Privacy Policy

Account data. When you sign in with email or a supported identity provider such as Google, Microsoft, or GitHub through WorkOS, we receive your name and email address. We store these to identify your account and associate your trips with you.

Trip data. We store the trip data you create — trip titles, destinations, start and end dates, and the individual itinerary blocks (time, kind, title, notes, location) that make up each day.

Usage data. Optional analytics, session replay and advertising are off unless you explicitly choose each category. Consented product events use a limited event vocabulary, without names, email addresses, trip text, raw errors, search text or URL queries. Guest-share and sensitive account pages do not load optional vendors. Replay and advertising remain disabled until their provider configuration and privacy safeguards are verified.

Feedback. If you submit feedback through the in-app feedback button, we store what you wrote in our database with your signed-in account. Feedback is an explicit submission to our team, not an analytics event.

Your own trip notes or feedback may contain sensitive information. Please avoid submitting information you do not want us to store.

Your account and trip data are used to provide the TripHelm service — displaying your trips in the calendar, allowing you to edit them, and making them available to AI clients (such as Claude or ChatGPT) that you explicitly authorize.

Optional usage data helps us understand and improve the product. Advertising integrations, if enabled after configuration review and your separate consent, may use device identifiers for conversion measurement and retargeting. your trips, name, and email are never shared with advertisers.

We do not use the contents of your trips for advertising or profiling, and we never train AI models on your data.

When you connect TripHelm to an AI assistant through the MCP connector, that assistant can read and write your trip data on your behalf. It can only do so while you maintain that authorization, and it accesses only trips your account is authorized to use.

TripHelm receives only the structured tool calls the assistant makes (for example “create a trip to Kyoto”) — we never receive or store your chat conversation. For reliability and abuse prevention we keep limited operational records such as tool name, duration and outcome, without account IDs or tool payloads. Optional account-linked product analytics additionally requires your stored analytics preference, including for MCP clients.

Publishing a template is a separate, optional action. Your reviewed snapshot and displayed author name become public and reusable by other users. Private metadata is not automatically included; notes require an explicit choice and review. Check all proposed public text for personal or confidential information before confirming.

Publication and saved copies are independent snapshots, not ongoing synchronization with your private trip. Withdrawing a publication stops future discovery and saves through TripHelm. Account deletion removes your published originals, but neither action recalls information already viewed or deletes independent copies previously saved by others.

All trip and account data is stored in a Neon Postgres database hosted in the US East region. Authentication is handled by WorkOS, whose infrastructure is also US-based.

Data is encrypted in transit (TLS) and at rest by the database provider.

We share data with the following service providers, and no one else:

• WorkOSAuthentication by email or a supported identity provider such as Google, Microsoft, or GitHub — receives your name and email
• NeonDatabase hosting — stores your account and trip data
• VercelApplication hosting, edge delivery, performance analytics, and server logs
• PostHogOpt-in, allowlisted product events; server events use an internal account identifier, not name/email. No feedback or raw errors.
• GoogleAnalytics and tag-delivery capability; currently disabled pending configuration review
• MicrosoftClarity replay capability; currently disabled pending masking, shutdown and erasure review
• Amazon AdsAdvertising capability; currently disabled pending separate consent and tag-purpose review
• MapTilerGeocoding and map tiles — receives the place names on your itinerary blocks and your IP address, never your identity

We do not sell, rent, or trade your personal information, and no advertiser ever receives your trips, name, or email.

• Account deletion removes your owned live account data, trips, original publications, feedback and preferences. Other people’s independently saved copies remain.
• External identity and historical vendor erasure is tracked separately. Your receipt distinguishes pending, completed and operator-action-required work; an unavailable provider is not reported as erased.
• Temporary provider identifiers are removed from each completed erasure step. Receipts expire after 90 days and their stored hashes are purged by the worker. A minimal hash of the old identity remains to prevent stale credentials recreating a deleted account; an expiry requires verified provider token/session lifetimes.
• Hosting logs, backups and vendor retention are governed by provider settings and recovery requirements. We do not promise an unverified automatic deletion period or that deleting live data instantly removes every backup copy.

Export or delete your account in account settings. For erasure questions or an action-required receipt, email hello@codeandcapital.co.

• Delete any trip at any time from the dashboard — data is removed immediately.
• Revoke AI client access through that assistant’s connected-app settings. Already-issued tokens may remain usable until provider expiry; account deletion separately fences the old identity.
• Download your private account JSON before deletion in settings. This is a product-data export, not a full vendor-log export, and excludes other people’s data and authentication/share credentials.
• Use Privacy choices or account settings to opt in or withdraw optional collection. Withdrawal stops future collection, not historical erasure. Global Privacy Control overrides advertising; explicit browser choices update signed-in preferences.

Questions about this policy or your data? Email us at hello@codeandcapital.co. We'll respond within a few business days.