Privacy Policy
GroupCation ("we", "us") builds a native iPhone app for planning group trips. This policy describes what we collect, why, and how we use it.
What we collect
- Account information. If you sign in, we store your email address and a unique account identifier. Apple Sign-In accounts may use a relay email provided by Apple.
- Trip data. Trips, travelers, itinerary items, reservations, tasks, notes, expenses, and settlements you create or are invited to.
- Invitations. Email addresses you send invitations to, so the invitee can accept.
- Device tokens. If you enable push notifications, the iOS device token is stored so we can deliver trip notifications.
- Diagnostics. Crash reports and usage events (if enabled) via Sentry and PostHog, with identifiers that cannot be used to contact you directly.
What we do not collect
- We do not sell personal data to third parties.
- We do not access your contacts, photos, or location without an explicit in-app action and iOS permission prompt.
- We do not run third-party advertising networks in the app.
How your data is shared
Trip data is shared with the people you invite to that trip, scoped by the role you assign them (organizer, collaborator, viewer, advisor). Database-level access control (Supabase Row Level Security) enforces this — it is not only enforced in the app.
Subprocessors
- Supabase — authentication and database hosting.
- Apple Push Notification service (APNs) — delivery of push notifications if enabled.
- Stripe — hosted payment links when you send or accept a payment request.
- Sentry — crash and error reporting (if enabled in your build).
- PostHog — product analytics (if enabled in your build).
- Vercel — hosting for this website and the guest companion.
Your rights
You can delete your account and associated trips at any time from inside the app or by emailing privacy@groupcation.net. Deletion removes your account, your owned trips, and any invites you issued. Trips you were invited to remain owned by the organizer.
Data retention
We retain trip data while your account is active. When you delete your account, we delete or anonymize your data within 30 days, except where we are required to retain it for legal reasons.
Contact
Questions about this policy: privacy@groupcation.net.
Changes
When we make material changes to this policy we update the "Last updated" date and, for significant changes, notify you in the app before the change takes effect.