Privacy Policy

1. Operator and scope

This policy applies to the Tripin iOS and iPadOS app, provided by an individual developer, and to this privacy policy page. It does not describe the separate Android app. Tripin has no separate Tripin account registration or developer-hosted trip database. Optional sync uses your existing Apple iCloud account. Questions about personal information can be sent to the contact address below.

Applicability: this policy applies to Tripin for iOS and iPadOS version 1.4 and later, including optional iCloud sync, trip-deletion confirmations, Records to Review, and retained-content management. Some of these features become available only after you enable them or approve the related in-app steps.

2. Information handled and purposes

Trip, schedule, and expense records

Trip names, city and country or region, dates, budgets, currencies, and cover-photo references are used for trip management. Schedule names, place names, categories, dates and times, saved coordinates, addresses, notes, and photo references are used for planning and map display. Expenses include names, categories, amounts in the trip's accounting currency, original amounts and currencies, entered currency and precision, dates, saved coordinates, addresses, notes, and photo references. Stored converted amounts and their accounting context are retained; sync does not make a new exchange-rate request to reinterpret a record.

When you approve iCloud sync, these saved fields, record identifiers, parent-trip links, and synchronization information are sent to Apple's private CloudKit storage for cross-device continuity, updates, and deletion propagation. Technical information includes app-generated writer and change identifiers, record versions, and deletion flags and dates. Device settings, selected-trip state, and top-level list order are not synchronized as business-record fields. Tripin does not send these trip records to a developer-hosted server.

Photos and camera

Photo library or camera access is used when you choose to attach a photo to an expense, schedule item, or trip. The attached image copy is stored in Tripin's own storage area. With approved iCloud sync, referenced trip covers and attached photos can also be uploaded as image files to Apple's private CloudKit storage and downloaded to your connected devices. Tripin does not upload your entire system Photos library or every unreferenced file in its local photo storage.

Photo references, byte counts, and SHA-256 content checksums accompany synchronized image files to verify identity and detect changed or corrupted bytes, not to merge unrelated photos. Transfers can use temporary app-private file copies and protection markers so a pending transfer or recovery does not lose its original. Photos are not sent to a developer-hosted trip server.

When you confirm a photo taken with the camera, it is attached to Tripin and, at the same time, saved to your iOS system Photos library. If you cancel a capture, nothing is saved anywhere. A photo you choose from your library is not re-saved or duplicated into the system Photos library.

Removing a record does not promise immediate permanent deletion of every photo copy. Other live records, unfinished transfers, or retained recovery history can still reference and protect an image. Section 5 explains this retention. Removing a Tripin attachment does not delete the image in the system Photos library; manage that image in Photos separately. iCloud Photos and iOS device backups are separate from Tripin's CloudKit sync.

Location information

When you grant location permission and use the current-location feature or place search, your current location is used to move the map and to search for nearby places. The same place search is available when you add either an expense or a schedule item. The app does not track your location in the background, and does not continuously store your device's current location on the developer's server.

Tapping Directions on a saved expense or schedule location opens an external maps app with that location's coordinates, so the app can draw the route. For a trip whose country is set to South Korea, this opens NAVER Map and also includes the place's name; for every other trip, it opens Google Maps with only the coordinates. See Section 4 for what each of these services receives.

Advertising and related information

The app may use the Google Mobile Ads SDK and the Google User Messaging Platform to display ads and manage the related consent. For the purposes of serving ads, frequency capping, preventing abuse, measuring performance, and managing consent, Google may process information such as approximate location inferred from your IP address, device identifiers (for example an advertising identifier or an app- or developer-scoped identifier), ad impression information, product interactions such as app launches and taps, and crash logs and performance or diagnostic information.

The Google User Messaging Platform may communicate with Google before the ATT decision in order to determine whether a region-specific consent flow is required and to present the necessary consent screen. No ads are requested at this stage.

After completing this consent flow, and before starting the Google Mobile Ads SDK or requesting any ad, the app checks the iOS App Tracking Transparency (ATT) authorization status. If you allow tracking through ATT, your device's advertising identifier and your activity in other companies' apps and websites may be used for personalized advertising or ad performance measurement, subject as well to the advertising consent choices that apply in your region. If you do not allow tracking through ATT, or tracking is restricted, the app disables ad personalization and the publisher first-party ID feature. Even in that case, Google may process your IP address, device signals, or certain identifiers in order to serve non-personalized or limited ads, apply frequency capping, produce aggregate reporting, and prevent abuse. The core features of the app — trip management, the map, and expense records — remain available whether or not you allow ATT.

3. Account information and direct contact

Tripin does not ask you to register a Tripin account or enter an Apple account password, payment card number, or bank account number. To check iCloud availability and prevent one account's saved sync state from being used with another, the app asks CloudKit for account status and its container-specific user record identifier. It derives a SHA-256 identifier from that value and stores it in local sync ownership and approval information. A hash is not a guarantee of anonymity.

If the account changes or cannot be verified, the app blocks use of the previous account's sync state; it does not automatically transfer that state to a new account. Local records and retained information are not automatically erased or separated into a new set of trip records. Connecting another account is not a silent migration and may require review or remain blocked.

After returning to the originally connected Apple account, you can use the existing retry action. In some interrupted connection states, retry alone cannot resume synchronization: completely closing and reopening Tripin can be necessary so the app checks the original account and saved state again. Returning to an account is not a guarantee of automatic recovery, and does not reset or re-register ownership.

There is no inquiry form inside the app. If you email the developer, the email service may process your email address, message, and any files you choose to send.

4. External services and transfers

The following external services are used for app features and to serve ads.

• Apple iCloud / CloudKit: optional storage and sync of the records, linked photos, and technical information described above in your Apple account's private database, not Tripin's public database or a developer-operated trip server. Account checks and read-only comparisons can occur during a requested review before you approve a transfer. Initial connection, any new private sync area, and initial record/photo transfer have separate approval boundaries where applicable; connecting does not by itself authorize an unapproved initial upload. Previously approved sync can resume on launch or foreground while enabled. Apple operates this service and handles service/account information under its own terms and privacy practices. Apple Privacy Policy and Apple's private CloudKit database documentation.
• Apple Maps (MapKit): used for map display and place search inside the app. When a map is displayed or moved, general network information such as the map region being viewed may be processed by Apple. When you run a place search, the search term and a search area centered on your current location are sent to Apple. If your current location is unavailable, the city name saved with the currently selected trip may be appended to the search term to improve accuracy. Search results may be held temporarily in app memory; search terms that you do not save as a trip record are not separately stored in the app's persistent storage. Apple Maps is a feature built into iOS, and the handling of map and search requests follows Apple's policy. Apple Privacy Policy
• Google Maps: used only when you tap Directions on an expense or schedule belonging to a trip whose country is not set to South Korea. Tapping it opens Google Maps (in the Google Maps app if installed, otherwise your browser) with only the destination's coordinates included in the link; no place name, trip name, or other trip data is sent. This is separate from the Google Mobile Ads / User Messaging Platform use described below. Google Privacy Policy
• NAVER Map: used only when you tap Directions on an expense or schedule belonging to a trip whose country is set to South Korea. Tapping it opens the NAVER Map app with the destination's coordinates, the saved place name, and the app's bundle identifier, so NAVER Map can show the route and identify the requesting app. If NAVER Map is not installed, the App Store page for NAVER Map opens instead and no location data is sent. The handling of this information follows NAVER's own privacy policy. NAVER Map on the App Store
• Frankfurter exchange rate API: used to convert expenses entered in another currency into your trip currency, and to power the exchange calculator. Each request sends only two currency codes and a reference date; expense amounts, trip details, and location are never sent. Past expenses use the rate for the date of the expense, while today's expenses and the calculator use the latest rate. Retrieved rates are held temporarily in app memory and are not written to the device's persistent storage. Frankfurter
• Google Mobile Ads and Google User Messaging Platform: used to serve ads and manage consent. Details about Google's handling of information are available in the Google Privacy Policy and in how Google handles information in apps that use Google services.
• GitHub Pages: used to publicly host this privacy policy page. When you open this page, GitHub may process general access information such as your IP address, browser, and request logs in accordance with its own policy. GitHub Privacy Statement

The service providers above may process information on servers outside your country, including in the countries where they operate. The specific countries of processing, retention periods, deletion methods, and processing practices follow each provider's policy and your consent choices. The linked notices explain the providers' own processing. This policy does not promise a particular storage country or retention period where those have not been established for the service.

5. Retention and deletion

Active records and propagation

You can delete an individual expense or schedule item, a trip with its schedules and expenses, or all active trip records using Delete All Trip Data in Settings. Trip and all-trip deletion require confirmation that describes the selected records and whether deletion also reaches connected devices. This is not an erasure of all app settings, sync metadata, recovery history, or every photo.

A store never connected to sync deletes its active records locally. For a store already connected to sync, accepted deletions are retained for transmission even while sync is off or the device is offline. They can reach iCloud and other connected devices when synchronization resumes with the matching account. Propagation is not necessarily immediate. If ownership or recovery state is unsafe, deletion or sync can be blocked rather than being silently treated as device-only.

Deletion markers and recovery content

Synchronized deletion uses a retained deletion marker to prevent an old device from recreating a deleted record. Text deletion clears the normal trip, schedule, or expense content fields in that server record while retaining technical deletion information. A photo deletion update removes the active image-file field and its content hash and byte-count fields, while retaining its reference and deletion information. These updates are not a promise of immediate physical erasure from Apple's systems or backups.

Separately, app-private local sync metadata can retain full record content: pending saved changes, versions used for comparison, interrupted-apply checkpoints, and device, previously received iCloud, and base snapshots of a conflict. Conflict-resolution history can retain the original snapshots, discarded local content, the selected result, and processing status after a decision or copy recovery. These are not just content-free deletion markers. Such local recovery snapshots are not themselves separate CloudKit history records; an approved recovered copy or chosen result can be synchronized as a normal record.

There is no automatic time-based expiry for deletion evidence, retained conflict content, or resolution history. Unresolved content remains until a supported resolution or an explicitly confirmed decision to give it up. Completing a resolution does not by itself remove its retained content. No 30-day, 90-day, or other fixed deletion deadline is promised.

Selected retained content on this device

In builds providing retained-content management, Records to Review lets you review and confirm Delete Retained Content for one eligible resolved history. For a supported unresolved item, you can explicitly give up its retained content only after the app safely determines the resulting record state, such as accepting a currently verified iCloud result or deletion. This is not merely clearing a warning. Online verification, a changed record, incomplete work, or another recovery dependency can delay or block the action.

The action concerns the selected archival content in the storage connected to the current device, account, and sync environment. Once removed, that history cannot be used to recover its former content. Live records, recovered copies, and comparison versions or checkpoints still needed for safe saving and sync remain. A compact completion identifier, result linkage, and deletion protection can remain to prevent repeated recovery or resurrection; these technical identifiers are not guaranteed to be anonymous. Necessary dependencies are not removed just to report completion.

This control does not erase saved state from a previous development connection or another account or environment, independent backups, exported files, other devices, or all data in iCloud. Switching accounts does not erase those stores. Deleting active records is separate from deleting selected retained content. A comprehensive permanent-erasure procedure for all these locations has not been established or verified, and is not promised here.

Photos, protected transfers, and recovery

The app can remove an unreferenced local photo candidate after the related record change has been saved, but only when no other live record, transfer protection, or retained conflict or resolution history still needs it. Transfer protection is released after the applicable confirmed or safely cancelled operation; uncertain outcomes can keep it in place. There is no automatic orphan-protection sweep. Completed recovery does not release a reference still held by retained history, and an incoming remote photo deletion does not itself aggressively erase the local original. Some local originals and temporary transfer copies can remain; the app does not guarantee a deletion deadline for all copies.

Explicit retained-content removal considers only photo references released by the selected history, not every file in the photo folder. Before removing a candidate, the app checks live records, other histories, unfinished transfers and temporary transfer files, recovery protection, comparison versions, and other saved sync stores. If a dependency cannot be checked, the file stays protected. Content-state saving and photo-file removal are separate steps; cleanup may remain pending or partly protected and can resume after a failure or restart. A newly referenced or shared photo is not promised to be removed with the selected history.

Turning sync off, removing the app, and Apple storage

Turning iCloud Sync off stops new automatic sync requests and discards queued triggers. A previously approved operation already running can finish its durable work, including a remote write, before stopping; off is not an instantaneous cancellation or an iCloud erasure request. Explicitly requesting a connection review or an online conflict review can still contact Apple while automatic sync is off. Turning it off does not stop the separate external services in Section 4.

Removing the app normally removes its local sandbox data; offloading the app or retaining/restoring an OS backup can preserve data instead. Removing Tripin does not request deletion of its private CloudKit records. Data may become available again through a later approved connection. Tripin CloudKit sync, system Photos, iCloud Photos, and device backups have separate storage and deletion controls. Use Apple's available iCloud storage controls or support for the data Apple manages; this policy does not promise that a specific OS control erases all Tripin markers, backups, or copies immediately.

Retention of information processed by maps, advertising, exchange-rate, website, and email services follows the relevant provider's practices. For information the developer actually controls, such as messages you send for support, you can request access, correction, or deletion at the contact address below, subject to applicable obligations. The developer has no in-app administrative control to remotely inspect or erase every user's private iCloud database and does not promise to perform such an erasure on receipt of an email.

6. Your choices and rights

• You can change location permission at any time in the Tripin permission screen in iPhone Settings.
• You can change photo library and camera permission at any time in the Tripin permission screen in iPhone Settings.
• You can change whether Tripin is allowed to track under Settings > Privacy & Security > Tracking on your iPhone.
• You can use Settings > iCloud Sync to review a proposed connection, grant the applicable transfer approval, and turn ongoing sync on or off. Turning it off does not erase data already in iCloud; Section 5 explains pending work and deletion.
• You can edit or delete active trips, schedules, and expenses. Trip/all-trip confirmation describes the actual local or connected-device scope. Connected deletions may be applied on other devices later.
• In builds providing Records to Review, you can view locally retained conflict content offline without resolving it just by opening the list. Previously stored iCloud content is a historical copy, not a claim of the current server state. Some histories are read-only if safe action cannot be established.
• A supported record below a deleted trip can be recovered as a new copy in a valid trip; a supported deleted trip edit can become a new trip. This does not restore the original deleted identifier or erase its deletion evidence. Schedule/expense destinations must preserve the original trip's base currency; no arbitrary conversion is performed.
• For supported simultaneous edits of a still-live trip, schedule, or expense, the app offers Use This Device's Content, Use iCloud Content, or Later, with a complete result preview. Nonconflicting changes are retained. Online actions recheck the account, latest record, parent, and local state; changed or deleted records require another review or copy recovery instead of forced restoration.
• Copy recovery and resolution keep prior content in local history, including local content discarded when choosing iCloud. Missing originals, changed photo checksums, incompatible destination currency, unverified history, or unsafe pending state can prevent completion. Recovery is not guaranteed to be complete. Saving on this device and waiting to reach other devices are distinct from confirmation of the chosen result in iCloud; that confirmation does not certify that every photo or every other record has finished syncing.
• Where supported, you can select a retained history, review the stated local scope, and confirm Delete Retained Content, or explicitly give up unresolved content after reviewing the resulting record state. Cancelling does not remove the content. This removes access to the selected archival copy, not normal live records, other stores, or all iCloud data. Photos required elsewhere can remain, and pending or blocked cleanup is not complete erasure. Section 5 describes the boundaries and retained technical information.
• You can export the trip schedules and expenses stored on your device as an Excel, PDF, or CSV file using Export Data in Settings. The file is generated on your device; the exported file goes to the location or app you choose and is not sent to the developer.
• You can also save your trips, expenses, and schedules as a backup file (JSON) using Export Backup File in Settings, and merge such a file back using Import Backup File. The file is created and read on your device, does not include photos, goes only to the location or app you choose, and is not sent to the developer. Importing adds records and overwrites records with the same identifier; it does not delete existing records, and it is unavailable while iCloud sync is on.
• Delete All Trip Data removes active trip records, not all settings, retained recovery history, or every local/iCloud photo copy. See Section 5 before using it or removing the app.
• Where it is offered in your region, you can review or change your advertising consent from the privacy choices menu in the app.
• Use the contact address below for requests concerning information the developer controls or questions about app behavior. Use your own device/account controls and Apple's support for Apple-managed iCloud data. Do not send passwords, private sync files, or photographs unless you deliberately choose to share material needed for support.

7. Protection of information

Local records, sync state, protected image files, and recovery history are stored in the app's sandbox. Sync separates account and service-environment state, checks record versions before conditional updates, and verifies image bytes with content checksums. A checksum is an integrity check, not encryption or anonymization. Apple operates the private CloudKit storage and its service security; this app does not claim its own end-to-end encryption of these record fields or images, complete anonymity, or absolute inaccessibility.

App network requests use the relevant Apple SDK or HTTPS services. Storage, transmission, and provider controls cannot guarantee absolute security. Keeping records private in CloudKit does not eliminate processing by Apple's service or the separate advertising, map, and other services described above.

8. Children's privacy

Tripin is not a service designed for children, and does not knowingly collect personal information from children. If you believe that a child's personal information has been processed, please let the developer know at the contact address below.

9. Changes to this policy

This policy may be revised if the app's features, the external services it uses, or applicable law change. Significant changes will be announced on this page or through the app, and the effective date will be updated.

10. Contact

Please send questions about the handling of personal information to the email address below.

sehwani87@gmail.com