Privacy & cookies

Last updated October 2026. Plain-language summary — not a substitute for legal advice.

What we collect

If you just browse the landing page or a shared/sample trip, we don't ask for anything. Creating an account or a trip collects:

Account: name, email, and a password (stored hashed) — or, if you sign in with Google, your name, email, profile photo and a Google account ID instead of a password.
Trip content: destinations, dates, flight details, hotel name, areas, interests, budget figures, and anything you or your collaborators type into a trip.
Collaboration: who's a member of a trip and their role, invite links you create, and which option a member picks (attributed to that member, visible to the rest of the trip).
Trippie chat: messages you send the assistant, to generate a reply. These are not saved on our server after the request completes.

Cookies & browser storage

We don't run ads or ad-tracking scripts, so there's no ad-tech cookie wall here. What we do use:

What	Purpose	Where
Session cookie	Keeps you signed in	Cookie, expires when you log out or after inactivity
CSRF token cookie	Blocks cross-site request forgery	Cookie, session-length
Trip picks	Which option the group chose for each stop	On trips you belong to: saved on our server with who picked it, so everyone on the trip sees the same picks. On the public sample trips: your browser's local storage only
Trippie history	Keeps the chat visible while you browse	Your browser's session storage only, cleared when the tab closes

Trippie's chat history and your picks on the sample trips live in your browser's storage, not ours — clearing your browser data or switching device resets them.

Third parties we send data to

To provide specific features, some data leaves Travel2gether and goes to:

Google Sign-In — if you use it, to authenticate you.
Anthropic (Claude AI) — your trip's destination, dates, day titles and areas, interests, and hotel names (to draft a day or suggest day details), and whatever you type to Trippie or into "Help me with this day" (plus your current trip's summary, if you're on a trip page). Anthropic does not use this to train its models under its commercial API terms. Don't paste anything sensitive into a trip field or the chat — treat both like a message to any third-party AI tool.
OpenStreetMap services (Photon, Overpass) — the place name you type and an approximate location, to look up real places for the trip builder and to give the AI a list of real nearby sights. No account data is sent.
Pexels — the names of places in an AI-drafted day, to find an illustrative photo when none of our own photos fits. The photo then loads from Pexels' servers, which can see your IP address, like any image on the web.
Open-Meteo — a location's coordinates and a date, to fetch weather. No personal or account data is sent.

None of these providers are paid to advertise back to you based on this data, and we don't sell or rent your information to anyone.

Who can see what

A private trip is visible only to its owner and the collaborators invited to it. A public trip (like the seeded samples) is visible to anyone with the link. Presence — "who's viewing this trip right now" — is only shown to other members of that same trip, never to strangers.

How long we keep it, and your choices

We keep account and trip data for as long as your account exists. Security logs (sign-in attempts, etc.) are kept for 90 days. Nightly database backups are kept for 14 days, then deleted automatically. To access, correct, or delete your data — including closing your account — contact the site owner (a self-service option is coming; for now, reach out through the account you signed up with).

Children

Travel2gether isn't directed at children and isn't intended for use by anyone who can't independently agree to these terms.

Changes

If this policy changes in a way that matters, we'll update the date at the top of this page.