Privacy policy

What we collect

Account details you provide: name, email address, and optionally a phone number, city, date of birth, and profile photo.

Content you create: trips, itineraries, budgets, expenses, enquiries, bookings, and reviews.

Technical data needed to run the service: your IP address for rate limiting and abuse prevention, and login timestamps.

Verification documents, if you register as a guide or agency. These are visible only to our verification team and are never shown on public profiles.

Why we collect it

To operate your account, show your trips and bookings, connect you with guides and agencies, and let collaborators you invite see shared itineraries.

To prevent abuse: login attempts and IP addresses are recorded so that repeated failed logins and message flooding can be throttled.

To moderate the platform: reviews, reports, and administrative actions are logged so decisions can be audited.

What we do not do

We do not sell your personal data.

We do not show your email address or phone number to other users. Guides and agencies see your name and the content of your enquiry or booking request, not your contact details, unless you include them.

The “Ask TripMate” helper is a static FAQ that runs entirely in your browser. It stores nothing and sends nothing to any external service.

Your control

You can edit or delete your profile details and travel preferences at any time from Profile settings and Preferences.

You can disable personalised recommendations without deleting your preferences.

You can request account deletion by contacting support. Bookings and reviews attached to other people’s records are retained in anonymised form for their integrity.

Security

Passwords are stored only as bcrypt hashes and are never recoverable in plain text. Sessions use HttpOnly cookies, and remember-me tokens are stored as hashes so a leaked database cannot be replayed.

Uploaded files are renamed, type-checked, and served from a directory where script execution is disabled.

Contact

For any privacy question, or to request a copy or deletion of your data, use the contact page.