Privacy Policy

1. Data controller

The controller of your personal data is Monika Dąbrowska, a sole trader registered in Poland, tax ID (NIP) 7352887773 (the TripBuddy project). For any data-related matters, write to: [email protected].

2. What data we collect

• Account data: your email and password (stored encrypted, never as plain text).
• Profile data you provide voluntarily: first and last name, age, gender, city, country, bio, photo, interests, links.
• Content you create: trips, sign-ups, ratings, friendships, reports, chat messages (group and private) with uploaded photos, trip cost entries and settlements, checklists, and markers on your private places map.
• Search watches (optional): if you enable notifications about new trips, we store the chosen criteria and your e-mail address to message you when a matching trip appears. You can remove a watch with one click in the e-mail ("unsubscribe" link).
• Technical data: basic logs and error information (may include your IP address), needed to run and secure the service.

3. Purpose and legal basis

We process your data under Article 6(1) GDPR:

• performance of a contract (b) - running your account and providing the service, i.e. matching people for trips;
• consent (a) - selected email notifications, which you can turn off any time in your profile;
• legitimate interest (f) - security, abuse prevention and content moderation.

4. Testing version (beta)

TripBuddy is a testing version. The service may be temporarily unavailable and test data may be reset. Please do not enter special-category data (e.g. about health or beliefs) - we do not need it.

5. Who we share data with

• Other users - your profile and content are visible to others, to the extent you set in your visibility settings. Private notes, costs, checklists and your places map stay visible only to you.
• Technical providers - hosting, database and email delivery (Microsoft Azure, EU region); they process data only on our behalf.
• Cloudflare - traffic to the service passes through Cloudflare's infrastructure (attack protection and speed-up); Cloudflare processes e.g. IP addresses in doing so.
• Microsoft Azure AI Translator - when a trip description is translated automatically, its text (without your personal data) is passed to the translation service.
• Google (Google Maps) - maps in the service are loaded from Google servers; your browser shares e.g. your IP address with Google. Place search when creating a trip uses the Nominatim service (OpenStreetMap) on the same basis.
• We do not sell your data or share it for third-party marketing.

6. How long we keep data

We keep account data until the account is deleted. You can delete your account any time in profile settings - we then remove your data and content. Technical logs are kept briefly, for security.

7. Your rights

You have the right to: access, rectification, erasure, restriction of processing, objection, data portability, and to withdraw consent at any time. You may also lodge a complaint with the Polish data protection authority (PUODO).

To exercise your rights, write to [email protected].

8. Cookies

We use only essential cookies: one keeps you signed in (your session) and one remembers your language. We use no analytics or marketing cookies, which is why we show no cookie-consent banner. If that changes, we will ask for your consent first.

We measure site traffic with Plausible Analytics, a cookieless tool that does not identify individuals - it collects only aggregated, anonymised statistics (e.g. visit counts).

9. Security

Passwords are stored encrypted (bcrypt hash), the connection is encrypted (HTTPS), and access to data is restricted.

10. Changes to this policy

We may update this policy. We will announce material changes in the service or by email.

11. Contact

Questions? Write to [email protected].