Privacy Policy

1. Information we collect

Trip settings (dates, arrival/departure locations, transportation, party, pet/stroller/wheelchair status and budget), saved places and priorities, generated itineraries, live recalculation records, unverified places you add yourself, and error reports.

Trip settings, places and budgets in MCP (external AI tool connection) requests are used only to calculate that request and are not stored. Request IP addresses are kept briefly in server memory to prevent excessive calls and are not shared between server instances.

If you agree to cloud saving, a Google Firebase account identifier (UID). It starts as an anonymous account. If you link a Google account or an email address with 'Continue on other devices' on the My page, your sign-in email address is stored in Firebase Authentication and in this browser's sign-in storage. When linking by email link, the email address stays in this browser for up to 24 hours until sign-in is completed, and expired entries are deleted. Tripcart does not store or display your Google account name or profile photo (they may be recorded in Firebase Authentication during Google sign-in, so we clear them right after linking). We do not collect travelers' phone numbers or precise location (for the partner center and listing inquiries, see section 6).

If you agree to usage analytics, feature-use events (event names, counts and times). Place names and itinerary details are not included in events.

Visit analytics (regardless of consent): We use our hosting provider Vercel's Web Analytics to aggregate visits anonymously. It records only visited page paths, referrers, approximate regions, device type, operating system and browser; it does not use cookies or collect information that identifies a person. Search terms in addresses (including shared-link contents) are not sent.

Likes, ratings and comments left by members who agreed to cloud saving. They are stored with the account identifier (UID). Comment text and per-place totals (likes, ratings, comments) are visible to other members; the identifier attached to a comment is not shown on screen but can be read by other members' apps. Emails and names are never included in comments. You can delete your own comments, and 'Delete all data' also deletes your comments and likes.

2. Storage and consent

By default, data is stored only on this device (browser localStorage). In this state trip data is not sent to a server (only the anonymous visit analytics above are aggregated).

After you save a place, turning on 'Cloud saving & sync' in the cart notice card or on the My page stores data in Firebase (Google Cloud) Firestore with an anonymous account. Turning on 'Send usage analytics' sends events to Firebase Analytics. You can turn either setting off at any time.

Linking an account is optional. You can keep using Tripcart without it; once linked, you can sign in with the same account on another device and continue your trips. We never ask you to link on the first screen.

If you sign in on a new device that already has a trip, you choose which one to use. The one you don't choose stays in that device's browser as a backup, which you can restore or delete on the My page.

3. Retention period

Trip data: kept until you delete it. 'Delete all data' on the My page deletes trips on this device and in the cloud, recorded share links, comments and likes, and backup trips on this device, and also deletes the account. For an account linked to Google or email, we ask you to sign in again before deleting, and nothing is deleted unless you finish signing in. Ratings and error reports may remain.

When you use 'Sign in to an existing account' with Google or email and your current anonymous account has cloud records (trips, recorded share links, comments and likes), we ask first, then delete those records and the anonymous account before signing in. Trips on this device stay as a backup; if you cancel, nothing is deleted and you are not signed in.

If the same sign-in account is also used for the partner center or operations, 'Delete all data' deletes only trip data and signs you out, keeping the sign-in account (for deleting partner information, see section 6).

Sign-in email: deleted from Firebase Authentication when the account is deleted.

Share-link documents: they cannot be opened after 90 days and the creator can revoke them at any time.

Error reports: kept for up to one year for data validation and improvement, then deleted. Reports include only an account identifier and no contact details.

Analytics events: kept for up to 14 months according to Firebase Analytics retention settings.

4. Third parties and processing

Only when you agree to cloud saving or analytics, we entrust storage and processing to Google (Firebase). We do not sell data or provide it for advertising.

Anonymous visit analytics are processed by Vercel Inc. (United States). Values that distinguish individual visitors are discarded after 24 hours.

Map tiles are provided by OpenStreetMap, and location search for places you add yourself is provided by OpenStreetMap Nominatim. These requests send search terms and connection information (such as IP addresses) to those services.

5. Your rights

On the My page, you can turn off cloud saving or usage analytics, delete cloud data only, or delete all data.

You can revoke a shared link on the Share screen. Once revoked, recipients can no longer open it.

6. Partner center and listing inquiries (for business owners)

The partner center (/partner) operates separately from traveler features. However, if a traveler links an account on the My page with the same email used to sign in to the partner center, both use the same sign-in account. In that case, the traveler's 'Delete all data' deletes only trip data and signs out, keeping the sign-in account (to delete partner information, request it as described under 'Retention' below).

Information collected: [required] contact email (for sign-in-link delivery and processing notices), sign-in account identifier (UID), managed store, submitted requests, store-information submissions and processing records. When applying to link a store: [required] business name, contact person's name, contact number, and the privacy-policy version and time agreed to. [optional] a contact number written for each request (for result notices). We do not collect business registration numbers.

Purpose: to confirm the store contact (by phone or visit) and link stores; to confirm and reflect requests and submissions for opening hours, menus, photos, details, discounts and events; and to provide estimates for webbook and advertising inquiries.

Disclosure: Applications (business name, contact person's name and contact number) are visible only to the applicant and Tripcart operators. They are not visible to other contacts at the same store. The representative name and contact number in the basic-information form are kept in a separate private document and only Tripcart staff can access them. After review, approved public fields (business name, address, introduction, keywords, directions, links, store phone, reservation guidance, parking guidance, hours, menus and prices) appear in public place information with the source 'provided by partner, date'. Contact emails, contact numbers and photo links are not included in public information.

Retention: After a partner relationship ends or an application is rejected or withdrawn, if deletion is requested we delete personal information in the sign-in account, application, request/submission records, and the private representative name and contact number (an operator processes this in the Firebase console). Source records for reflected place information ('provided by partner, date') remain without personal information. Temporary store-form drafts stay only in that device's browser and disappear when submitted or deleted.

Listing inquiry (/biz): [required] store name, phone number for a reply, business type, agreed copy version and time, and incoming advertisement data (UTM source, medium and campaign name). To accept only one request from a browser, that browser's anonymous account identifier (UID) is used as the application number. We do not collect names, emails or business registration numbers.

Purpose of a listing inquiry: to contact you for consultation (by phone) and count which advertisement brought you in. Only Tripcart operators can view an inquiry, and the applicant cannot view it again on screen. If you do not join, it is deleted within six months of the application date; it is also deleted earlier on request. If you do not agree, you can consult by phone.

The browser on the device that requested a sign-in link retains the email until sign-in is completed (up to one day, then deleted).

Processor: Google (Firebase Authentication and Firestore) handles sign-in and storage of applications and requests. For deletion or access requests, contact the Tripcart contact shared when joining as a partner.

Questionnaire answers about pets, children, accessibility, seating, diet, waits, payment, parking, visit duration, activities and courses are reviewed, reflected in data and deployed before being shown with a source such as ‘provided by partner, date’, ‘Tripcart field check, date’, or ‘Tripcart phone check, date’. New fields are published after their screens are connected.

For staff accounts (managers and administrators), we process email, UID, role, assigned places and writing/review records to enter and review questionnaires. Removing an assignment blocks new submissions while retaining the record; deletion can be requested as described in the retention paragraph. A shared partner or traveler role keeps the sign-in account.

Do not put staff names or contact details in free text, course names or source links; answers that look like personal information are rejected. Public data files contain no UID, email, review memo or therapist information. Massage-course prices are collected but not published until the engine supports partner prices.

The same section applies to lodging owners and event organizers. We do not collect lodging room prices. Lodging and event answers may enter reviewed public data, but are not used on place screens or itineraries in this release.

7. Jeju pilot-operation notice

This is currently a Jeju pilot operation. We show each place's source and verification date for place information (hours, parking, companion conditions and prices), but you should check official channels again before visiting. Daegu is being prepared.