Privacy Policy

1. Who we are

TripMate is a group trip expense app on the web and on Android, built and run by Biswodip Goj ("we", "us"). This policy explains what information TripMate handles, why, and the choices you have.

2. Information you give us

• Your name and 10-digit mobile number, so your group knows who you are and you can find your trips when you log in.
• A 4-digit PIN. On our servers it is stored only as a one-way hash, so nobody, including us, can read it back.
• Trip details you and your group add: trip name, code and password, expenses (amounts, categories, notes, who paid and who shared), hotel stays and rooms, sponsorships, settlements, and whether each one was paid by UPI or in cash.
• UPI IDs and names that members choose to add so others can pay them.
• Bill photos and UPI payment screenshots you attach. Photos are compressed on your device before upload and can only be opened by members of that trip.

3. Information collected automatically

• Login cookies. The website keeps your login in two httpOnly cookies that page scripts cannot read: a short-lived access token and a refresh token that lasts up to 90 days while you keep using TripMate.
• On Android, the app keeps the same kind of refresh token in the phone’s secure storage (Android Keystore), and the short-lived access token only in memory.
• A session record for each logged-in browser: a hash of the refresh token, the trips it can open, your browser or app description (user agent) and when it was last used. This lets you log out and lets us end stolen sessions.
• Abuse protection. To stop PIN guessing, we count login attempts against your network (IP) address and mobile number for a short time, and lock a member for 15 minutes after 5 wrong PINs.
• Standard server logs kept by our hosting providers, such as request times and IP addresses.

4. Information kept on your device

So TripMate works offline, trips you open are saved on your phone or in your browser, together with your language choice and the mobile number you last logged in with. This stays on your device until you log out, clear the app data or uninstall. Your PIN is never saved on the device.

5. What we do not do

• No advertising and no third-party analytics or tracking scripts.
• We do not sell or rent your information.
• TripMate does not read your contacts, SMS or location. The Android app uses the camera and photos only when you choose to attach a bill or screenshot.

6. How we use information

Only to run TripMate: showing your trips to their members, calculating who owes whom, syncing between your devices, keeping your account secure and answering your requests. We do not use it for profiling or marketing.

7. Who can see your information

• Members of a trip can see that trip: member names and mobile numbers, expenses, stays, settlements, UPI IDs and attached photos.
• Our service providers process data on our behalf: Supabase (database and file storage), Vercel (website hosting) and Expo (delivering Android app updates). Their servers may be outside India.
• We may disclose information if the law requires it.

8. How long we keep it

• Trip data is kept until the trip is deleted or you ask us to delete it.
• Login sessions end when you log out, or after 90 days without use.
• Login-attempt counters are cleared within a day.

9. Security

We use HTTPS, hashed PINs, httpOnly cookies, rate limits and server-side access checks. No system is perfectly secure, so keep your PIN and trip password private and tell us if you suspect misuse.

10. Your choices and rights

You can ask to see, correct or delete your information, or withdraw consent, by contacting us. Depending on the law that applies to you, including India’s Digital Personal Data Protection Act, 2023, you may have further rights, and we will respond within a reasonable time.

11. Children

TripMate is not intended for anyone under 18 unless a parent or guardian has agreed to their use.

12. Changes to this policy

If we change how TripMate handles information, we will update this page and its date. Significant changes will be shown in the app before they take effect.

13. Contact

For questions or requests about your data, contact Biswodip Goj, who runs TripMate.