Privacy Policy for Your Group Trip

Last Updated: March 2026

1. Introduction

Your Group Trip ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and otherwise process your personal information through our mobile application (the "App") and related services.

This Privacy Policy applies to all users of Your Group Trip, regardless of location. We comply with applicable privacy laws in all territories where our App is available, including the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), UK GDPR, and other international privacy regulations.

2. Information We Collect

2.1 Information You Provide Directly

Authentication & Account Information:

Email address
Username/Display name
Password (securely encrypted by Firebase Authentication)
Profile information you choose to add

Group & Activity Information:

Group membership details
Expense records (amounts, participants, descriptions)
List items and tasks you create or manage
Vote participation data
Draw/lottery participation records

Communication Data:

Messages within groups
Invitation links and sharing data

2.2 Information Collected Automatically

Device & Usage Information:

Device type, operating system version, and unique device identifiers
App usage patterns and interaction data
Crash logs and error reporting
App version and performance metrics
Approximate location (based on IP address, not GPS)

Advertising & Analytics:

Google Mobile Ads (AdMob) collects advertising identifiers
App analytics through Firebase Analytics
Advertising interaction data

Local Storage:

Authentication tokens stored securely in your device's local storage (AsyncStorage)
Cached data for offline functionality

3. How We Use Your Information

3.1 Primary Uses

Account Management: Creating and maintaining your user account, authentication, and password management
Service Delivery: Enabling core App functionality (expense tracking, group management, lists, draws, voting)
Communication: Sending service-related notifications, group invitations, and administrative messages
Data Synchronization: Syncing your data across devices and maintaining backup on our Firestore database
Deep Linking: Processing group invitations and enabling seamless app navigation

3.2 Secondary Uses

Analytics: Analyzing user behavior to improve App performance and user experience
Security: Detecting and preventing fraud, abuse, and security threats
Legal Compliance: Fulfilling legal obligations and protecting our legal rights
Customer Support: Responding to your inquiries and providing technical assistance

3.3 Legal Basis for Processing (GDPR)

Contract: Processing necessary to perform our services with you
Legitimate Interest: Improving services, security, and analytics
Legal Obligation: Complying with laws and regulations

4. Data Sharing and Disclosure

4.1 Within Your Groups

Information you share within groups (expenses, profiles, lists, votes) is visible to all group members you authorize.

4.2 Third-Party Service Providers

We share your information with the following third parties who process data on our behalf:

Google/Firebase Services:

Firebase Authentication (manages secure login)
Firestore Database (stores group, expense, and activity data)
Firebase Analytics (analyzes app usage patterns)
Google Mobile Ads/AdMob (serves non-personalized advertisements)

For more information, see Google's Privacy Policy: https://policies.google.com/privacy

Data Processing Agreement: Google processes personal data as a data processor under the Data Processing Addendum included in Firebase terms.

4.3 Legal Requirements

We may disclose personal information if required by:

Court order or legal process
Government or law enforcement request
Protection of legal rights or safety
Enforcement of our Terms of Service

4.4 No Sales of Data

We do NOT sell your personal information to third parties for commercial purposes.

5. Data Storage and Security

5.1 Where Data is Stored

Cloud Storage: Firestore database (Google-managed servers, typically in US regions)
Local Storage: Encrypted authentication tokens on your device (AsyncStorage)
Authentication: Firebase Authentication (Google-managed)

Your data may be transferred to, stored in, and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws. By using Your Group Trip, you consent to this transfer.

5.2 Security Measures

End-to-end encryption for sensitive data (passwords are hashed by Firebase)
Secure HTTPS/TLS encryption for all data in transit
Firebase security features including identity verification
Regular security audits and monitoring
Account-level security controls (email verification, password requirements)

Note: While we implement industry-standard security measures, no method is 100% secure. We encourage you to use strong passwords and enable device security features.

5.3 Data Retention

Account Data: Retained while your account is active
Expense/Activity Data: Retained for the duration of your group memberships
Logged/Analytics Data: Typically retained for 12-24 months
Deleted Accounts: Personal data is deleted within 30 days of account deletion request

You can request deletion of your account by contacting privacy@Your Group Trip.com. Group-related data may be retained if necessary for group operations or legal compliance.

6. Your Privacy Rights and Choices

6.1 GDPR Rights (EU Users)

Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your data ("Right to be Forgotten")
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in a portable format
Right to Object: Object to processing for marketing or profiling
Right to Lodge a Complaint: Contact your local data protection authority

6.2 CCPA Rights (California Users)

Know: What personal information is collected, used, and shared
Delete: Request deletion of personal information (with exceptions)
Opt-Out: Opt out of the sale or sharing of personal information
Non-Discrimination: Not be discriminated against for exercising CCPA rights

6.3 Other Rights

Right to Withdraw Consent: Withdraw consent for marketing communications
Account Controls: Manage privacy settings within the App
Device Settings: Control advertising and tracking through your device settings

6.4 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: support@your-group-trip.com

We will respond to verified requests within 30 days (or as required by applicable law).

7. Advertising and Marketing

7.1 Non-Personalized Advertising

We use Google Mobile Ads (AdMob) to display non-personalized advertisements.

8. Children's Privacy

Your Group Trip is not intentionally designed for children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under 13.

If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete such information and suspend the child's account.

For Parents/Guardians: If you believe your child has created an account in Your Group Trip, please contact us immediately at support@your-group-trip.com.

9. Third-Party Links and Services

Your Group Trip may contain deep links to Firebase-hosted web pages, and references to third-party services. This Privacy Policy does not apply to third-party websites or services. We encourage you to review their privacy policies before providing information. We are not responsible for the privacy practices of third parties.

10. Cookies and Similar Technologies

Your Group Trip may use:

Authentication Tokens: To keep you logged in securely
Analytics Cookies: To understand app usage (via Firebase)

These technologies are stored on your device and used to enhance functionality and personalization. You can control many of these through device settings.

11. International Data Transfers

Your personal information may be transferred to, stored in, and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home country.

For EU Users: We rely on Standard Contractual Clauses (SCCs) for Google/Firebase transfers, adequacy decisions where applicable, and your explicit consent to international transfers.

By using Your Group Trip, you consent to the transfer of your information to countries outside the European Economic Area.

12. Data Processing Details

12.1 Firebase (Google Cloud)

Purpose: Authentication, real-time database, analytics

Data Categories: Email, username, password hash, group data, activity logs

Retention: While account active, 30 days after deletion

Subprocessors: Google Cloud infrastructure partners

For details: https://firebase.google.com/support/privacy

12.2 Google Mobile Ads (AdMob)

Purpose: Serving and non-personalizing advertisements

Data Categories: Advertising ID, app usage, general location

Retention: According to Google's retention policies

12.3 AsyncStorage (Local Device Storage)

Purpose: Local caching and offline functionality

Data Categories: Authentication tokens, cached app data

Retention: Until app uninstall or manual deletion

13. User Responsibilities

Maintaining the confidentiality of your password
Not sharing your account with others
Reporting unauthorized access immediately
Keeping your contact information current
Using the App in accordance with our Terms of Service

14. Data Breach Notification

In the event of a data breach affecting your personal information, we will:

Notify affected users without undue delay
Provide details of the breach and potential impact
Offer guidance on protective measures
Comply with all notification requirements under applicable law

Notifications will be sent via email or in-app notification to the address associated with your account.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technological advancements, legal and regulatory changes, or other operational reasons.

Notification of Changes:

Significant changes will require your explicit consent
We will notify you via email or prominent in-app notification
The "Last Updated" date will be revised

Your continued use of Your Group Trip after policy changes constitutes acceptance of the updated terms.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact:

Privacy & Data Protection Officer

Email: support@your-group-trip.com

For EU Users:

EDPB: https://edpb.europa.eu/
Your National DPA (e.g. Bundesdatenschutzbeauftragte, CNIL, ICO)

For California Users:

California Attorney General: https://oag.ca.gov/privacy/ccpa
Your local district attorney

17. Additional Information by Region

A. European Union (GDPR Compliant)

Under GDPR, you have comprehensive rights including access, rectification, erasure, restriction, portability, and objection. Data processing is lawful if a legal basis exists (contract, consent, legitimate interest, legal obligation, vital interest, or public task). Our Data Processing Agreement with Google/Firebase includes Standard Contractual Clauses for lawful international transfers. We conduct Data Protection Impact Assessments for high-risk processing.

B. United Kingdom (UK GDPR)

UK GDPR provides protections equivalent to GDPR. Our processing complies with UK GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

C. United States (CCPA/CPRA - California)

California residents have rights to know, delete, opt-out, and non-discrimination. We respond to verified requests within 45 days. We do not sell personal information to third parties for money but may share with service providers.

D. Australia (Australian Privacy Act)

We comply with the Privacy Act 1988 (Cth) and Australian Privacy Principles. You have rights to access, amend, and complain. We collect only necessary information for functions and activities, using overseas disclosures with contractual protections.

E. Canada (PIPEDA)

We comply with PIPEDA principles including accountability, identifying purpose, consent, limiting collection, limiting use, accuracy, safeguards, openness, access, and challenge accuracy. Canadian residents can request access to personal information held.

F. Other Jurisdictions

For other countries, we comply with applicable privacy laws and provide equivalent protections where required.

18. Definitions

Personal Information: Any information relating to an identified or identifiable person
Processing: Any operation performed on personal information (collection, storage, use, sharing, deletion)
Data Controller: The entity determining the purposes and means of processing (Your Group Trip)
Data Processor: The entity processing data on behalf of the controller (Google/Firebase)
Consent: Freely given, specific, informed, and unambiguous affirmation of willingness
Legitimate Interest: A legal basis for processing when the entity's interest outweighs individual rights

19. Acknowledgment and Consent

By downloading, installing, and using Your Group Trip, you acknowledge that you have read this Privacy Policy and agree to:

Our collection and use of your personal information as described
Processing and storage of your data in the jurisdictions outlined
The privacy practices detailed in this policy
Applicable terms and conditions

If you do not agree with any part of this Privacy Policy, please do not use Your Group Trip.

For the most current version of this Privacy Policy, visit https://your-group-trip.com/PrivacyPolicy.html