Privacy

01

Who this notice is from

Trek Together is operated by Travel Trek Vacations and covers this web application and the trip data stored behind it. Business information and official contact channels are available on the Contact page.

For privacy questions, corrections, access requests, or deletion requests, use the Contact page or the self-service controls in your Profile. Privacy rights vary by location, and mandatory rights under applicable law remain available to you.

02

What we store about your account

When you register, the app stores your email address and either a password or a Google sign-in, held by our backend provider. Your traveller profile then holds:

• display name and, if you add one, a profile photo and short bio
• phone number and home city — both optional, both entered by you
• notification preferences for announcements, itinerary reminders, and group activity
• account status and the time you last signed in

Everything except your email and display name is optional. Anything you put in your profile is visible to the members of trips you belong to.

03

Food allergies — health-adjacent information

This is the most sensitive information Trek Together holds, so it is worth reading closely. New travellers are asked for food allergies during onboarding, and the form includes a free-text box for details or severity (for example, “severe peanut allergy; avoid cross-contact”).

Your allergies are stored on your account and are also copied onto your membership record for every trip you belong to. When you update them, the copy on each of your trip memberships is updated as well.

Two things follow from that, and both are deliberate:

• Trip hosts see a “Food allergy notice” with your allergy list and your notes on the trip’s member list.
• Your name, allergies, and notes are included in the trip context sent to Trek Guide, the in-app AI assistant, whenever any approved member of that trip asks it a question — including when you are not the person asking.

The app does not ask for medical records, medications, diagnoses, or any other health information, and nothing is inferred from what you enter. Because the notes box is free text, please write only what you are content for your hosts, your fellow travellers’ assistant answers, and our support staff to see.

Allergy information may be treated as sensitive or health-related data. Before saving it, the app asks for your explicit consent to share what you enter with approved trip members, trip hosts, and Trek Guide for group travel planning. You can withdraw that consent by removing the information from your profile.

04

Photos, videos, and the location inside them

When you attach a JPEG to a trip post, the app reads any GPS coordinates embedded in the photo’s EXIF metadata inside your browser. At that point nothing has been sent anywhere.

If any of the photos you selected carry coordinates, the composer shows a checkbox — “Show N embedded photo locations on the trip map”. What happens next depends entirely on what you choose:

• Tick the box and the coordinates are saved with the photo at exact precision, and the photo appears at that spot on your group’s trip map.
• Leave it unticked and attach the post to a saved trip place instead, and the photo is stored at place-only precision — linked to the place your group already saved, with no coordinates taken from your photo.
• Do neither, and the photo is stored with its location hidden and no coordinates at all.

Saved places and map pins your group creates carry the same precision setting, so a group can share a neighbourhood or a venue without publishing an exact position.

For every upload we also store the file itself plus its file name, type, size, dimensions, video duration, and capture time.

Photos are re-saved in your browser before they are uploaded, which removes the metadata your camera wrote into the file — GPS coordinates, camera model and serial number, capture time. That happens whether or not you tick the box above; the box only controls whether a location is shown on the trip map. Three exceptions, stated plainly: videos and animated images are uploaded exactly as you chose them, because re-saving them in a browser is not possible without destroying them; and photos uploaded before we added this, or ones where the re-save failed and we sent the original rather than lose your upload, still carry whatever their camera wrote. Assume older uploads may still contain their original camera metadata.

05

Live location

Trek Guide has a “Share live location” button. It is never automatic: your browser asks your permission, and only then does the app read your current latitude, longitude, and accuracy and send them along with the question you typed, so the assistant can answer things like what is open nearby.

That position is used for the assistant conversation you are having. It is not written to your trip’s records, your profile, or the trip map. The app does not track your location in the background at any point.

06

Trip plans and group content

A trip hub holds what the group puts into it: posts and comments, reactions, photo and video memories, announcements and who acknowledged them, polls and each member’s votes, packing lists and what each person has ticked off, and activity responses.

The itinerary and saved places can hold meeting points, addresses, coordinates, dress codes, what to bring, reservation details, and contact information — usually entered by a host on behalf of the group.

Your membership record also stores the role you were given, your membership status, when you joined, the email address the invitation went to, and how you described your relationship to the group.

07

Travel documents

Trips can hold uploaded documents filed under categories including flight manifests, boarding passes, travel insurance, reservations, visa or ID documents, packing lists, and destination travel tips.

Documents shared in a trip are visible to every approved member of that trip. The app does not currently offer a host-only or one-person-only document, so please treat anything you upload as shared with the whole group, and avoid uploading a passport, visa, or other identity document unless every approved member should be able to see it.

08

Messages

Each trip has a group conversation, and members can also message one another directly. We store the message text, any photo you attach, the sender’s name, and the time it was sent, plus read receipts recording how far each participant has read and when.

A message is readable only by the people listed as participants on it — for a direct message, that is the two of you. Push notifications about a new message include the sender’s name and the first 140 characters of the message.

09

Who can see your trip content

Access is enforced on the server, not in the browser. Every trip record carries the list of that trip’s approved members, and the database rules only return a record to someone on that list.

• Trips are reached with a private trip code, and hosts can require that every join request be approved.
• While your request is pending you can see that you are waiting, and the hosts can see your request — but not the trip’s content.
• If you are removed or declined, your access to the trip and its group conversation is revoked. Direct messages you exchanged with individual travellers are deliberately left intact, because they are personal correspondence.
• Content you already shared stays with the trip after you leave, unless you delete it while you still have access or ask the host or us to remove it.

Platform administrators at Travel Trek Vacations can access trips, user records, content reports, and support tickets in order to run, support, and moderate the service. Trip content and messages are not end-to-end encrypted and are readable by those administrators.

10

Notifications and email

The app creates in-app notifications for announcements, itinerary items and one-hour reminders, and group activity such as new posts, photos, and polls. Your profile has switches for those three categories; if you have never touched them, they are on.

Push notifications are also sent for new chat messages. Chat has its own switch — “Chat messages” on your profile — separate from group activity, so turning that off stops chat pushes without silencing everything else. A chat push includes a short preview of the message, which appears on your lock screen.

Invitation emails are sent to the address a host enters when inviting someone. The email names the host and the trip and carries the join link.

11

Outside services that receive data

Trek Together is not self-contained. These are the outside services the app actually contacts, and what reaches them:

• Base44 — hosting, database, file storage, sign-in, email delivery, push notifications, and the AI assistant runtime. Effectively everything described on this page is stored there.
• MapTiler — map tiles and terrain. Your browser requests tiles directly, which means MapTiler receives your IP address and the area you are looking at.
• Photon by Komoot (photon.komoot.io) — turns destination names and itinerary addresses into map coordinates. The text being searched is sent from your browser.
• Google Calendar — optional, and only if you connect it. Syncing sends the selected itinerary items’ titles, descriptions, meeting instructions, what-to-bring notes, addresses, and times to your primary Google calendar. You can disconnect it at any time from the itinerary screen.
• Uber — the “Ride there with Uber” button is a link. Following it hands Uber the destination address and coordinates of that itinerary item.
• The AI service configured through Base44 for Trek Guide receives your question together with the trip context described below.

The app loads no advertising networks and no third-party analytics trackers. It does send basic usage analytics to Base44 itself: an event carrying the page address, a session identifier, a timestamp, and — when you are signed in — your user identifier.

For current information about service providers, international processing, or applicable data safeguards, contact Travel Trek Vacations through the Contact page.

12

What Trek Guide is told about your trip

Trek Guide is an AI assistant inside each trip. Every question a member asks is sent with a snapshot of trip context so the answer is useful. That snapshot contains:

• the trip’s name, destination, dates, and time zone
• the group’s lodging, including addresses, coordinates, and any contact information saved on those items
• saved places and the existing itinerary, with addresses and coordinates
• open and closed polls with their options and vote counts
• the asking member’s own allergies and notes — and the names, allergies, and allergy notes of every approved member of the trip who has recorded any
• your live location, only if you pressed “Share live location” for that conversation

That last-but-one point is the one people do not expect: allergy details are shared with the assistant on any member’s question, not only your own, so that food suggestions are safe for the group. If you would rather your allergy notes were not sent, remove them from your profile.

13

How long we keep things

Trip content stays for as long as the trip exists in the app; trips can be completed and archived, which keeps the record rather than deleting it. Invitation records carry an expiry date and a host can mark one revoked, but that changes the host's list rather than disabling a code already shared.

Active and archived trip content remains available while the trip record exists. Account closure deletes personal-only records, anonymizes shared contributions, and retains operational, support, moderation, and audit records when needed to protect users, resolve disputes, maintain trip history, or meet legal obligations. Service-provider backups expire under their normal backup cycle.

14

Your choices and your rights

Inside the app you can, at any time:

• edit your profile, your allergies, and your notification preferences
• choose per upload whether a photo’s location is shown on the trip map
• delete content you created, wherever the app offers a delete control
• leave a trip you joined
• connect or disconnect Google Calendar

Hosts can download a trip archive as a JSON file containing the itinerary, places, polls, announcements, documents, posts, and media references for their trip.

You can download everything we hold about you, and close your account, from the Profile page in the app. The export includes your profile, your trip memberships, and the content you authored, including the chat messages you sent — other travellers’ messages are their personal data and are not included. Closing your account erases your profile details and food allergy information, removes your votes, reactions and read receipts, and replaces your name on posts and messages with “Deleted traveller”; the text of posts and messages stays, because removing it would tear holes in conversations other travellers were part of. Photos you shared stay in the trip too; we erase the location we recorded about them, but the picture file is kept as the group shared it. The app shows exactly what will be deleted, anonymised and kept before you confirm. If you own an active trip with other travellers, hand it over or wind it down first. For corrections or requests not covered by in-app controls, use the Contact page. You may also contact the privacy authority available in your jurisdiction.

15

Children and family trips

Trek Together accounts are for people aged 13 or older. Anyone under 18 must have permission from a parent or guardian before creating or using an account. The app records the user’s confirmation but does not independently verify age.

If you add details about someone else — including a child’s allergies, a travelling companion’s phone number, or a document naming them — only do so when you have authority and consent to share that information with the approved trip group.

16

How your data is protected

Read access to every trip record is checked on the server against the trip’s approved-member list, rather than being filtered in the browser. Membership changes, invitations, moderation, and message sending all run through server functions that re-check who you are and what standing you have on that trip, so those decisions cannot be made from a user’s browser.

Sign-in, password storage, file storage, and infrastructure security are handled by our backend provider. We do not claim security certifications that have not been independently verified. If a data incident creates a legal notification duty, affected users and authorities will be notified as required by applicable law.

17

Changes to this notice

When the app materially changes what it collects or who receives it, this page will be updated and the new date shown above. Where required, a prominent in-app notice will appear before the change takes effect.