept: only on your phone. Without an account, the profile lasts while the app is open. With an account, it is stored encrypted in the phone's secure storage (Keychain on iPhone, Keystore on Android). We do not keep it on our servers.

Why: with each search, the app sends our server the parts of the profile that work as filters. The server uses them to choose places and does not store them. The fuel type is not sent with the restaurant search.

Legal basis: Art. 6(1)(b) GDPR, and explicit consent for diets (see below).

Diets, allergies and halal (special category data)

An allergy or coeliac disease is health data, and halal may reveal religious beliefs. The GDPR gives them extra protection (Art. 9).

• Legal basis: your explicit consent (Art. 9(2)(a) GDPR). Adding them is optional: if you don't, we search without that filter.
• Use: only as a search filter. Our server does the filtering: they are not sent to Google or any other provider.
• They are never sent to ads, analytics or error reports.
• You can remove them at any time in Profile. Withdrawing consent does not affect searches already made.

Saved trips and favourites (with an account)

What: the trip name, the start and end coordinates, the filters you chose and the restaurants you mark as favourites.

Why and legal basis: to keep them for you (Art. 6(1)(b) GDPR). You can delete them in the app.

Ratings: "How was it?" (with an account)

What: the 1 to 5 rating, an optional comment and the place's identifier. We do not store the place's name or address. For now only you can see the comment.

Answers about diets ("was it really coeliac-safe?"): only stored if you give explicit permission at that moment, and we keep the date of that permission. Publicly we only show totals, and only once a diet has at least 3 answers, so nobody can work out what one person answered.

Legal basis: Art. 6(1)(b) GDPR for the rating and explicit consent (Art. 9(2)(a)) for the answers about diets. You can change or delete your rating in the app.

Road reports (with an account)

What: the type of report (accident, queue, roadworks, object on the road or stopped vehicle), the place to within about 10 metres, the direction of travel and the road.

Who sent it: nobody can see that. To prevent abuse (one vote per person and hourly limits), we keep your account linked to the report only while it is active, 3 hours at most, and delete the link with it.

Your position: when you report, the app sends where the phone is to check you are near the place. It is not stored.

Legal basis: legitimate interest in reliable reports and in preventing abuse (Art. 6(1)(f) GDPR).

Shared plans

What: the names of the start and end towns (never the street or coordinates), the departure time, the stops with their times and the plan B. It does not include your profile, diets, account or IP address.

Why: to create the link you share. Anyone with the link can see the plan. The link works for 30 days and is then deleted.

Legal basis: Art. 6(1)(b) GDPR.

Location

The app only uses your location while it is open, never in the background, and only if you allow it on your phone.

On the phone:

• "Use my location" to set the start of the trip.
• Trip mode and navigation: your position on the route, the arrival time and the voice prompts are worked out on the phone.
• Road reports: the speed tells whether the car is stopped.
• Day and night colours: if you already allowed location, the last known position is used to work out sunrise and sunset.

What reaches our server:

• The start and end coordinates of each stop search and each route.
• Your current position when navigation recalculates the route because you left it.
• Your position when you send a road report (see above).
• An approximate position (rounded to 1 km) when you search for a street or a place, and the map point whose name you ask for.

These coordinates are used to answer and are not stored, except for the trips you save yourself. They are not written to the technical logs either.

Legal basis: Art. 6(1)(b) GDPR, together with the location permission you give on your phone. You can remove it at any time in the system settings; the app still works if you type the places.

Street and place search

Towns are searched inside the app, offline. When you type a street or a place, the text goes through our server to the Photon search engine (see section 4). We keep the answer in memory for 10 minutes so the same search is not repeated, and we do not write the text to the logs.

IP address and usage limits

We use your IP address in the server's memory to limit how many requests can be made per minute or per day, to prevent abuse. It is not stored in the database and is forgotten within 24 hours at most.

Legal basis: legitimate interest in protecting the service (Art. 6(1)(f) GDPR).

Technical logs

The server records what it does so we can find faults. These logs do not include your full email (it appears masked, for example j***@gmail.com), what you search for, coordinates or the verification code. They may include your account's internal identifier. They are not written to files: Fly.io collects them and keeps them for a limited time.

Legal basis: legitimate interest in keeping the service working and secure (Art. 6(1)(f) GDPR).

Data that stays on your phone

Besides the profile, the app keeps your session, the stops waiting for a rating (encrypted, deleted after 2 days), and your chosen language and appearance on the phone. The "remind me 20 minutes before" alerts are local notifications: they do not go through any server.

3. What we don't do

• We do not sell or rent your data.
• We do not use analytics, heatmaps or tracking tools.
• We do not make automated decisions with legal effects on you.
• We do not use your diets, your route or your account for ads.

4. Providers and recipients

These providers process data so that TripBite works. Those acting as processors do so on our instructions and under their data processing agreement.

• Neon (Neon, Inc., USA): the database. Data is hosted in Frankfurt (Germany).
• Fly.io (Fly.io, Inc., USA): the API server, in Frankfurt (Germany). It receives your requests and your IP address.
• Resend (a US company): sends the email with the confirmation code, from its EU region (Ireland). It receives your email address and the message.
• Google:
  • Google Places: restaurant data. Our server sends it the points on your route where we search and the search radius. It does not send your IP address, account or diets.
  • Google Maps on Android: draws the app's map. To show it, Google receives technical data from the phone and the map area.
  • Google AdMob: ads (see section 9).
• Valhalla, public server run by FOSSGIS e.V. (Germany): works out routes and navigation with OpenStreetMap data. It receives the route coordinates from our server, not your IP address.
• Photon, public server run by komoot (Germany): searches streets and places. It receives the text you type and an approximate position from our server, not your IP address.
• Open-Meteo (Switzerland): the weather at the stop. It receives an approximate point (an area of about 5 km) and the time.
• Spanish Ministry for the Ecological Transition and the Demographic Challenge (fuel prices), DGT (traffic) and INE (list of municipalities): we only download their public data. We send them nothing about you.
• Expo (650 Industries, Inc., USA): only used to build the app. The app does not send it any user data.

If you open a place in Google Maps or Waze with "Directions", that app's privacy policy applies.

5. International transfers

Several providers are US companies even though the data is hosted in the EU. Where data is transferred outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework when the provider has joined it (as Google has) or on the European Commission's standard contractual clauses, as each provider states in its agreement. Switzerland has an adequacy decision from the European Commission.

6. How long we keep data

• Account, trips, favourites and ratings: until you delete them or ask us to delete the account.
• Confirmation code: expires after 15 minutes. Its hash is deleted when you ask for another code more than 24 hours later, or when the account is deleted.
• Session: the refresh token expires after 7 days. The expired record is deleted with the account.
• Road reports: 3 hours at most. When they expire they are deleted, together with the link to your account.
• Shared plans: 30 days.
• Street and place searches: 10 minutes in memory.
• IP address for usage limits: 24 hours at most, in memory.
• Traveller profile: on your phone, until you delete it, sign out or uninstall the app.

Deleting the account also deletes its sessions, codes, trips, favourites, ratings and road report votes. It may stay a few more hours in the database's technical recovery history (currently 6 hours at most).

7. Your rights

You can ask at any time for:

• Access: to know what data we hold about you and get a copy.
• Rectification: to correct wrong data.
• Erasure: to delete your data and your account.
• Portability: to get your data in a machine-readable format (JSON).
• Objection and restriction: to stop us using your data for something specific, or to keep it without using it.
• Withdrawing your consent for diets or personalised ads, without affecting what was done before.

How: email hola@tripbite.app from your account's email address, so we can check it is you. We reply within one month at most.

Deleting your account: for now, ask by email to hola@tripbite.app from the account's email address. In the app you can already delete your trips and ratings, and delete the profile from your phone.

If you think we have not handled your rights properly, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Security

All connections are encrypted (HTTPS). Passwords and codes are only stored as hashes. On the phone, the session and the profile are kept in the system's encrypted storage. Access to the servers and the database is limited to the people who run TripBite.

9. Ads

The free version shows a small Google AdMob banner. There are never full-screen ads, and never any during Trip mode or navigation.

• Consent: the first time you open the app in the European Economic Area, Google's consent form appears. No ad is requested before you answer.
• Without consent: non-personalised ads are requested, or none if Google does not allow it.
• What Google receives: according to Google, its ads SDK collects the phone's advertising ID, the IP address (from which it gets an approximate location), interactions with ads and diagnostic data. On iPhone we do not use the advertising ID.
• What it does not receive: your diets, allergies, profile, route, email or account.
• Changing your choice: in the app, Settings → Privacy → Ad privacy.

Legal basis: your consent for personalised ads and for storing or reading data on the phone for that purpose (Art. 6(1)(a) GDPR); legitimate interest in funding the app for non-personalised ads (Art. 6(1)(f)). Google processes this data under its own privacy policy.

10. Children

TripBite is not aimed at children under 14. If you are under 14, do not create an account without the consent of your parent or guardian (Art. 7 of Spanish Organic Law 3/2018). If we learn that an account belongs to a child under 14 without that consent, we will delete it.

The children's ages you add to the profile stay on your phone and are only sent as a search filter.

11. Changes to this policy

We will publish each new version here with its date.