Version 2026-09-02 · Effective September 2, 2026
Version 2026-09-02 · Effective September 2, 2026. TripTips LLC respects your privacy. This Privacy Policy explains what TripTips collects, how it uses information, and the choices available to you.
TripTips is intended for people who are 18 or older. During onboarding, you self-attest that you are at least 18 and provide your date of birth. The age check blocks onboarding, earning, and referral activity for an under-18 person; browsing-only account existence can occur before the age check. If you believe a person under 18 submitted information, report it to support@triptipsapp.com. TripTips investigates, removes the information where required, and retains no under-18 person's information for product use.
We collect your email address; your optional display name, including a name supplied by Apple or Google; and your date of birth. We collect business listing data, including the business name, address, phone number, category, hours, website, and other listing details. We collect reviews, replies, photos, promotion details, and captions that you submit, plus abuse reports and relevant snapshots.
For business operations we collect an employee's name, employee code, and PIN hash. We collect blocks and preferences, push tokens, IP addresses in logs and rate-limit buckets, and referral details. For payments and tax we collect bank references and last four digits, W-9 status, and provider references. We collect precise location only during QR scanning and business setup.
We also receive sign-in information when you choose email code sign-in, Sign in with Apple, or Google sign-in. TripTips does not use advertising, sell personal information, use third-party analytics, or track you across services.
We use information to authenticate accounts, provide customer, promoter, and business features, process scans and payments, deliver notifications, prevent abuse, respond to reports, comply with legal duties, and provide support. We use precise scan location only to check the business radius and discard scan coordinates immediately.
Private originals are stored in Cloudflare R2. Camera metadata is retained with an original only during the applicable retention window. Published copies are re-encoded, have metadata removed, and use randomized URLs. Originals are retained for 30 days after publication or 7 days after rejection, whichever rule applies. Deletion requests also trigger storage and CDN purge processes.
When you grant the recorded AI-processing permission, TripTips sends OpenAI only the submission needed for safety moderation: review, reply, display, employee, and business names; address lines; website and YouTube URLs; promotion titles; abuse-report details; captions; and downscaled, metadata-stripped photos. TripTips does not send your email, phone number, account identifiers, precise location, or unrelated request headers. OpenAI is used through its moderation endpoint; TripTips does not use your submissions to train a model. You can withdraw AI-processing permission in Settings. Withdrawal blocks new submissions that require this processing.
Supabase provides authentication and database services. Render hosts the API and public pages. Cloudflare R2 and its CDN store and deliver media. OpenAI provides permitted automated moderation. Sentry receives scrubbed crash and error diagnostics with no PII. Resend delivers transactional email. APNs and FCM deliver push notifications. Apple and Google provide sign-in. Dwolla processes payment transfers. TaxBandits supports W-9 and tax workflows.
Abuse reports and moderation records are retained for 2 years for safety and enforcement. Financial and tax records are retained for 7 years. Logs and backups are retained for up to 30 days. Scan coordinates are discarded immediately. Media originals follow the 30-day-after-publication or 7-day-after-rejection windows above. Published content and account records are deleted or de-identified according to the deletion process below.
Request deletion in Settings. TripTips records the request immediately and shows a deletion status screen. The request moves through requested, queued, waiting on funds, processing, and completed or failed states. If a payout is in flight or a balance is owed, completion waits for that condition; the status screen shows the blocker, requested date, expected timeframe, and current status. You may cancel while the request is queued, waiting on funds, or processing, until the account is marked deleted. You may sign out while waiting. TripTips sends accepted and completed status email when the email seam is available.
Completion deletes personal UGC, relationships, tokens, preferences, drafts, referral sessions and handoffs, QR tokens, funding instruments, promoter questionnaires and activation records, role rows, reviews, replies, photos and renditions, likes, blocks, and notification records. It purges associated media from R2 and the CDN. TripTips de-identifies the auth and profile tombstone so stable identifiers can support retained records, and retains only payouts, transaction and ledger records, ACH authorizations, promoter tax records, content reports, AI-processing consent events, referral-attribution records, and a de-identified business record where needed for payment, tax, safety, fraud, or accounting purposes. A business owner's active listings are closed and unpublished, promotions end, drafts and republish requests are deleted, and listing media is purged.
To request access, correction, or a copy of your data, email support@triptipsapp.com from your account email and describe the request. You can also request withdrawal of AI-processing permission there if you cannot use Settings. Account ownership may be verified; responses follow the period required by law.
TripTips may update this Policy as the service changes or law requires. The new version and effective date are posted; material changes receive additional notice where required.
Privacy questions, under-18 reports, content reports, and rights requests go to support@triptipsapp.com.