1. 這是誰的 app

Tripseki 旅跡（以下稱「Tripseki」或「我們」）是一個由個人開發、用來整理旅程的 app，包含 iOS 版與網頁版 tripseki.com。資料的處理者與聯絡窗口是開發者本人：eederhsu@gmail.com。

這份政策寫的是 app 實際上做的事。如果你發現任何一條與 app 的行為不符，請寫信告訴我們，我們會更正政策或更正程式。

2. 我們保存哪些資料

2.1 帳號

你用 Google 或 Apple 登入時，我們向登入服務取得並保存：

• email（作為帳號的唯一識別）；
• 顯示名稱；
• 頭像圖片的網址（有的話）。

我們不會拿到你的 Google 或 Apple 密碼。用 Apple 登入並選擇「隱藏我的電子郵件」時，我們保存的就是 Apple 給的轉寄地址。登入頁的「使用帳號密碼登入」只供 App Store 審核用的示範帳號使用；一般帳號沒有密碼，我們也不保存任何密碼。

帳號上另外會存你在「我」頁面設定的顯示幣別，以及一個用來認轉寄信的專屬信箱代碼（見 2.3）。

2.2 你放進旅程的內容

這是 app 的核心，全部由你（或同一個旅程的成員）輸入：

• 旅程名稱、日期、目的地、預算與基準幣別；
• 行程項目：航班、住宿、餐廳、活動、交通等，含時間、地點、備註；
• 訂位資訊：訂位代號 / 確認碼、票價；
• 花費紀錄（金額、幣別、分類、誰付的）；
• 待辦清單；
• 文件與附件：你上傳的 PDF、圖片、票券等檔案（檔案本身存在我們的資料庫）；
• 心得：每個項目的評分與事後筆記；
• 你和 AI 助理在該旅程裡的對話紀錄。

2.3 轉寄進來的訂位信

登入後你會拿到一個專屬的轉寄地址。把訂位確認信轉寄到那裡，信會經由電子郵件收件服務送到我們的伺服器。我們保存：

• 寄件人地址與主旨；
• 去掉轉寄殼與引文後的純文字內文；
• 信裡的附件（例如 PDF 票券）；
• 解析出來的結果與狀態。

只有那封被轉寄的信會進來——我們沒有、也不要求任何讀取你信箱的權限。身分靠地址裡的代碼判定，所以請把這個地址當成密碼看待，不要公開貼出。信一送到就會自動解析：看起來像訂位確認、而且日期剛好落在你某一趟旅程裡的信，會自動歸進那趟旅程成為待確認項目，附件也會一併放進該旅程的文件；其他的留在收件匣等你指派。指派或歸檔後，信仍留在你的收件匣作為紀錄，你可以隨時刪除。

2.4 推播與裝置

你允許推播通知後，我們保存 Apple 發給這台裝置的推播 token（以及它是正式或沙盒環境、平台名稱、最後使用時間）。這些 token 只能用來送通知，不能反查你是誰或你在哪。

2.5 我們刻意不收集的

• 手機定位：app 不要求定位權限。「足跡」地圖上的航線是從你行程裡的航班機場算出來的，不是 GPS。
• 通訊錄、相簿全部內容：只有你主動選來匯入的那張圖片會被上傳。
• 行為分析 / 廣告追蹤：app 內沒有任何分析或廣告 SDK，也沒有第三方追蹤碼。

伺服器有一般的請求紀錄（時間、路徑、狀態碼，以及連線來源 IP），只用來排除故障，不做行為分析，並定期滾動清除。

2.6 你連結的第三方助理

你在同意頁授權一個外部 AI 助理（例如 ChatGPT、Claude）後，我們保存這筆連線：助理自報的名稱、你給的權限（只讀，或讀取＋編輯）、旅程範圍（全部，或你指定的旅程）、建立時間與最後使用時間，並在你的通知裡留下一則「已連結」通知。連線的長期憑證（refresh token）與授權碼只以雜湊保存；助理每次換發憑證後約一分鐘內，我們會暫存一份加密的新憑證，讓逾時重送的同一個請求拿到同一份回應，之後即刪除（清除前做的資料庫備份可能包含這份加密副本）。它的用途與會拿到的資料見第 4 節。

2.7 變更紀錄與刪除的項目

行程項目每次被新增、修改、移動、刪除或還原，我們都會記下誰、何時、透過什麼（app、助理、匯入或轉寄信；是助理的話也記下助理名稱）以及改了什麼，讓同一個旅程的成員和助理知道發生過什麼。刪除一個項目時，我們另外保存一份可還原的副本，包含它綁定的花費與附件檔案，30 天內可以還原（目前透過你連結的助理的還原功能）。保存多久見第 6 節。

3. 我們拿這些資料做什麼

• 把你的旅程顯示回來給你，以及給你邀請的成員；
• 在你的裝置上保留最近一次同步的副本，讓你沒有網路時也能查看（見第 8 節）；
• 解析截圖、貼上的文字與轉寄信，產生待確認的行程項目；
• 用行程裡的航班號碼和日期查詢即時航班狀態，並在延誤、改登機門等情況通知你；
• 回答你在 AI 助理裡問的問題；
• 讓你自己連結的外部助理，依你給的權限讀取或修改你選的旅程；
• 把不同幣別的花費換算成大概的合計。

沒有別的用途。我們不會用你的資料做廣告投放、不會賣給任何人，也不會拿去訓練模型。

4. 資料會交給哪些服務

以下是我們實際使用的第三方服務。表格寫的是各自會拿到什麼：

除了這些，我們不會把你的資料交給任何第三方，除非法律要求。app 存在你裝置上的離線副本（第 8 節）不會送到上表或任何其他服務。

4.1 第三方助理連結

要不要連結助理、連結哪一個，完全由你自己選擇並授權；我們不會主動把資料送給任何助理。授權之後：

• 助理會讀到所選旅程中其他成員建立的內容，並傳到該助理的服務。他人項目的結構化訂位代號欄位會遮蔽；自由文字（標題、備註等）裡的代號不保證辨識。
• 預設只給「讀取」。你另外勾選「也允許編輯行程」，助理才能新增、修改、移動、刪除、還原行程項目，以及新增和勾選待辦；它的權限永遠不超過你在該旅程的角色，檢視者連上的助理也只能讀。刪除項目會連同它綁定的花費與附件一起刪除（30 天內可還原）。
• 助理不能刪除旅程、管理成員、開公開分享、上傳文件或記花費。
• 旅程裡可能有人寫進想引導助理的文字（例如共享旅程的備註、轉寄進來的信）。助理照著做時，用的是你的權限。我們會把這些內容標示為資料而不是指令，但無法控制外部助理的行為；對共享旅程建議只給讀取，或只選擇需要的旅程。
• 你隨時可以在「我」→「已連結的助理」斷開連線，斷開後助理的下一次請求就會被拒絕。還沒更新的 iOS 版本看不到這個清單，請到網頁版 tripseki.com 的「我」頁操作。
• 資料送到助理服務之後，如何保存與使用依該服務的政策；已經送出的內容，我們無法替你從對方那裡刪除。

5. 跟旅程成員共享時，他們看得到什麼

你邀請別人加入旅程時，是把整個旅程分享出去。不論角色是擁有者、編輯者或檢視者，成員都看得到該旅程裡的：

• 全部行程項目，包括訂位代號與確認碼；
• 花費、預算、待辦；
• 文件與附件；
• 心得評分與筆記；
• 該旅程的 AI 助理對話；
• 彼此的顯示名稱與頭像。

角色只決定能不能改，不決定能不能看。你的轉寄收件匣本身是私人的，別人看不到信件內容；但一封信被指派（或依日期自動歸進）某個共享旅程後，它解析出的項目與附件就會出現在該旅程裡，成員都看得到。邀請前請想清楚要分享的內容。

成員也可以連結他自己的外部助理（見 4.1）。這時你在共享旅程裡建立的項目，也會被讀到並傳到他選的助理服務；其中結構化的訂位代號欄位會遮蔽，自由文字不保證辨識。

每位成員的 iOS app 也會在他自己的裝置上保留一份最近同步的旅程副本，供離線查看（見第 8 節）。你把成員移出旅程或刪除旅程後，對方裝置上的副本要等他的 app 下次連上網路同步時才會刪除；在那之前，他仍可在 app 裡看到移出前已經同步的內容（最長 30 天）。同樣地，你修改或刪除的內容，要等其他成員的 app 下次連上網路重新載入時，才會在他們的副本裡更新。

6. 資料放多久

• 通知（延誤、登機門變更等）：舊通知會定期清理。
• 其他所有資料：保留到你自己刪除它，或刪除整個帳號為止（刪除的行程項目例外，見下一條）。刪掉一個旅程會連同它的行程、文件、花費、對話、變更紀錄與尚未清除的刪除副本一起刪掉。
• 刪除的行程項目：刪除後 30 天內可以還原。期限一到就不能再首次還原，保存的副本與附件檔案由伺服器定期執行的自動清理從資料庫永久移除（分批進行，可能比期限晚一點才清完；資料庫備份裡的舊副本依下方的備份輪替淘汰）。期限內還原過的，還原出的項目是新的目前資料；原本那份副本仍按原來的期限清除，不會因為還原而延長。
• 變更紀錄：保留到旅程被刪除為止。某個項目的刪除副本到期清除時，這個項目的全部變更紀錄也同時縮減成只剩類型、標題與日期的最小摘要。
• 仍然存在的資料不受上述清除影響：還原出來的項目，以及原本釘在項目上的文件（文件是旅程裡獨立的一份，刪項目時不會跟著刪），都是一般的目前資料，保留到你刪除為止。
• 助理連線：斷開後憑證立即失效；連線紀錄（助理名稱、權限、時間）保留作為稽核，直到你刪除帳號。
• 推播 token：Apple 回報該裝置已失效時停用；刪除帳號時一併刪除。
• 裝置上的離線副本：依第 8 節的規則刪除，不適用上面的期限。在伺服器上修改或刪掉的內容，會在各成員的 app 下次連上網路重新載入時從副本更新或移除；沒有再更新的部分，最長保留 30 天。

資料庫備份會依主機服務的設定自然過期，我們不另外承諾期限。已經清除的刪除副本，仍可能存在清除之前做好的每日資料庫備份裡，隨備份輪替淘汰（目前每日備份保留 30 天）。

7. 刪除帳號

在 app 裡：「我」→「刪除帳號」。這是真的刪除，沒有「停用後可復原」的狀態：

• 你的帳號、專屬轉寄地址、收件匣裡的信、裝置 token、通知全部刪除；
• 這台裝置上的離線副本立即刪除；你仍登入著的其他裝置，會在下次連上網路時登出並刪除副本；
• 你連結的助理全部斷開，連線紀錄一併刪除；
• 你在仍有其他成員的旅程裡留下的變更紀錄與刪除副本，會移除指向你帳號的引用（改為不具名）；內容屬於那個旅程，隨旅程保留；
• 你擁有、而且只有你一個成員的旅程，連同裡面的一切一起刪除；
• 你擁有、但還有其他成員的旅程，會移交給其中一位成員（優先是最早加入的編輯者），你的成員身分被移除。共同旅伴的行程不會因為你離開而消失。

如果你想在刪除前拿到自己資料的匯出，或是有任何無法在 app 內完成的請求，寫信到 eederhsu@gmail.com。

8. 安全

app 與伺服器之間全程使用 HTTPS。登入後的身分以簽章 token 保存在你的裝置上。所有第三方服務的金鑰只存在伺服器端，不會放進 app。上傳的檔案存在資料庫中，只有該旅程的成員能透過驗證後的 API 取得。

為了讓你沒有網路時也能查看行程，iOS 版 app 會在這台裝置上保存一份最近一次同步的副本，也就是 app 最近從伺服器載入過的這些資料：你的帳號（email、顯示名稱、頭像網址、顯示幣別與語言）；你所在的旅程清單（名稱、日期、預算與花費合計）；每個旅程的成員（顯示名稱、頭像網址與角色，不含他們的 email）；行程項目，包括訂位代號／確認碼、座位與航廈、住宿地址、備註、心得與綁定的花費，也包括其他成員建立的項目；花費（含備註與誰付的）與待辦；文件與附件的清單（標題、檔名、類型與大小，不含檔案本身）；足跡統計；參考匯率；以及最後一次查到的航班狀態（不含飛機位置）。進行中與即將出發的旅程會預先載入（最多 8 趟）；其他旅程只有 app 在線上時載入過的部分才會在副本裡，例如你打開過的旅程。你的專屬轉寄地址、收件匣裡的信、通知、已連結的助理、AI 助理對話、待確認的匯入結果、邀請與公開分享連結，以及文件和附件的檔案本身，都不會存進副本。副本只存在 app 自己的儲存空間，不會送到任何服務；它受裝置的螢幕鎖保護，但你的裝置若有 iCloud 或電腦備份，備份裡可能也有它。網頁版不在裝置上保存副本：只在分頁開著的期間暫存於記憶體，重新整理或關閉分頁就清空，也不會預先載入。

你在這台裝置上登出、刪除帳號，或改用另一個帳號登入時，副本立即刪除。登入因為其他原因失效時（例如登入到期，或你在另一台裝置上刪除了帳號），副本會在 app 下次連上網路時刪除。超過 30 天沒有更新的部分不再顯示，並在 app 下次開啟時刪除。你在這台裝置上退出或刪除的旅程立即從副本移除；你被移出、或被別人刪除的旅程，會在 app 下次連上網路同步時移除。刪除 app 也會一併刪除副本。這些規則只涉及離線副本；語言等存在裝置上的偏好設定不受登出影響。

外部助理的連線使用另外一組憑證：與 app 的登入憑證用不同金鑰簽章、彼此不能互用；長期憑證只存雜湊，只有換發後約一分鐘內會另存一份加密的新憑證供重送使用、之後刪除；每次請求都會確認連線沒有被斷開、你仍是該旅程的成員且角色足夠。

話說在前面：沒有任何系統能保證絕對安全。這是個人維護的服務，請不要把它當成護照掃描或信用卡資訊的唯一備份。

9. 兒童

Tripseki 不是為 13 歲以下的兒童設計的，我們也不會刻意收集他們的資料。若你認為有兒童在未經同意下建立了帳號，請聯絡我們，我們會刪除。

10. 你的權利

你隨時可以在 app 內查看、修改、刪除自己輸入的所有資料，並依第 7 節刪除帳號。若你要求查閱、更正、匯出或刪除我們持有的資料，或對處理方式有任何疑問，請寫信給我們，我們會在合理時間內回覆。

11. 政策變更

app 的功能改變時，這份政策也會跟著改，並更新頁首的生效日期。重大變更（例如新增一個會拿到你資料的服務）會在 app 內提示。需要舊版本的話，寫信給我們就會提供。

12. 聯絡

開發者：eederhsu · eederhsu@gmail.com

Privacy Policy

Effective 18 October 2026 · Terms of Service

This is the English version of the policy above. The two say the same thing; if they ever differ, the Traditional Chinese text is the one we maintain first.

1. Who we are

Tripseki 旅跡 ("Tripseki", "we") is a trip-organising app built and run by an individual developer, available as an iOS app and on the web at tripseki.com. The data controller and contact is the developer: eederhsu@gmail.com.

This policy describes what the app actually does. If you find anything here that does not match the app's behaviour, tell us and we will fix the policy or the code.

2. What we store

2.1 Your account

When you sign in with Google or Apple we receive and keep your email address (the account's identity), your display name, and your avatar image URL if there is one. We never see your Google or Apple password. If you use Apple's "Hide My Email", the relay address is what we store. The "sign in with email and password" form on the login screen only works for the App Store review account; regular accounts have no password and we store none.

Your account also holds the display currency you pick on the Me screen and a secret forwarding token used to recognise your forwarded emails (see 2.3).

2.2 What you put into a trip

All of this is entered by you or by members of the same trip:

• trip title, dates, destination, budget and base currency;
• itinerary items — flights, stays, dining, activities, transport — with times, places and notes;
• booking details, including confirmation codes and fares;
• expenses (amount, currency, category, who paid);
• to-do lists;
• documents and attachments you upload — PDFs, images, tickets (the file bytes themselves are stored in our database);
• ratings and after-the-fact notes on each item;
• your conversation with the AI assistant inside that trip.

2.3 Forwarded booking emails

After signing in you get a personal forwarding address. Emails you forward there reach our server through an inbound email service. We keep the sender address and subject, the plain-text body with forwarding chrome and quoted text stripped, any attachments (such as PDF tickets), and the parsed result and its status.

Only the emails you forward come in — we do not have, and never ask for, access to your mailbox. Identity is decided by the token in the address, so treat that address like a password and do not post it publicly. Emails are parsed automatically on arrival: one that looks like a booking confirmation and whose dates fall inside exactly one of your trips is filed into that trip as items to confirm, with its attachments added to that trip's documents; anything else waits in your inbox for you to assign. Either way the email stays in your inbox as a record and you can delete it at any time.

2.4 Push notifications and devices

If you allow notifications we store the push token Apple issues for your device (plus whether it is a production or sandbox token, the platform, and when it was last seen). These tokens can only be used to deliver notifications; they cannot identify you or your location.

2.5 What we deliberately do not collect

• Device location: the app never requests location permission. The routes on the Footprint map are computed from the airports of the flights in your itinerary, not from GPS.
• Contacts or your whole photo library: only the single image you choose to import is uploaded.
• Analytics or advertising tracking: there is no analytics or advertising SDK in the app and no third-party tracking code.

The server keeps ordinary request logs (time, path, status code and the connecting IP address) for troubleshooting only, not for behavioural analysis; they are rolled over regularly.

2.6 Third-party assistants you connect

When you authorize an outside AI assistant (such as ChatGPT or Claude) on the consent page, we keep that connection: the name the assistant gives itself, the permission you granted (read only, or read and edit), the trip range (all trips, or the ones you picked), when it was created and last used, and an "assistant connected" notification in your inbox. The connection's long-lived credential (its refresh token) and authorization codes are stored only as hashes. For about a minute after each refresh we keep an encrypted copy of the new credentials, so a retried request gets the same answer; then it is deleted (a database backup taken in that window can contain the encrypted copy). What it is used for and what it receives is in section 4.

2.7 Change history and deleted items

Every time an itinerary item is added, changed, moved, deleted or restored, we record who did it, when, through what (the app, an assistant — with the assistant's name — an import, or a forwarded email) and what changed, so the members of a trip and their assistants can see what happened. When an item is deleted we also keep a restorable copy, including its linked expense and attachment files, for 30 days (restoring currently happens through the restore function of an assistant you connected). How long each part is kept is in section 6.

3. What we use it for

• showing your trips back to you and to the members you invite;
• keeping a copy of your most recently synced data on your device so you can read it without a connection (see section 8);
• parsing screenshots, pasted text and forwarded emails into itinerary items for you to confirm;
• looking up live flight status by flight number and date, and notifying you of delays, gate changes and the like;
• answering what you ask the AI assistant;
• letting an outside assistant you connected read or change the trips you picked, within the permission you gave it;
• converting expenses in different currencies into an approximate total.

Nothing else. We do not use your data for advertising, sell it to anyone, or use it to train models.

4. Services your data is shared with

These are the third-party services we actually use. The table says what each one receives:

Beyond these we do not hand your data to any third party unless the law requires it. The offline copy the app keeps on your device (section 8) is not sent to any of these services or anywhere else.

4.1 Connecting a third-party assistant

Whether to connect an assistant, and which one, is entirely your choice and your authorization; we never send data to an assistant on our own. Once you authorize one:

• the assistant reads content other members created in the trips you picked, and it is sent to that assistant's service. The structured booking-code field of other members' items is masked; codes in free text (titles, notes and so on) are not guaranteed to be recognised;
• it can only read by default. Only if you also tick "Also allow editing trips" can it add, change, move, delete and restore itinerary items and add and tick to-dos — and never beyond your own role in that trip: an assistant connected by a viewer can only read. Deleting an item deletes its linked expense and attachments with it (restorable for 30 days);
• it cannot delete trips, manage members, create public share links, upload documents or record expenses;
• someone may write text into a trip meant to steer an assistant (a note in a shared trip, a forwarded email). If the assistant follows it, it acts with your permission. We label trip content as data, not instructions, but we cannot control an outside assistant; for shared trips we suggest read-only access, or picking only the trips it needs;
• you can disconnect at any time under Me → Connected assistants, and its next request is refused. iOS versions that have not been updated do not show that list — use the Me page on the web at tripseki.com;
• once data reaches the assistant's service, how it is kept and used is governed by that service's policy; we cannot delete what was already sent there on your behalf.

5. What trip members can see

Inviting someone to a trip shares the whole trip. Whether their role is owner, editor or viewer, a member can see that trip's:

• every itinerary item, including booking and confirmation codes;
• expenses, budget and to-dos;
• documents and attachments;
• ratings and notes;
• the trip's AI assistant conversation;
• each other's display names and avatars.

Roles decide who can change things, not who can see them. Your forwarding inbox itself is private — nobody else sees the email contents — but once an email is assigned to (or automatically filed by date into) a shared trip, the items and attachments parsed from it appear in that trip for every member. Think about what you are sharing before you invite.

A member can also connect their own outside assistant (see 4.1). The items you created in a shared trip are then read by it and sent to the assistant service they chose; the structured booking-code field is masked, free text is not guaranteed to be.

Each member's iOS app also keeps a copy of the trips it last synced on their own device so they can read them offline (see section 8). After you remove a member or delete a trip, the copy on their device is deleted the next time their app connects and syncs; until then they can still see in the app what had synced before the removal (for at most 30 days). In the same way, what you change or delete is updated in other members' copies the next time their app connects and reloads it.

6. How long we keep it

• Notifications (delays, gate changes and so on): old notifications are cleaned up periodically.
• Everything else: kept until you delete it or delete your account (deleted itinerary items are the exception, see the next point). Deleting a trip deletes its items, documents, expenses, conversation, change history and any deleted-item copies not yet purged with it.
• Deleted itinerary items: restorable for 30 days after deletion. Once that deadline passes, a first restore is refused, and the kept copy and its attachment files are permanently removed from the database by an automatic cleanup the server runs regularly (in batches, so it may finish a little after the deadline; older copies in database backups age out with the backup rotation described below). If an item was restored in time, the restored item is new, current data; the original copy is still purged on its original deadline — restoring does not extend it.
• Change history: kept until the trip is deleted. When a deleted item's copy is purged, that item's whole change history is reduced at the same time to a minimal summary of its kind, title and date.
• Data that still exists is not affected by those purges: a restored item, and a document that was pinned to an item (a document is its own record in the trip and is not deleted with the item), are ordinary current data, kept until you delete them.
• Assistant connections: disconnecting invalidates the credentials at once; the connection record (assistant name, permission, times) is kept for audit until you delete your account.
• Push tokens: disabled when Apple reports the device gone; deleted with the account.
• The offline copy on a device is deleted under the rules in section 8, not the periods above. Content changed or deleted on the server is updated in, or removed from, each member's copy the next time their app connects and reloads it; anything not updated again is kept for at most 30 days.

Database backups expire on the hosting service's own schedule; we make no separate promise about that window. A deleted-item copy that has been purged can still exist in the daily database backups taken before the purge, until those backups rotate out (daily backups are currently kept for 30 days).

7. Deleting your account

In the app: Me → Delete account. This is a real deletion — there is no deactivated state to come back from:

• your account, forwarding address, inbox emails, device tokens and notifications are deleted;
• the offline copy on this device is deleted at once; any other device where you are still signed in is signed out, and its copy deleted, the next time it connects;
• every assistant you connected is disconnected and its connection record deleted;
• in trips that still have other members, the change history and deleted-item copies you left behind lose their reference to your account (they become anonymous); the content belongs to that trip and stays with it;
• trips you own where you are the only member are deleted with everything in them;
• trips you own that still have other members are handed over to one of them (the longest-standing editor first) and your membership is removed. Your co-travellers' itinerary does not disappear because you left.

If you want an export of your data before deleting, or have any request the app cannot handle, write to eederhsu@gmail.com.

8. Security

All traffic between the app and the server uses HTTPS. Your signed-in identity is a signed token kept on your device. Keys for every third-party service live only on the server and are never shipped in the app. Uploaded files are stored in the database and are only served to members of that trip through the authenticated API.

So you can read your trips without a connection, the iOS app keeps a copy of the most recently synced data on this device — what the app last loaded from our server: your account (email address, display name, avatar URL, display currency and language); the list of trips you belong to (titles, dates, budgets and spending totals); each trip's members (display names, avatar URLs and roles, not their email addresses); itinerary items, including booking and confirmation codes, seats and terminals, stay addresses, notes, ratings and linked expenses, and items other members created; expenses (with notes and who paid) and to-dos; the list of documents and attachments (titles, file names, types and sizes, not the files themselves); your footprint statistics; reference exchange rates; and the last flight status the app looked up (without the aircraft's position). Trips in progress and upcoming trips (up to 8) are loaded in advance; of any other trip, the copy holds only what the app loaded while online, such as a trip you opened. Your forwarding address, inbox emails, notifications, connected assistants, assistant conversations, unconfirmed import results, invite and public share links, and the document and attachment files themselves are not kept in it. The copy stays in the app's own storage and is not sent to any service; it is protected by your device's screen lock, but if your device is backed up to iCloud or a computer, the backup may include it. The web version keeps no copy on your device: it holds one in memory only while the tab is open, clears it when the tab is reloaded or closed, and loads nothing in advance.

The copy is deleted at once when you sign out, delete your account, or sign in with a different account on this device. If your sign-in ends any other way (it expires, or you delete your account from another device), the copy is deleted the next time the app connects. Anything not updated for 30 days is no longer shown and is deleted the next time the app opens. Trips you leave or delete on this device are removed from the copy at once; trips you were removed from, or that someone else deleted, are removed the next time the app connects and syncs. Deleting the app deletes the copy too. These rules cover the offline copy only; preferences kept on the device, such as language, are not affected by signing out.

Connections to outside assistants use separate credentials, signed with a different key from the app's sign-in tokens so neither works in place of the other; long-lived credentials are stored only as hashes, apart from an encrypted copy of freshly issued credentials kept for about a minute so a retried refresh gets the same answer, then deleted; and every request checks that the connection has not been revoked and that you are still a member of the trip with a sufficient role.

To be plain: no system is perfectly secure. This is a service maintained by one person — please do not make it the only copy of your passport scan or card details.

9. Children

Tripseki is not designed for children under 13 and we do not knowingly collect their data. If you believe a child has created an account without consent, contact us and we will delete it.

10. Your rights

You can view, edit and delete everything you entered from inside the app at any time, and delete your account as described in section 7. To access, correct, export or erase data we hold, or to ask anything about how it is handled, email us and we will respond within a reasonable time.

11. Changes

When the app changes, this policy changes with it and the effective date at the top is updated. A material change — such as a new service that receives your data — will be announced in the app. Earlier versions are available on request by email.

12. Contact

Developer: eederhsu · eederhsu@gmail.com