Privacy Policy

Last updated September 24, 2026

Who we are

TripMind (tripmin.app) is an AI travel planner operated by Ashutosh Bhandari. Questions about this policy or your data: support@tripmin.app.

What we collect

  • Account: your email address. If you sign in with Google, also your name, profile picture link and Google account ID. You can change your name in Settings.
  • Trips: what you enter when planning (origin, destination, dates, budget, number of travelers and children's ages, interests, must-dos and links you paste, flight and hotel preferences), the plans we generate, your chat messages with the assistant, and up to 20 earlier versions of each trip for Undo.
  • Billing: if you upgrade, your Dodo Payments customer and subscription IDs, your plan, and when it renews or ends.
  • Usage records: the time and type of actions such as planning a trip or sending a chat message, used to apply usage limits.
  • Sign-in codes: the code emailed to you, when it expires and how many times it was tried.
  • Technical data: your IP address is held briefly in server memory to limit sign-in attempts and isn't saved in our database. Our hosting providers keep standard request logs.

We don't collect card or payment details (Dodo Payments does, on its own checkout page), your precise location or your contacts.

How we use it

To plan your trips, sign you in, send your sign-in codes, apply usage limits, prevent abuse and fix problems. We don't sell your data, show ads, share your data for advertising or use it to train AI models.

Who we share it with

Only the service providers TripMind needs, and only what each one needs:

  • OpenRouter, which routes to Google (Gemini)

    Receives: Your trip details and chat messages

    Why: Writing your plan and chat replies

  • SerpAPI (Google Flights, Hotels and Images results)

    Receives: Origin, destination, dates, number of travelers, hotel preferences and place names

    Why: Real flight and hotel prices, and photos

  • OpenTripMap and Wikidata

    Receives: Your destination's coordinates and place IDs

    Why: Finding places and activities

  • OpenWeatherMap

    Receives: Your destination's coordinates

    Why: Weather forecasts

  • Ticketmaster

    Receives: Your destination and dates

    Why: Events during your trip

  • OpenStreetMap Nominatim and Photon (Komoot)

    Receives: Place names

    Why: Placing stops on the map (some requests come from your browser)

  • Travelpayouts

    Receives: The city names you type

    Why: City and airport suggestions (from your browser)

  • Dodo Payments

    Receives: Your email address and name if you upgrade, plus the card and billing details you enter on its checkout page (we never see them)

    Why: Selling and billing the Pro plan, as merchant of record

  • Resend

    Receives: Your email address and sign-in code

    Why: Sending sign-in codes

  • Google Sign-In

    Receives: Handled by Google in your browser, if you choose it

    Why: Signing in with Google

  • Google Maps Platform

    Receives: The map area you view (from your browser)

    Why: The 3D trip rehearsal and Street View

  • CARTO, Google Fonts and unpkg

    Receives: Standard web requests from your browser

    Why: Map tiles, fonts and map styles

  • Vercel and Render

    Receives: Everything above, as our hosting providers

    Why: Running the website, API and database (in the United States)

When your browser contacts a provider directly, that provider also sees your IP address, under its own privacy policy. For troubleshooting we may turn on LangSmith, which then receives prompts and replies. We'll also disclose data when the law requires it.

Cookies and browser storage

We use two cookies, both needed to keep you signed in: tripmind_access (expires after 15 minutes) and tripmind_refresh (30 days). Your browser keeps an unfinished trip form in session storage until you close the tab. We use no analytics or advertising cookies. If you use Google Sign-In, Google may set its own cookies.

How long we keep it

Your account, trips and chat history are kept until you delete them. Sign-in codes expire after 10 minutes. Usage records and sign-in code records are kept until you delete your account. Search results from providers are cached in server memory for a short time and aren't linked to your account.

Your choices and rights

  • Change your name in Settings, and delete any trip from your dashboard.
  • Delete your account in Settings → Delete Account. It happens at once, cancels a Pro subscription, and permanently removes your trips, chat history, usage records, billing IDs, Google link and sign-in codes. Dodo Payments keeps its own billing records as the law requires.
  • Email support@tripmin.app for a copy of your data or any privacy request.

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have the right to access, correct, delete or export your data and to object to how it's used. We'll answer requests within 30 days. We don't sell or share personal information for targeted advertising.

Security

We use HTTPS, sign-in cookies that page scripts can't read, passwordless sign-in, API keys kept on our servers and rate limits. No system is perfectly secure, so please tell us at support@tripmin.app if you find a problem.

Where your data is processed

Our servers and most providers are in the United States. Using TripMind means your data is processed there.

Children

TripMind isn't for children under 13 (under 16 in the EU and UK), and we don't knowingly let them create accounts. Parents may enter their children's ages when planning a family trip. If you think a child has an account, contact us and we'll delete it.

Changes

We'll update the date above when this policy changes, and point out significant changes on the site.