Privacy Policy

TripSum ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application TripSum (the "App") and our website (the "Site"). By using the App or Site, you consent to the practices described in this policy.

We are based in Toronto, Ontario, Canada. If you have any questions about this Privacy Policy, please contact us at contact@tripsum.app.

Account Information

When you create an account, the sign-in method may vary by region and network routing. In most regions, sign-in may use Sign in with Apple or Google Sign-In through Firebase Auth. In supported mainland China routing, sign-in uses native Sign in with Apple and CloudKit. Depending on method, we may collect your email address and, if provided, your name. You may also optionally set a custom display name and profile photo.

Trip and Expense Data

We collect the trip and expense information you enter, including trip titles, destination countries, currencies, expense amounts, categories, notes, and timestamps.

Receipt Images

When you use the receipt or price tag scanning feature, we process images captured by your device camera or selected from your photo library. These images are stored locally on your device and, if you have an account, synced to secure cloud storage.

Location Information

TripSum does not access your device's GPS or location services. Location addresses associated with expenses are extracted solely from receipt text via optical character recognition (OCR) — not from your device.

Preferences and Settings

We store your in-app preferences, such as home currency, display settings, and notification preferences, to personalize your experience.

Device Information

We may collect basic device information (device model, operating system version) for compatibility and troubleshooting purposes.

We use your information to:

• Provide, maintain, and improve the App's core features
• Process and convert currencies using real-time exchange rates
• Scan and parse receipts and price tags using on-device OCR
• Generate AI-powered categorization, insights, and recommendations
• Sync your data across devices when you are signed in
• Manage your TripSum Plus subscription
• Respond to support inquiries

TripSum uses artificial intelligence to enhance your experience with features such as automatic item categorization, receipt parsing, smart spending insights, and price tag interpretation.

To provide these features, certain data is sent to our AI inference providers through our server-side routing, which may include Cerebras AI and, for supported Hong Kong/mainland China routing, a Tencent-hosted API gateway path to regional model providers. This data may include:

• Item names and descriptions from your expenses
• Text extracted from receipt images via on-device OCR
• Trip metadata (destination, category breakdowns, budget status) for insight generation
• Price information for currency detection and conversion

Important: AI request payloads are limited to feature processing needs. We do not intentionally include direct account identifiers (such as your login email) in AI prompts unless strictly necessary for a requested feature.

You can disable AI-powered categorization at any time in the App's settings. Core features such as manual expense tracking, currency conversion, and receipt scanning via on-device OCR function independently of AI services.

We integrate the following third-party services, each governed by their own privacy policies:

• Firebase (Google LLC) — Authentication, cloud database (Firestore), file storage, and server functions for syncing your data across devices in supported regions
• Apple CloudKit / iCloud (Apple Inc.) — Private iCloud database and asset storage for sync in supported mainland China routing
• Google Sign-In — OAuth-based authentication
• Sign in with Apple — Apple's authentication service
• Cerebras AI — AI-powered language model inference for smart features (region dependent)
• Tencent Cloud (SCF / API Gateway) — Regional API routing for AI requests in supported HK/CN paths
• ExchangeRate-API (open.er-api.com) — Real-time currency exchange rates
• Apple StoreKit 2 — In-app subscription management

We encourage you to review the privacy policies of these services for details on how they handle your data.

TripSum uses a local-first architecture. Your data is stored on your device using CoreData and is fully functional offline. If you create an account, your data is synced using one of two cloud paths: Firebase (Firestore and Storage) or Apple CloudKit (private iCloud database), depending on region and network routing.

CloudKit path requirement: CloudKit sync requires iCloud to be enabled on your device and an Apple ID with CloudKit access.

We implement industry-standard security measures to protect your information:

• All data transmitted between the App and cloud services is encrypted in transit using TLS
• Cloud-stored data is encrypted at rest by our cloud providers (including Firebase and Apple CloudKit)
• API keys and credentials are stored securely and are not embedded in client-side code
• Receipt images are compressed and stored with unique identifiers

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

Your data is retained for as long as your account is active or as needed to provide you with our services. You may delete your account at any time from within the App, which will remove your authentication identity and associated settings.

To request complete deletion of all your data (including cloud-stored trips, expenses, and receipt images), please contact us at contact@tripsum.app. We will process deletion requests within 30 days.

Data stored in Firebase and CloudKit may be maintained as separate backend datasets. If you have used both backend paths, deletion may need to be processed for each path.

If you use the App in guest mode (without an account), your data is stored only on your device and can be removed by uninstalling the App.

TripSum is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

Your information may be transferred to and processed in countries other than your own, including countries where our service providers (such as Google Firebase, Apple, Cerebras, and Tencent Cloud) operate. These countries may have different data protection laws. By using TripSum, you consent to such transfers and processing, subject to applicable law and available safeguards.

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal data
• Portability — Request your data in a structured, machine-readable format
• Opt-out — Disable AI-powered features or withdraw consent for data processing

To exercise any of these rights, please contact us at contact@tripsum.app. We will respond within 30 days.

If you are a resident of the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR). If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA). We honor all applicable data protection rights.

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this page and, where appropriate, notify you via the App or our website. Your continued use of TripSum after any changes constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: