Privacy
Travel Whoop: the trip planner (plan.travelwhoop.com and the Travel Whoop apps), the website and travel guides (travelwhoop.com) and the flight search (search.travelwhoop.com) · last updated 22 October 2026
Travel Whoop Trips is a trip planner for you and the friends you invite. This page says what the app keeps, who can see it, which outside services it uses and how to delete everything. The section The website, travel guides and flight search covers travelwhoop.com and search.travelwhoop.com.
Who is responsible
Travel Whoop, the service behind travelwhoop.com, plan.travelwhoop.com and the Travel Whoop apps, is responsible for the personal data described here (the "controller" under the EU General Data Protection Regulation, GDPR). Email: [email protected].
What the app keeps
- Your account: your name and email address. If you sign up with email, we send a one-time code to check the address is yours; the code is stored only as a secure hash and expires after 10 minutes. Older accounts may have a password, also stored only as a secure hash, never readable.
- Sign in with Apple or Google: we receive your name, your email address (with Apple, possibly a private relay address that forwards to you) and an account ID from Apple or Google, which they confirm. We never see your Apple or Google password. When you delete your account, we also disconnect it from Apple.
- Your travel profile, if you fill it in: what you love on a trip, your diet, food rules (such as halal or kosher) and allergies, your pace, mornings, budget and home city. It shapes suggestions, "Plan it for me" and the restaurant finder. People on your trips see it in the trip's group needs; your food and allergies only if you allow it. Diet, food rules and allergies can say something about your health or religion, so we keep them only because you add them yourself, use them only for these suggestions, and you can delete them any time in your travel profile.
- Your trips: places, times, notes, ideas, packing lists, bookings, files and photos you add, comments, journal notes and expenses.
- Payment names you choose to add (PayPal.me, Revolut, Wise, UPI or IBAN), so friends on your trips can pay you back. These are only links: money between friends never goes through Travel Whoop.
- Your plan and purchases: whether you have Free or Travel Whoop Pro, until when and whether it renews, and what you bought (a Trip Pass and which trip it is for, or Pro), when, for how much and where (website, App Store or Google Play), with the shop's purchase number. We need this to unlock what you paid for and for our accounts. We never see your card or bank details: the shop you pay with handles them (see below).
- Your travel history, only if you import your Google Maps Timeline. It is used for your own travel globe and nothing else.
- Booking emails you forward to your personal Travel Whoop address: the email is read to find the flight, stay or rental details, which are added to your trip. Emails that match no trip wait in your inbox list until you add or dismiss them.
- Your location, only when you allow it: to show where you are on the day's map and to check you in when you arrive at a planned place. In the iPhone app, automatic check-in watches today's planned places while the app is closed. Your position isn't kept as a history: a check-in saves only which place and at what time. If you add a stop where you are right now, that spot is looked up (Photon) and saved in the trip as a place, like any other.
- Notifications: if you switch them on, the address your phone gives for sending them. On phones without the iPhone app, the app also sends the server the times of your "time to leave" reminders for the next few days, so they can be sent to that phone.
- How the app is used: the day you last opened it (and whether in the iPhone app or the browser), and when someone on a trip opens the video maker or photo book or taps a paid feature or "Unlock". We look at these only as totals (how many people use the app, how many would buy the Trip Pass) on our own usage page.
Cookies and storage on your device
- One login cookie (
tw_session) keeps you signed in for up to 90 days, or until you sign out. - The app also saves a few settings on your device (such as your colours, that you've seen the intro, and your video settings) and a copy of your trips so you can see them without signal.
- These are needed for the app to work as you asked, so they need no separate consent. There are no advertising or tracking cookies, and no outside analytics services.
Who can see it
- Everything in a trip is visible to the people on that trip.
- If you turn on a view-only link or "Use this itinerary", anyone with that link sees the route only: places and times, never people, money, bookings, notes or your own photos.
- If you turn on the link for your travel card, anyone with that link sees the card: your first name (if you chose to show it), your totals and the list of countries. Never dates, trips or places. You can turn the link off at any time.
- Your Google history, password, notification settings, plan and purchases are visible only to you. A Trip Pass shows on its trip, for everyone on it.
- We don't sell your data, and there are no ads. It goes to the outside services below only as far as they need it for what you use.
Outside services the app uses
To show maps, travel times, weather and opening hours, the app asks free public services. These requests contain places and coordinates, not your name or email.
- Maps: OpenFreeMap (your phone loads the map pictures directly, so that service sees your IP address).
- Routes, place search and opening hours: OpenStreetMap services (OSRM, Valhalla, Photon, Overpass). Train and bus times are estimated; "Check times" opens Google Maps.
- Weather forecast: MET Norway (Data from MET Norway, CC BY 4.0). Past and typical weather: NASA Langley Research Center's POWER project. Heights: Mapzen terrain tiles on AWS Open Data (SRTM courtesy of the U.S. Geological Survey; produced using Copernicus data and information funded by the European Union, EU-DEM layers). Public holidays: the date-holidays library (data CC BY 3.0), worked out on our server. Exchange rates: Frankfurter. Photos and descriptions of places: Wikipedia and Wikimedia Commons.
- Ratings, prices and photos of places to eat: Foursquare. It gets the spot's coordinates from our server, not who is asking; photos are passed on through our server too.
- Find a stay: the place, dates and group size go to Stay22, which opens a booking site such as Booking.com. If you book there, Travel Whoop earns a commission. Your name and email are not sent.
- Paying for the Trip Pass or Pro: on the website, Stripe runs the payment page; it gets your email address, the card or other payment details you enter there and your country, and sends receipts. In the iPhone app you pay through Apple's App Store, in the Android app through Google Play, with your Apple or Google account. In every case we receive only a confirmation of what was bought, when and for how much, never your card details. Each of them is responsible for the payment data it collects, under its own privacy policy.
- Printed photo books: the book's pages (with your photos and the trip's places) go to Peecho, which prints and ships the book. You pay on Peecho's checkout page, which collects your name, delivery address, email and payment details; we don't receive your payment details. We keep the book's files for 60 days; Peecho keeps a copy for reprints.
- The satellite map in trip videos: Esri (ArcGIS). Your phone loads these map pictures directly, so Esri sees your IP address.
- Sign-in codes and other emails from us are sent through our email provider, Hostinger.
- Notifications are delivered through your phone's push service (Apple, Google or your browser's).
- The Android app opens this site in Google Chrome, without the address bar.
- Hosting: a server at Oracle Cloud in Frankfurt, Germany, reached through Cloudflare, which protects the site and sees connection details like your IP address. Encrypted backups are kept with Cloudflare R2 storage in the EU.
Most of these services work inside the EU or the European Economic Area. Some are based elsewhere, mainly in the USA (Cloudflare, Stripe, Apple, Google, Foursquare, Esri), or in Canada (Stay22). Where data goes to a country outside the EU/EEA, this is covered by an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified US companies, or the decision for Canada) or by the EU standard contractual clauses in the provider's terms.
Why we may use your data
- To give you the app you signed up for (your account, trips, sharing, bookings, expenses, plans you buy, printed books): this is needed for our agreement with you (Art. 6(1)(b) GDPR).
- Things you choose to turn on (your location, notifications, importing your Google Maps Timeline, your diet, food rules and allergies): your consent (Art. 6(1)(a) and, for diet and allergies, Art. 9(2)(a) GDPR). You can withdraw it at any time by switching the feature off or deleting the data; this doesn't affect what happened before.
- Keeping the service safe and working, and counting how it's used (connection details at Cloudflare, the usage totals above, backups): our legitimate interest in a secure, reliable service (Art. 6(1)(f) GDPR).
- Records of purchases: tax and accounting law (Art. 6(1)(c) GDPR).
We don't make decisions about you by automated means alone. Suggestions such as "Plan it for me" are only proposals you can change.
Videos and pictures you make
Trip videos, the travel globe video and pictures are made on your phone. Photos you pick "from phone" for a video are used only on your phone and are never uploaded.
Deleting your data
- Delete a trip in the trip's options. It is removed with its files and photos.
- Delete your Google history any time in "Your Travel Passport".
- Delete your account in your account settings (tap your initials). Trips only you are on are deleted. On trips you share with friends, your name changes to "Deleted user" so their plan and money stay correct; your email, password, Apple or Google sign-in link, payment names, notifications and Google history are removed.
- Records of purchases are kept for as long as tax and accounting law requires (usually up to 10 years), also after you delete your account, linked to "Deleted user".
- Cancelling Pro: if you bought Pro on the website, cancel it in the app under Your account → Your plan → Cancel Pro (deleting your account also ends it). One bought in the App Store or Google Play is billed by Apple or Google: cancel it there (iPhone: Settings → your name → Subscriptions; Android: Google Play → Payments and subscriptions → Subscriptions).
- Daily backups are kept for 14 days to recover from problems and are then deleted.
- Everything else is kept while your account exists and is deleted with it, as described above.
The website, travel guides and flight search
This policy also covers our website travelwhoop.com, with its travel guides, and the flight search at search.travelwhoop.com. The trip planner and the apps don't use any of the services in this section.
- Hosting: travelwhoop.com is hosted by Hostinger and delivered through Cloudflare. To show the pages and protect them from attacks, they process your IP address and browser details (our legitimate interest in a working, secure website, Art. 6(1)(f) GDPR).
- Visitor statistics on the travel guides: the guides use Google Analytics (Google Ireland Ltd.) and Jetpack Stats (Automattic) to count visits and see which guides are read. They use cookies or similar identifiers and process your IP address and device details; Google may transfer data to the USA under the EU–US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25 TDDDG), which you can withdraw at any time. The home page of travelwhoop.com doesn't use them.
- Affiliate links and the flight search: some links in the guides, and the flight search, are run with Travelpayouts. When you search for flights or click through to an airline, booking site or tour partner, your search and the click are passed on, and the partner may use cookies so that we can earn a small commission at no extra cost to you. You book on the partner's site, under its terms and privacy policy; we don't get your booking or payment details.
Your rights
You can ask us at any time to see the data we have about you (Art. 15 GDPR), to correct it (Art. 16), to delete it (Art. 17), to limit how it's used (Art. 18), or to get it in a common file format to take elsewhere (Art. 20). You can object to uses based on our legitimate interest (Art. 21), and withdraw any consent you gave. Most of this you can do yourself in the app; for anything else, email [email protected].
You also have the right to complain to a data protection authority (Art. 77 GDPR), for example the one in the EU country where you live or work.
Questions
Email us at [email protected].