Privacy Policy

Last updated: May 18, 2026

This policy describes how MyTripz collects, uses, shares and protects your personal data. By using the application, you agree to the practices described here. This policy complies with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018).

1. Who we are

MyTripz is a web and PWA (Progressive Web App) application for trip planning with Google Maps, operated by Bruno Nacari (individual), responsible for processing your data (the data controller, under the LGPD).

Official web address: www.mytripz.com.br.

2. Data we collect

2.1 Identification data (via Google OAuth)

• Full name, email and profile photo from your Google account
• Public Google ID (sub) to identify your account

You always decide whether to sign in. We do not have access to your Google password — authentication happens directly with Google via OAuth 2.0.

2.2 Location data (GPS)

• Your real-time position (when you authorize the browser to share it)
• Coordinates of the places you add to your maps

Location is used only to show where you are on the map and to calculate routes. You can revoke GPS access at any time in your browser or operating system settings.

2.3 Trip content

• Maps, places, itineraries, dates, photos and notes you create
• Uploaded attachments (images and PDFs of receipts for lodging, tickets, flights, restaurants)
• Expenses, budgets and expense splits among group members

2.4 Payment data (subscriptions)

• Contracted plan (Free, PRO, MAX) and subscription status
• Subscription ID at Mercado Pago and the amount of the last charge

Credit card data is handled exclusively by Mercado Pago. MyTripz never has access to your card number.

2.5 Technical data

• IP address, browser, operating system and language
• Application error logs (message, file, line) for diagnostics
• Access logs (login, logout, sensitive actions), including:
  • Type of device used at login (desktop / mobile / native app)
  • Approximate city inferred from the IP address, used only by the administrative dashboard to detect suspicious access — it is not GPS-level precision

3. How we use your data

• Authenticate you in the application
• Save and display your maps, itineraries and places
• Calculate routes and optimize itineraries
• Process uploaded receipts (automatic data extraction via AI)
• Charge subscriptions and enforce plan limits
• Send transactional emails (sign-up confirmation, shared-map invitation, receipt)
• Detect and fix failures and abuse
• Comply with legal obligations (tax, judicial)

4. Sharing with third parties

We use third-party services to deliver essential features of the app. When we share data with them, it is only the minimum necessary and strictly for the purpose of the service:

• Google (Maps, Places, OAuth, Drive Picker): authentication, map rendering, POI search, attaching files from your Drive (only the files you select — we use the drive.file scope)
• Google Gemini API: analysis of images and PDFs of attached receipts (automatic extraction of name, amount, date). The content sent is discarded after processing — Google does not train models with your paid API key
• Mercado Pago: subscription processing and payment webhooks
• Resend: sending transactional emails
• Meta (Facebook/Instagram) Pixel and CAPI: marketing campaign measurement, only if you consent via the cookie banner. You can decline at any time
• Travelpayouts: affiliate partner for travel services (flights, hotels, activities). A partner script loads on site pages and may turn travel links into affiliate links and use its own cookies for commission attribution. It does not receive your name, email, or account data
• Frankfurter (European Central Bank): exchange rates for converting expenses — no personal data is sent
• ip-api.com: resolving the approximate city from the IP address on login events (administrative security log). Only the IP is sent; no other personal data
• Railway, Supabase and Neon: application hosting and database (managed PostgreSQL in data centers in the United States)

5. Sharing between users (you control it)

You can share a map with other people (by email) with view or edit permission. These guests will see the map content, but will not have access to your other maps or your account data. You can revoke sharing at any time.

Maps marked as public are visible in the Explore section to any app user. Before making a map public, make sure the content is appropriate for that exposure.

6. Storage and retention

• Data is stored on servers in the United States (Supabase / Neon / Railway providers), with encryption in transit (TLS) and at rest
• We keep your data while your account is active
• When you delete your account, your personal data is removed within 30 days, except for records that must be retained by legal obligation (tax, judicial)
• Error and access logs are kept for up to 90 days for diagnostics and security

7. Cookies and local storage

• Session cookie (MYTRIPZ_SESSID): keeps you logged in. Strictly necessary, does not require consent
• localStorage: saves map preferences (center, zoom, active category) so you can pick up where you left off
• IndexedDB: local cache of your places and maps, so the app works offline
• Service Worker: caching of PWA assets
• Marketing cookies (Meta Pixel): only activated after consent in the cookie banner. You can decline and the app works normally

8. Your rights (LGPD Art. 18)

You may, at any time, request:

• Confirmation of the existence of processing of your data
• Access to the data we hold about you
• Correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion of unnecessary data
• Portability of your data
• Deletion of data processed with consent
• Information about whom we share your data with
• Withdrawal of consent

To exercise any right, send an email to suporte@mytripz.com.br. We respond within 15 days.

9. Security

We adopt technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), HttpOnly and SameSite=Lax cookies, CSRF protection on all forms, rate limiting, security headers (CSP, X-Frame-Options, Referrer-Policy) and access auditing.

No system is 100% immune to incidents. If a breach occurs that affects your data, we will notify you and the Brazilian National Data Protection Authority (ANPD) within the deadlines required by the LGPD.

10. Children and adolescents

MyTripz is not directed at children under 13. We do not intentionally collect data from children. If you are a legal guardian and have identified improper use by a minor, please contact us so that we can remove the data.

11. Changes to this policy

This policy may be updated to reflect changes in the application, legislation or partner services. When there are relevant changes, we will notify you by email and the next time you open the app. The last-updated date always appears at the top.

12. Contact

You may also contact the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd in case of an unresolved complaint.