Privacy Policy

This Privacy Policy (the "Privacy Policy") describes and governs how KOTRIP, operated by Colin Schneider, sole proprietor of the KOTRIP sole proprietorship, Switzerland (hereinafter referred to as "we", "our", "us" or the "Data Controller"), collects, uses, stores and discloses information about you when you access our website and use our mobile application and other online services (collectively, the "Services").

Please read this Privacy Policy carefully before using the Services. By accessing or using the Services, you agree to be bound by this Privacy Policy and by our Terms of Use available at https://kotripapp.webflow.io/terms-condition (the "Terms of Use"), which are incorporated herein by reference, and you agree to comply with all applicable laws, rules and regulations (collectively, the "Applicable Law"). If you do not agree with this Privacy Policy or the Terms of Use, you should not access or use the Services.

For any questions regarding data protection or to exercise your rights, you may contact the Data Controller at:

support@kotrip.app

Personal Information We Collect

We collect information that identifies you, relates to you, describes you, or could reasonably be associated with you ("Personal Information") in various ways when you interact with our Services. The Personal Information we collect depends on how you interact with us and may include the following categories:

Information You Provide to Us

This may include :

Contact and profile information: first and last name, email address, username, password, date of birth, country of residence, preferred language and preferred currency.
User-generated information: information you provide directly through the Services, such as your trips (destination, dates, number of travelers), flights, accommodations, planned activities, task lists, expenses, budgets and voting proposals among friends.
Location information: see "Location and Address Information" below.
Payment and transaction information: information relating to your KOTRIP Pro subscription. We do not have access to your payment card numbers. If you subscribe through the App Store, payment information is collected and processed by Apple in accordance with their respective privacy policies. We encourage you to review the privacy policy of the relevant provider for more information.
Communications with our support team: the content of communications you have with our support team.
Inferences: we may make inferences based on the information we collect, such as your preferred travel destinations, in order to improve travel suggestions.

Information Collected Automatically

When you access or use the Services, we may automatically collect certain information, including:

device and usage information, such as your IP address (which may be used to determine your general location), browser type, operating system, pages viewed, and the date and time of your visits;
an internal user identifier generated by our authentication provider;
limited technical logs necessary for the proper operation and security of the Application (e.g., errors and failed login attempts);
preferences stored locally on your device (light/dark theme, favorites, notifications already viewed), which remain on your device and are not transmitted to us.

We do not use advertising tracking technologies (pixels or third-party advertising SDKs) and we do not display advertisements in the Application.

Location and Address Information

With your direct action, our Services connect to third-party services to convert addresses you enter into geographic coordinates (in particular through OpenStreetMap / Nominatim; see "Where Your Information Is Stored" and "Who We Share Your Personal Information With" below). This information may include:

the address and GPS coordinates of accommodations you save;
the address and GPS coordinates of activities you plan;
the city and country of your trips, used to display local weather and convert currencies.

If you authorize access to your device's location, the Application may display your approximate position on a map so that you can see your location in relation to your activities. We do not track your location in the background and do not maintain continuous location history.

Information You Share With Other Users

KOTRIP offers optional social features that allow multiple users to collaborate on the same trip. If you choose to use these features:

Trip sharing: you may generate a sharing code and password allowing another person to join your trip. Once the trip has been joined, certain information relating to that trip (expenses, amounts paid, task lists, activities and votes) becomes visible to all participants in the shared trip, including your displayed name.
Expense splitting: when you record a shared expense, the names of the people participating in the split (including people you designate as the "payer" who may not necessarily be Application users) may be visible to other participants in the trip.

The collection and use of information relating to a person referenced in a shared trip (before any potential registration) is limited to facilitating the sharing functionality and is governed by this Privacy Policy. We recommend that you only share trips with people you trust, as this information is not anonymized between participants of the same trip.

How We Collect Your Personal Information

We collect your Personal Information from the following sources:

Directly from you. We collect Personal Information directly from you. When you register for the Services, enter information into a form, or communicate with us or our support team, you may provide information such as your name and email address. We process this information in accordance with the legal bases described in the section "Our Legal Bases for Processing Personal Information".
From third-party services. We may obtain geographic coordinates, weather information and exchange rates from third-party providers based on the information you enter (address, city, currencies). See "Who We Share Your Personal Information With" below.
From other users. If another user adds you as a participant to a shared trip or designates you as the payer of an expense, certain information relating to you (such as your name) may be provided to us by that user.

Where Your Information Is Stored

Personal Information and user-generated data. Contact information, account information and travel-related data are stored through our cloud infrastructure provider, Supabase. Our Supabase project is hosted in the Central Europe (Zurich) region, where the primary database and associated user data are stored.
Subscription information. KOTRIP uses RevenueCat to manage subscription status and validate purchases made through the Apple App Store. RevenueCat may process and store relevant subscription and technical information in the United States as described in its own privacy documentation and applicable data processing agreements.
Third-party functionality. Certain information may also be transmitted to third-party providers such as OpenStreetMap/Nominatim, Open-Meteo, AviationStack and Google Maps Platform when you use features relying on those services. The information transmitted is limited to what is necessary to provide the relevant functionality.
Local preferences. Certain preferences (display theme, favorites and notifications already viewed) are, by default, stored and processed locally on your device and are not transmitted to our servers.
Email delivery. KOTRIP uses Resend as an SMTP email delivery provider connected to Supabase Auth. Resend is used to deliver transactional emails such as account verification emails, password reset emails, email change confirmations and other authentication-related messages. Resend may process and temporarily store information necessary to deliver these emails, including email addresses, email metadata and message content. Resend states that customer data is stored in the United States.
Password reset page hosting. KOTRIP uses Vercel Inc. to host and deliver the web page used in connection with password reset flows. When accessing this page, limited technical information, such as IP address, browser information and HTTP request data, may be processed by Vercel as necessary to deliver and secure the page.
Product analytics. KOTRIP uses PostHog (EU Cloud) to collect and analyze usage data. This data is hosted within the European Union.

By using the Services or otherwise providing us with information, you understand and consent to your Personal Information being transferred to and processed in this jurisdiction. If you reside in the European Union (the "EU") or Switzerland, we transfer your Personal Information in accordance with applicable data protection laws. You understand that the jurisdiction in which your data is hosted may not provide the same level of protection as the laws of your country. In certain circumstances, judicial, regulatory or security authorities in that jurisdiction may be authorized to access your Personal Information.

How We Use the Information We Collect

We may collect and use your Personal Information for the following purposes:

To provide the Services. We use your Personal Information and travel data to provide our Services, including trip planning, sharing and budget tracking features.
To provide and improve customer service. We use your contact information to respond to your questions and requests, inform you about changes to the Services, and maintain and improve their operation.
For analytics. We use a product analytics tool (PostHog) to understand how users interact with our Services, improve our features, and measure the performance of the Application. This may include information such as your internal user identifier, the screens and features you interact with, your country and preferred language, and technical information about your device. This data is not used for advertising purposes.
Restrictions. We do not use your travel or expense data for advertising or marketing purposes.

Who We Share Your Personal Information With

With service providers. We share information with providers and contractors who help us provide, maintain and improve the Services, including:

Supabase Inc. — database hosting and account authentication;
RevenueCat, Inc. (United States) — technical subscription management and purchase validation;
Apple Inc. — payment processing and subscription billing through the App Store;
OpenStreetMap Foundation (Nominatim service) — conversion of entered addresses into geographic coordinates;
Open-Meteo — displaying local weather based on the city and country of your trip;
Frankfurter API — currency exchange rate calculations;
Google LLC (Google Maps Platform) — displaying interactive maps and location markers.
Resend (Plus Five Five, Inc., United States) — SMTP email delivery for authentication and transactional emails sent through Supabase Auth.
Vercel Inc. — hosting and delivery of the web page used for password reset and authentication-related flows.
PostHog (Ireland) Ltd. — product analytics, to understand feature usage and improve the Services.

With other users, at your initiative. When you activate a trip-sharing or expense-splitting feature, certain information about you (display name, expenses and amounts) is shared with the other participants in the relevant trip, as described in the "Information You Share With Other Users" section above.

As required by law. We may share your information with competent authorities if we believe that disclosure is permitted or required by Applicable Law, including legitimate requests from public authorities relating to national security or law enforcement.

In connection with business transactions. In the event of a takeover, conversion into a company, merger or sale of assets of the KOTRIP sole proprietorship, we may transfer your Personal Information to the parties involved in the transaction. Such recipients will be required to protect your information through a confidentiality agreement or comparable obligation.

How We Share Your Information

With your consent. We may disclose or share your information with your consent, including by accepting the Terms of Use or activating a sharing feature.
In connection with a business transfer. We may disclose or share your information as part of a business transaction (takeover, merger, legal conversion, asset sale), including in the event of cessation of business, in which case such information may be transferred to third parties as a business asset.
With unaffiliated third parties. We may disclose or share your information with certain unaffiliated third parties for various business purposes, including to facilitate your access to and use of our Services. These third parties may include Internet service providers and related professionals, data analytics providers, government entities, operating systems and platforms, and service providers.
For legal and protection purposes. We may disclose or share your information to comply with a law, regulation, legal proceeding or governmental request, or when we believe in good faith that access, use, storage or disclosure of such information is reasonably necessary to:protect our rights, interests, property or safety, or those of others;in connection with claims, disputes or legal proceedings;protect users of our website and Services against fraudulent, abusive or unlawful use.

Mapping, Weather and Currency Exchange (Integrated Third-Party Services)

To provide practical travel-planning features, our Services rely on third-party technical providers:

Address geocoding (OpenStreetMap / Nominatim). When you search for or confirm an address (hotel, activity), the text of your search is transmitted to this service to obtain GPS coordinates. No account information (name or email address) is transmitted with this request.
Mapping (Google Maps). The display of maps and location markers in the Application relies on Google Maps Platform and is subject to Google's privacy policy.
Weather (Open-Meteo). The city and country of your trip are transmitted to this service to display the corresponding local weather.
Currency exchange rates (Frankfurter API). The currency codes you select are transmitted to this service to calculate exchange rates; no Personal Information is transmitted in this context.

We only transmit to these providers the minimum information necessary to provide the relevant functionality.

We Do Not Sell Your Personal Information

We do not sell your Personal Information for monetary compensation. We work with trusted third-party service providers, such as cloud hosting and infrastructure providers, who process data solely on our behalf in order to operate and provide the Services.

Links and Third-Party Websites

Our Services may contain links to websites and services operated by our partners, suppliers, advertisers, licensees and other third parties (collectively, the "Third-Party Services"), including social networks such as Instagram, YouTube and TikTok, accommodation booking websites such as Booking.com, and airline websites.

We do not control the content or links that appear on these Third-Party Services and are not responsible for their practices. These Third-Party Services may have their own privacy policies and customer-service policies. Browsing and interacting with any such Third-Party Services is subject to their own terms and policies.

Our Content on Third-Party Services

Our Services may be offered or hosted on a third-party platform or may use Third-Party Services, including the App Store for distribution of the Application.

We do not control the content or links that appear on these Third-Party Services and are not responsible for the practices employed by them. Your browsing and interactions with these Third-Party Services are subject to their own terms and policies. Any visit you make to these services is at your own risk.

Your Choices

You have certain choices regarding the processing of your Personal Information, as described below:

Modification of Personal Information. You may review and request modification of your Personal Information by editing your profile directly in the "Profile" section of the Application or by contacting us at support@kotrip.app. We will retain data for as long as reasonably necessary to fulfill the purpose for which it was collected, or as required or permitted by Applicable Law.
Trip sharing and social features. You may choose never to activate trip-sharing or expense-splitting features. If you have activated them, you may leave a shared trip or delete expenses you have recorded at any time, subject to information that may already have been viewed by other participants.
Account deletion. You may request deletion of your account and Personal Information directly from the "Profile" section of the Application using the "Delete Account" option, or by contacting us at support@kotrip.app.
Marketing communications. You may opt out of promotional marketing communications by contacting us at support@kotrip.app. If you opt out, we may continue to send you non-promotional communications, such as account-related communications.
Location services. You may disable access to your device's location at any time through your device settings. This may limit certain mapping features of the Application.
Not providing Personal Information. You may choose not to provide certain Personal Information. However, if you do not provide such information, we may not be able to provide you with all or part of our Services.

Information Security

We use commercially reasonable security technologies and procedures to protect your Personal Information against unauthorized access, use or disclosure, including:

encryption of data in transit (TLS/HTTPS) between the Application and our servers;
password hashing (passwords are never stored in plain text);
database-level access control rules limiting each user's access to their own data or data explicitly shared with them;
limiting login attempts and temporary blocking mechanisms in cases of suspicious activity.

However, we cannot guarantee the absolute security of your information. You are responsible for maintaining the confidentiality of your login credentials.

Security Incident Notification

In the event of a security breach or unauthorized access to your Personal Information that is likely to result in a high risk to your rights and freedoms, we will notify you in accordance with Applicable Law, including, where applicable, the Swiss Federal Act on Data Protection (FADP) and the GDPR.

Where required by law, such notification will be sent to the email address associated with your account within the time periods prescribed by Applicable Law. If you believe that your account has been compromised, please contact us immediately at support@kotrip.app

Retention of Your Information

We retain your Personal Information for the shortest period necessary for our relationship with you, to provide access to our Services, and in accordance with our data-retention policies and Applicable Law. More specifically:

Contact and profile data are retained while your account remains active, and thereafter for a reasonable additional period to comply with ongoing obligations or resolve potential disputes.
Travel, activity, expense and budget data are retained while your account remains active or for as long as necessary to provide the Services. You may request their deletion at any time by contacting us at support@kotrip.app
Billing and subscription data are retained for the period required by applicable accounting and tax obligations (generally up to 10 years in Switzerland for accounting records).
Aggregated and anonymized data may be retained indefinitely for the purposes of improving the Services, preventing fraud and performing analytics, provided that such data can no longer reasonably be used to identify you.

Minors and Children

Our Services are not intended for individuals under the age of 16. We verify the date of birth during registration to ensure that this requirement is met, and we do not knowingly collect Personal Information from individuals under 16.If we become aware that we have collected Personal Information from a person under 16, we will delete such information as soon as reasonably possible.

If you believe that we have inadvertently collected information from a person under 16, please contact us at support@kotrip.app.

Jurisdiction-Specific Information (Outside Switzerland and the EU)

Depending on your place of residence, you may have rights similar to those described in this Privacy Policy under applicable laws, such as the California Consumer Privacy Act (CCPA/CPRA) in California or other comparable data protection laws adopted in other U.S. states or jurisdictions.

Regardless of your place of residence, and to the extent permitted by Applicable Law, we provide you with the following rights:

the right to know which categories of Personal Information we collect, use and disclose about you;
the right to access a copy of your Personal Information;
the right to request deletion of your Personal Information;
the right to request correction of inaccurate information;
the right not to be discriminated against for exercising these rights.

During the 12 months preceding the date of this Privacy Policy, we have not sold or "shared" (as defined by the CCPA) any Personal Information for targeted advertising purposes. We have disclosed Personal Information only as described in this Privacy Policy.

Exercising Your Rights

To request access to, correction of or deletion of Personal Information collected through your use of the Services, please contact us at support@kotrip.app
To verify your identity before processing your request, we may ask you to confirm certain information that we hold about you or regarding your interactions with us.
You may appoint an "authorized agent" to submit a request on your behalf. Such agent may submit the request in the same manner, but we may require written and signed authorization as well as independent verification of your identity.

We will respond to your verified request within a reasonable period and, in any event, within the time limits required by Applicable Law (for example, 30 days for requests subject to the GDPR, extendable by an additional two months where the request is complex).

"Do Not Track" and Global Privacy Control Policy

Our Services do not respond to "Do Not Track" (DNT) signals from browsers. However, we respect the "Global Privacy Control" (GPC) signal.

If you transmit a GPC signal through a browser or extension that supports it, we will treat the signal as a valid request to opt out of the sale or sharing of your Personal Information for that browser, to the extent required by Applicable Law.

Information for Residents of the European Economic Area, the United Kingdom and Switzerland

This section applies where the processing of your Personal Information is subject to the data protection laws of the European Economic Area, the United Kingdom or Switzerland (collectively, the "European Data Protection Laws", including the Swiss Federal Act on Data Protection (FADP) and the GDPR).

For purposes of this section, "Personal Information" refers to the same information described elsewhere in this Privacy Policy and constitutes "personal data" under the GDPR and the FADP.

Our Legal Bases for Processing Personal Information

We only process your Personal Information where we have a legal basis to do so under Applicable Law. Depending on the context and purpose of the processing, our legal bases may include:

Performance of a contract, including processing necessary to provide the Services, manage your account and perform the features you request (trip planning, sharing and subscriptions);
Compliance with legal obligations, including accounting and regulatory requirements;
Our legitimate interests, such as operating and improving the Services, preventing fraud, securing our systems and responding to your requests; and
Your consent, where required by European Data Protection Laws, including for activation of trip-sharing features.

Where processing is based on consent, you may withdraw your consent at any time, as described below.

Your Rights Regarding Your Personal Information

In addition to the rights described elsewhere in this Privacy Policy, you may have the following rights under European Data Protection Laws:

Access. The right to request access to your Personal Information;
Rectification. The right to request correction of inaccurate or incomplete Personal Information;
Erasure. The right to request deletion of your Personal Information, subject to legal exceptions;
Data portability. The right to receive your Personal Information in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller;
Objection. The right to object to certain processing of your Personal Information, including processing based on our legitimate interests;
Restriction of processing. The right to request restriction of processing in certain circumstances; and
Withdrawal of consent. Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Complaints and Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority:

In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch
In the EU/EEA: the data protection authority in your country of habitual residence, place of work, or where the alleged violation occurred;
In the United Kingdom: the Information Commissioner's Office (ICO) — ico.org.uk.

International Transfers

KOTRIP uses third-party service providers located in different countries to provide and operate the Services. As a result, certain Personal Information may be transferred to, stored in, or processed in countries outside Switzerland and the European Economic Area.Your Personal Information and user-generated content are primarily stored through Supabase in the geographic region selected for our Supabase project. Where our Supabase project is hosted in the Central Europe (Zurich) region, the primary database and user-generated data are hosted in Switzerland. However, certain third-party providers used by KOTRIP may process information outside Switzerland or the European Economic Area. These providers may include RevenueCat, Resend, Google Maps Platform, AviationStack and other infrastructure or service providers used to operate specific features of the Services.In particular, RevenueCat and Resend may process Personal Information in the United States. RevenueCat uses Amazon Web Services (AWS) for data storage, while Resend states that its customer data is stored in the United States. Where required by applicable data protection laws, these providers use appropriate safeguards for international data transfers, including Standard Contractual Clauses and other legally recognized transfer mechanisms. Resend also states that it participates in the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework. These providers may include RevenueCat, Google Maps Platform, AviationStack — flight information services; only flight-related search parameters are transmitted and no account information such as name or email address is transmitted. In particular, RevenueCat, which KOTRIP uses to manage and validate subscriptions and related purchase information, states that customer data is stored on Amazon Web Services (AWS) in the United States. RevenueCat provides contractual and other safeguards for international data transfers where required by applicable data protection laws. Where Personal Information is transferred to a country that does not provide an adequate level of data protection under applicable law, KOTRIP will rely on an appropriate legal mechanism, such as an adequacy decision, Standard Contractual Clauses, or another legally recognized transfer safeguard, where required.KOTRIP only transfers information that is reasonably necessary for the relevant third-party service to provide its functionality. The categories of information transmitted depend on the feature being used and are described in the relevant sections of this Privacy Policy.By using the Services, you acknowledge that certain Personal Information may therefore be processed outside Switzerland, including in the United States, subject to the safeguards required by applicable data protection laws.

Use and Deletion of Personal Information

You may request information about which Personal Information we have collected, used and disclosed about you, as well as the identity of the third parties to whom we have disclosed your Personal Information.

You may also request deletion of your Personal Information. Please note that we may not delete all of your information if:

we need it to provide a service you have requested or fulfill a contract with you;
we need it to correct errors affecting our Services or detect security breaches; or
we need it to protect against fraud or illegal activity or to comply with Applicable Law.

Please note that if we delete your Personal Information, we may no longer be able to provide the Services with the same functionality.

For any request regarding your Personal Information or its deletion, please email us at support@kotrip.app.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. We encourage you to review this page regularly for any changes.

You acknowledge and agree that it is your responsibility to periodically review this Privacy Policy and become aware of any changes. Subject to Applicable Law, your continued use of the Services will be deemed acceptance of the revised Privacy Policy.

In the event of a material change to this Privacy Policy, we will notify you by posting a notice in the Application or sending you an email before the change takes effect.

Material changes include, without limitation, changes concerning the categories of Personal Information we collect, the purposes for which we use it, or the third parties with whom we share it.

Contact Us

If you have any questions regarding this Privacy Policy, you may contact us at: support@kotrip.app