Privacy Policy of the TripHar App

This page sets out what data the TripHar app processes, what for, who sees it, how long we keep it and what rights you have. Last updated: ENTER DATE. For the website, the website privacy policy also applies.

1. Who is responsible

Manuel Harrer, Lilienweg 1, 4064 Oftering, Austria.
Privacy questions and requests: privacy@triphar.com · Help with the app: support@triphar.com · Further details in the legal notice.

We have not appointed a data protection officer; we are not required to do so (to be checked).

2. What data, what for, on what legal basis

“Contract” means: we need the data to provide the app to you in the way you use it (Art. 6(1)(b) GDPR). “Consent”: Art. 6(1)(a), for specially protected data Art. 9(2)(a) — can be withdrawn at any time. “Legitimate interest”: Art. 6(1)(f) — you can object (see Your rights). “Legal obligation”: Art. 6(1)(c).

We use no tracking, no advertising tools, no third-party crash reporting and no contact syncing. Only when you pay by card or Apple Pay in the app (guide tours) does Stripe’s payment module record how it is used and check for fraud (see Recipients). We count how often place pages are opened and buttons are tapped — without storing who; a shortened marker against double counting is deleted after two days. Businesses only see these numbers from 5 per day or per 30 days. Others can search for you only by name and handle, not by phone number or email.

3. What others see

• Everyone who is signed in: your public profile (name, handle, picture, bio, links, interests, the country you live in if you chose one (shown as a flag), points, level, streaks, badges, follower counts, whether you have confirmed your phone number) and everything you share publicly. Your rank on the leaderboard and, if you review restaurants, among the “Top foodies” of a city (how many restaurants there you have reviewed in the last 12 months) — unless you switch off “Show me on the leaderboard”.
• Trips are public, followers only or private — you set this for each trip. Upcoming trips are followers only by default, so that strangers can’t see when you are away. Private trips are seen only by you and your travel companions. Budget, expenses and packing lists are only ever seen by the travel companions.
• “Open to dating” is something you switch on yourself (18+, with a separate confirmation). It is not shown on your profile; it can only be seen while you are visible to other travellers in your city. Switching it off withdraws it immediately.
• Never visible to others: date of birth, gender and request filter, emergency contacts, diet and needs, home location, travel preferences, when you were last active, your settings, whether you belong to the moderation team and who on the team made a decision, your trust score (seen only by you, our moderation team and anyone who has a meetup request or a meetup with you — shown only once you have had at least 3 meetups, and never to people you have blocked).
• Messages are seen only by the participants in the conversation.
• Reviews are public. People who follow you see at a place that you have been there (“3 people you follow were here”), and get a notification if you rate a place on their wishlist highly. Nobody but you sees tables you add and places you follow.

4. Location

TripHar uses your location only while you are using the app — and only if you allow it. In the background only for route recording, if you switch it on for a trip yourself (see below).

Route recording (optional, on your device only). If you switch on “Record route automatically” for a trip, TripHar continuously stores your precise location with time and accuracy during the trip period (from the start day to the end of the end day; without an end date until you complete the trip, at most 30 days), even while the app is in the background. iOS shows this with the blue location indicator. Recording is off by default, and you can pause or switch it off at any time. The data stays on your device only: it is not transferred to TripHar or to third parties and is not included in your iCloud backup. It is only used to show you your route on the trip route. Others do not see your route in the app. If you share the trip route yourself as an image, story or post, an image of the simplified route is uploaded and treated like your other posts; TripHar leaves out the start and the end as well as the surroundings of places where you stayed longer (such as your accommodation or home) within a radius of about 500 m. You can delete the track per trip; when you delete the trip, sign out or delete your account, TripHar removes all tracks from the device. Legal basis: your consent by switching it on (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching it off; storage on your device at your express request (§ 165(3) of the Austrian Telecommunications Act 2021, TKG). PRÜFEN (Anwalt): Rechtsgrundlage.

Mutual: You only see other travellers nearby while you show yourself. If you are visible to everyone, you see everyone who is visible to everyone, plus the “followers only” check-ins of people you follow; if you are only visible to your followers, you only see people you follow who also follow you (however they are visible). Our server compiles this list: it matches who you follow and who follows you, and only passes on these people. The same applies to “… is nearby right now” notices. That way nobody watches without being seen.

5. tripHARRY and other AI features

With your consent

tripHARRY is an AI from our provider Anthropic (USA). Before he does anything for you for the first time, the app asks whether you agree. With your yes, the following goes to Anthropic: what you write to tripHARRY and the photos you send, your travel preferences and your home location, your trips and saved places, in companion mode your approximate location (approx. 100 m), what tripHARRY remembers about you (only with memory switched on), and for captions the place and keywords of your Trippy. Under its contractual terms, Anthropic does not use this data to train its models.

• Diet and needs (e.g. halal, kosher, allergies, accessibility) are only given to tripHARRY with a second, separate yes.
• Group trips: If you ask tripHARRY in the group chat, your question and the latest messages from travel companions who have also allowed tripHARRY go to Anthropic. Other people’s preferences only if they have switched on “Include me in group-trip planning”. Anyone who was not included receives a notice at most every 30 days.
• Memory: Only if you switch on “Harry may remember things” (off by default) does tripHARRY remember a short summary of your preferences. You can see and delete it under Settings → “tripHARRY & your data”. If you switch it off, tripHARRY no longer reads from or writes to the memory; if you withdraw your yes for diet and needs, we delete it.
• Withdrawal: at any time under Settings → “tripHARRY & your data”. After that nothing more goes to Anthropic, and the memory is deleted.

Without consent (legitimate interest)

To protect the community from harassment, spam and illegal content, an AI from Anthropic automatically checks texts that become public or visible to others: reviews, Trippy texts, comments, status posts, Story texts and submitted events. It also translates and summarises public reviews (“What travelers say”). We store a review’s translations with the review, so they aren’t created again for every reader, until the review is changed or deleted. The AI only flags; whether content is removed is decided by moderation (see Moderation). A flagged review does not, however, count towards the Foodie badge and a venue’s dish tips. Requests to businesses are only pre-screened automatically if you have consented to the AI; if the AI clearly considers a request to be spam or off-topic, we show you a warning with the reason. If you send it anyway, the request goes to the business, and our team sees a copy to check the AI (subject, text, the AI’s reason). We delete it 12 months after the review, after 90 days if it is not reviewed, and immediately if you delete your account (see section 9). The business learns nothing about the warning. Before your first public text, we point this out to you in the app. You can object to this processing (privacy@triphar.com).

Transfer to the USA: on the basis of the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) in the data processing agreement with Anthropic. Anthropic is not certified under the EU-US Data Privacy Framework (list at dataprivacyframework.gov, accessed on 19 October 2026: no entry, neither active nor inactive). DPF FOR ANTHROPIC NOT CONFIRMED — CHECK THE LIST AGAIN BEFORE PUBLICATION According to Anthropic, it deletes requests and responses within 30 days; if content violates its usage policies, it keeps them for up to 2 years.

6. Specially protected data

• Diet and needs (religion, health): voluntary and stored only with your explicit consent (tick box when you enter them, Art. 9(2)(a) GDPR). Visible only to you, given to tripHARRY only with a further, separate yes. In the app they preselect the diet filter for restaurants — this happens only on your device. If you remove the tick, we delete the details.
• “Open to dating”, gender and request filter may allow conclusions to be drawn about your sex life. All three are private. Gender and filter only determine who may send you requests and which open meetups (“Women only”/“Men only”) you can join; our server checks this on the basis of what you have stated (self-declaration), and hosts don’t learn it.
• Steps from Apple Health: only if you explicitly tap “Add steps” on a trip. Only the total number of steps during the travel dates is read; it is visible to everyone who can see the trip. You can remove it at any time.
• ID check before the first payout (via Stripe Identity, not yet active) DRAFT FOR THE LAWYER (B21): WORDING, ROLE OF STRIPE (PROCESSOR OR INDEPENDENT CONTROLLER FOR THE BIOMETRICS), RETENTION PERIOD AT STRIPE, MANUAL ALTERNATIVE
  • What for: Before we pay out money to you for the first time (cashback, creator cash), we check once that it is really you and that you are at least 18 years old.
  • How: The check is carried out by Stripe (Stripe Payments Europe Ltd., Ireland). You take a photo of your ID document and a selfie; Stripe compares your face with the photo in the ID document. This is biometric data (Art. 9 GDPR). We only process it with your explicit consent (Art. 9(2)(a) GDPR), which we obtain in the app immediately before the check starts.
  • What we receive: only the result (checked yes/no) and the date. We neither see nor store the image of your ID, the selfie or the facial data.
  • How long: with us, “checked” with the date, for as long as your account exists. At Stripe ENTER RETENTION PERIOD AT STRIPE (STRIPE CONTRACT/DPA, “IDENTITY DATA RETENTION”) — SUGGESTION: HAVE IT REDACTED IMMEDIATELY AFTER THE CHECK. If you delete your account, we have the recordings at Stripe deleted (redacted).
  • Withdrawal: at any time by email to privacy@triphar.com; we then have the recordings at Stripe deleted. Checks carried out until then remain lawful (Art. 7(3) GDPR). LAWYER: MAY “CHECKED” REMAIN AFTER THE WITHDRAWAL (OTHER LEGAL BASIS)?
  • Without consent: You don’t have to agree; your cashback remains yours, but it won’t be paid out without the check. Would you rather not have your face compared? Then we check your ID by hand (a photo showing only your name and date of birth, deleted immediately after the check; email support@triphar.com). DECISION MANUEL + LAWYER: IS THE MANUAL CHECK SUFFICIENT AS AN ALTERNATIVE?

7. Age and minors

When you sign up, we ask for your date of birth. It remains private and can only be changed via support.

Minimum age for the app: 18. If you enter a date of birth when signing up that makes you younger, you won’t get an account: we don’t store the date and delete the sign-up immediately. There is no block on the device. If it turns out that the holder of an existing account is under 18, we don’t delete the account but put it on hold until their 18th birthday: in that case we store the date of birth and the day on which the block ends. Until then the app only shows a notice; meetup features, location and push notifications are off, and the account doesn’t appear on the leaderboard. The profile and anything already shared remain visible. You can delete the account yourself at any time. If the date of birth is wrong, we only lift the block with proof: a photo of an ID card, passport or driving licence on which only the name and date of birth are visible. We look at it, delete it immediately afterwards and only store that proof was checked — no image, no face comparison.

Doubts about age: If someone tells us that you are not yet 18, we ask you first. If we still have justified doubts after that, we block the features where you meet strangers (Meetups, open meetups, “Nearby now”, visible check-ins, city presence, “Open to dating”) until you prove your age. Until then the following also applies: you only receive messages and trip invitations from people you follow; there are no 18+ events and no payouts; new trips are followers only by default. For this we only store since when proof has been required (private, until the proof is provided or until you delete your account), and send you the reason. You won’t find out who reported you. The proof works as above: a photo showing only the name and date of birth, deleted immediately. Legal basis: our legitimate interest in protecting minors when meeting strangers (Art. 6(1)(f) GDPR). LAWYER: CHECK THE LEGAL BASIS OF THE BLOCK WITHOUT A REQUEST FROM THE PERSON AND THE ART. 14 INFORMATION TO THE REPORTED PERSON

8. Recipients and transfers abroad

We only pass on data where this is necessary for the respective feature. Processors act on our instructions on the basis of a contract under Art. 28 GDPR.

Without any link to you, our server also retrieves weather (Apple WeatherKit; until the switchover Open-Meteo), open place data (OpenStreetMap via a paid Overpass instance of Geofabrik GmbH, Karlsruhe; until then via the public instance overpass-api.de), flight prices (Travelpayouts) and events (Ticketmaster). Only the location is sent, rounded to about 1 km for the weather and to about 100 m for the place search, never your account. We cache the responses briefly so that the same questions don’t have to be asked again: weather for at most one hour, place search 24 hours, without any link to an account; the place search under a checksum (hash) of the query instead of the location. GEOFABRIK AND WEATHERKIT ONLY ACTIVE ONCE ORDERED OR SWITCHED ON — THEN DELETE “UNTIL THE SWITCHOVER” The app loads images of imported events directly from the organiser’s server or from Ticketmaster; that server sees your IP address.

9. How long we keep data

• As long as your account exists: profile, content, settings. You can delete individual content yourself at any time — including check-ins and your reviews after meetups or tours.
• When you delete your account, we remove your profile, private details, trips (including polls, packing lists, expenses, highlights), Trippys, Stories, posts, reviews, comments, likes, follows, wishlists, address book, tripHARRY histories and memory, your photos, videos and voice messages, open meetups, guide offers, check-ins, tables you added, the places you follow, the assignment of your clicks on partner links, points and technical counters; you are removed from other people’s trips and teams. Group trips you organised pass to the member with the highest experience level (in the event of a tie, to the one who has been a member longest). Paid guide tours that are still upcoming are called off or cancelled in the process (as a guest only if they start more than 24 hours later) and refunded via Stripe; if a booked tour starts sooner, we tell the guide that you are not coming. If you are a guide, we also call off open requests and bookings that have not yet been paid. The other side receives a notification, and if a guide calls off a tour, it says that the guide has deleted their account. The booking remains, with the refund, as a record (see below). So that this also works if something goes wrong during deletion, we remember the time of deletion together with your account identifier until all refunds have been completed, for at most 30 days. LAWYER: CHECK THE “ACCOUNT DELETED” NOTICE TO GUESTS (ART. 6(1)(B)/(F) GDPR)
• What remains and why:
  • If you have your cashback paid out when you delete your account, we keep the payout record (amount, account holder, IBAN, date, reference) without any link to your deleted account — like all accounting records. Before deletion the app shows you a reference and a pickup code; of the code we only store a check value. With these you can collect your money if the transfer comes back. You can optionally provide a contact email: we only use it to let you know if the transfer comes back, and delete it 60 days after the transfer. If the transfer comes back, we keep it until we have transferred the money again (and then again until 60 days after that) — if you don’t get in touch, for at most 12 months. We delete the check value of the code 60 days after the transfer; if the transfer came back, it stays with the record for as long as you can still collect the money. You won’t get a copy of this via the data export — the account no longer exists by then; ask us by email.
  • Bookings, payments, payouts, cashback and Credits — statutory retention (accounting): 7 years from the end of the calendar year, unchanged (guide bookings and photo book and postcard orders 10 years); deleted afterwards;
  • Meetups, reviews after meetups, reports and suspensions — for the safety of others: meetups and reviews 3 years from the meetup; reports without a violation 12 months after the decision; reports that led to action and suspensions 3 years from the decision, at most 5 years; permanent suspensions as a minimal record for as long as they apply; for a suspended account, the check value of the phone number for as long as the suspension applies;
  • Records of consents given and withdrawn and of which version of the Terms of Use you agreed to — 3 years after the end;
  • We keep statements of reasons for moderation decisions for 3 years, even after you delete your account (defence of legal claims, Art. 17(3)(e) GDPR); they are included in your copy of your data;
  • Messages you have sent to others — they also belong to the other side. You can use “Delete for everyone” on your own messages at any time (the text and files are then gone; the notice “This message was deleted” remains). We delete chats with no new message for 24 months entirely.
• Automatically: Stories after 24 hours; live location after it ends; city presence after 24 hours; read notifications after 90 days, all notifications after 180 days; server logs after 30 days CHECK (CONSOLE; TARGET ~14 DAYS). What you delete is also removed by Google from its backups for sign-in and push notifications within 180 days.
• Other periods: tripHARRY histories 12 months after the last message; check-ins 24 months (longer only as long as you have reviewed the place or it counts for a group trip); requests to businesses and chats 24 months after the last message; the assignment of your clicks on partner links 90 days after the click (after that a booking only appears in the cashback record); trip plan PDFs 30 days, photo book PDFs 60 days after dispatch; tables you added 30 days after the date; the marker against double counting of views and clicks for businesses after 2 days; we delete your date of birth after your 18th birthday and only remember that you are an adult.
• Moderation, places, fraud: suggestions for places 90 days after the decision, those never decided after 12 months; who hid or unhid a place, 3 years after the last such decision; proof for further branches of a business for as long as the place belongs to the business, rejected proof 90 days after the rejection; indications of fraud with cashback and commissions 3 years after they have been dealt with; documents relating to creator applications and organiser verifications 12 months after the decision; the creator entry (period, extensions, check) 12 months after your status ends; copies of requests to businesses that you sent despite an AI warning, 12 months after the review, 90 days if not reviewed, immediately when you delete your account; copies of removed content kept as evidence, 10 weeks after removal, even if you delete your account before then PERIOD AS PER N3 — LAWYER TO CONFIRM (AMD-G, THE AUSTRIAN AUDIOVISUAL MEDIA SERVICES ACT: 10 WEEKS; TCO: 6 MONTHS FOR TERRORIST CONTENT FOLLOWING AN ORDER BY AN AUTHORITY).
• Inactive accounts: If you don’t use TripHar for 24 months, we delete your account. Before that we warn you four times — 60, 30 and 7 days and 1 day before the deletion date — by notification in the app and by email to the address of your sign-in (with Apple possibly the relay address; without an address only in the app). Opening the app is enough. If you have a balance, Credits, a subscription, a suspension or ongoing proceedings, we put the account on hold instead and remind you at most every 90 days.
• Waitlist (website, including early access for businesses and guides and signing up as an Original Creator): we keep your entry until the launch email and delete it within 30 days after that, at the latest 24 months after you signed up.
• Support emails: 6 months after the matter is closed; longer only what we have to keep longer: business letters 7 years, privacy requests 3 years after the matter is closed, objections to moderation decisions for as long as the case. We delete ID photos from support requests immediately after the check.

10. Notifications

You receive notifications about your trips, messages, meetups and your account if you allow push notifications; you choose which ones under Settings → “Push settings”. Tips & inspiration (promotional notifications, e.g. a food tip in the city of your trip) are only sent if you explicitly say yes; we store when you agreed. If you follow a place with the bell, you receive at most 4 messages from the owner per month; the bell on the place switches them off. About your content: People who follow you and have switched on the bell for you receive a notification about your new content that they are allowed to see — e.g. a review (“… ate at …”), a Trippy, a shared or completed trip, or that you are travelling. People who follow you may also see such content in the weekly summary “You missed this”. We never mention content to anyone who is not allowed to see it (e.g. private trips). Push notifications are delivered via Apple and Google; they may contain your name and a short preview. Emails are only sent to you about your account (currently: warning before inactive accounts are deleted; and to the optional contact email if a payout comes back after you have deleted your account) — without advertising, without tracking pixels, without remotely loaded images.

11. Access on your device

• Camera, photos, microphone: only when you record or select something. Only what you share is uploaded; we store images without location data in the file.
• Voice input: directly on the device if your device supports it, otherwise via Apple.
• Calendar: write access only, when you have an appointment added.
• Contacts: only the one contact you select as an emergency contact.
• Apple Health: see specially protected data.
• Stored on the device: your sign-in (keychain), a copy of your profile for a quick start, search histories and settings. When you sign out, we delete them and unregister the device from push notifications. In addition, there is a technical identifier for push notifications and one for checking that requests come from a genuine TripHar app (Apple App Attest); both are necessary for these functions. The app does not set cookies.

12. Reporting, moderation, suspensions

You can report profiles, content and messages. Our moderation team reviews reports; you receive feedback once a decision has been made. If content of yours is removed, your account is suspended or something is reversed, we tell you why, whether it happened automatically and how you can object; we keep these statements of reasons for 3 years (see section 9). What happens automatically (e.g. the 7-day suspension after two confirmed reports from real meetups, or the pause on Meetups after a low trust score, see section 2) and what is always decided by a person (e.g. every permanent suspension) is set out in the Terms of Use, section 13.2. We keep a copy of removed content as evidence, which only our admin team can see (period in section 9). If there is a threat to life or safety, we inform the authorities (Art. 18 DSA).

Protection against fake reviews (legitimate interest: genuine reviews for everyone, Art. 6(1)(f) GDPR). So that only reviews from confirmed accounts count towards the average, our server records for each review whether the person’s phone number is confirmed (this is shown on your public profile anyway) and when it created the review. For the daily limit (at most 10 new reviews per day), it counts which reviews you have written today; the counter is overwritten every day and is deleted together with your account. A job checks every hour whether a place is receiving a suspicious number of reviews within a short time from new accounts or without proof of a visit; for this it reads when the accounts were created. It only reports the place and figures to moderation, no persons, and decides nothing. Anyone permanently suspended is on a list that only our server reads — for as long as the suspension applies; their reviews then no longer count.

13. Your rights

• Access and copy (Art. 15, 20): Settings → “Privacy & account” → “Export my data” (file in JSON format), or by email.
• Rectification (Art. 16): in your profile; your date of birth via support.
• Erasure (Art. 17): individual content yourself, the whole account under “Delete account”.
• Restriction (Art. 18) and objection (Art. 21) to processing based on legitimate interest: by email to privacy@triphar.com.
• Withdrawal of consent: in the app (tripHARRY, diet and needs, group trips, Tips & inspiration, Apple Health, location, camera etc. in the iPhone settings). Processing remains lawful until the withdrawal.
• We respond within one month.
• Complaint: to the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at, or to the supervisory authority where you live.

14. Changes

If what the app does with your data changes, we update this policy. If the change affects a consent (e.g. a new AI provider), we ask you again in the app.