Your privacy.

Privacy notice · Updated 23 October 2026

Who is responsible

Li Studios LTD is the controller of personal information handled by Triplingo. Registered in England and Wales, company number 17221087. Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For privacy requests, contact hello@triplingoapp.com.

Who can use Triplingo

Triplingo is for people aged 13 or over, or older where local law requires it. If you are under 18, you need a parent’s or guardian’s permission to buy Plus. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us so we can delete it.

Accounts, devices and local trips

We process your name, email, username, password hash, sign-in sessions and account settings to provide and secure your account. Session records may include your IP address and browser/device information. Most personal trip content and learning progress are stored on your device. Information you explicitly send to an online feature is also processed as explained below. Website hosting receives ordinary request information such as IP address and requested URL. Essential session cookies maintain sign-in; we do not use advertising trackers on this website.

AI trip planning

When you ask Tingo to plan, we send OpenAI the destination, dates, interests, budget, pace, travel-party age groups, transport and accessibility preferences you provide, selected and skipped places, existing stop times, and relevant previous-trip place names if you choose to use them. An accommodation base is included if you add one. Your name, email address and account ID are not included. Do not put health diagnoses, private booking codes or other sensitive information into free-text planning fields. Booking documents, confirmation codes and expense records are not included automatically.

We store generated results and usage records to return your plan, recover requests and enforce allowances. We request API responses with storage disabled; this is not a promise that OpenAI retains no data for safety or legal purposes. Its provider retention and security rules also apply. Manual planning is available if you do not want to send planning information to AI. Suggestions do not make legal or similarly significant decisions about you.

Importing posts and links

AI imports require Plus. We process the public link and any caption or text you paste to identify places, and send relevant text to OpenAI. A public post may still be inaccessible to automated requests. Private accounts and login-protected content are not accessed. Review extracted places before adding them. Only paste information you are entitled to share, and avoid personal information about other people.

Places, maps, routes and pronunciation

When you search for a place, the app sends your search text and the destination’s coordinates directly to Photon, a place search service run by komoot. Routes between your stops are calculated by the OpenStreetMap routing service at routing.openstreetmap.de, run by FOSSGIS, which receives the coordinates of that day’s stops. Maps are drawn with OpenStreetMap tiles. These requests do not include your account details, but like any website the services receive ordinary request information such as your IP address.

To find place details and photos, our server sends a place name, destination or place coordinates, without your identity, to public encyclopaedia, photo and location services, including Wikipedia, Wikimedia Commons, Openverse, Photon and OpenStreetMap. Loading external photographs can disclose request information to their hosts. Opening Google Maps, a venue website or another external link is governed by that provider’s privacy notice.

Place photographs carry available source credits. If none is found, we show a reusable themed illustration; we do not generate a new AI picture of your place. Requested visitor information may use OpenAI with public-source search. Pronunciation audio is generated by OpenAI from the selected course phrase; only the phrase text is sent. Public place details, photos and course audio can be cached for reuse; private itinerary details are not intentionally included in those reusable media files.

Sharing with friends

Choosing to share uploads the itinerary shown in the sharing preview: destination, dates, places, scheduled times and shared notes. People who accept your invite can view it. You can revoke a member or stop sharing. Revocation stops future service access but cannot remove copies or screenshots already made by a recipient.

Why we use information

Our contractual basis covers accounts and features you request, such as planning, importing and sharing. Our legitimate interests cover account security, preventing misuse, measuring service costs and responding to support requests; we balance these interests against your rights. Legal obligations may require us to retain records or respond to lawful requests. Where processing needs consent, you may withdraw it without affecting earlier lawful processing. Travel-party age groups describe your trip; they are not a request for a child’s name or exact date of birth.

Providers and international processing

Vercel hosts the website/API, Turso stores account and service records, and OpenAI provides the AI features you request, including pronunciation audio. Resend sends account verification and password-reset emails; email correspondence may also be handled by our Spacemail mailbox.

Plus is sold through the Apple App Store and Google Play. RevenueCat manages subscriptions and purchases for us: it receives your Triplingo account ID as its app user ID, together with store transaction identifiers, purchase dates and subscription status from Apple or Google. We do not receive your full payment-card details. Place search, routing and map requests go to Photon and the OpenStreetMap services described above, under their own privacy notices.

These services may process data outside the UK. Where a restricted international transfer occurs, applicable adequacy arrangements or approved contractual safeguards are required. Contact us for information about the safeguards applicable to your data. This notice does not claim that every provider stores all information in the UK.

Retention and deletion

Account-linked records, generated plans and sharing data are retained while needed to provide your account and saved online results, unless you remove them or delete your account. Sign-in sessions expire after seven days without use, and expired session records, including their IP address and browser/device information, are deleted automatically. Reset links expire after 30 minutes and verification links after one hour. Expiry invalidates access and is not a claim of immediate physical deletion from every provider log or backup.

Deleting your account removes its active server account records, sessions, generated jobs and owned shared plans through linked-record deletion. Local trips remain on your device unless you erase them. Records of extra-trip purchases keep your account ID and the store transaction ID after deletion, so a purchase cannot be redeemed twice and refunds and disputes can be handled. Service spending records without your profile and security audit records containing account identifiers and administrative actions may also remain for abuse prevention, disputes and legal obligations. Apple, Google and RevenueCat keep their own purchase records. Provider logs/backups follow their own retention controls. We assess requests to delete retained personal records separately rather than promising that account deletion instantly removes every historical record.

Your rights and choices

You may request access, correction, deletion, restriction or portability where applicable, object to processing based on legitimate interests, and withdraw consent. We may need to verify your identity. We normally respond within one month; we will explain any lawful extension or exception. You can use the app’s account controls or our account deletion page, or email us for help.

You can complain to the UK Information Commissioner’s Office or your local supervisory authority. You do not have to contact us first, although we welcome the opportunity to resolve a concern. Material changes to this notice will be dated and communicated as appropriate. See our terms for service and subscription details.