Privacy Policy

Information we handle

Depending on how you use TRIBA: account details (name, email, sign-in method); profile and Tribe details (members, preferences, dietary needs you enter); trip details (dates, destinations, itinerary items, decisions and feedback); booking information you forward, approve or that we discover through a connection you choose; and data from connected services you authorise. We don't need, and currently don't accept, real passport or licence details.

Information you give us

We collect your account details and the Tribe profiles, preferences, dietary needs, trip plans, itinerary entries and feedback you choose to enter. Please only add information about another person when you have their permission to share it with TRIBA.

Oura, if you connect it

Connecting Oura requires a separate permission step and Oura authorisation. The current connection requests Oura’s Daily scope. On a manual sync, TRIBA retrieves daily activity and sleep data for approximately the previous three days and stores step counts and sleep duration in minutes, associated with your account. We store encrypted access and refresh tokens on the server to maintain the connection. TRIBA does not request your Oura credentials. These summaries are for your personal context; they are not shown to your Tribe or published as community options.

Booking email connections, if you choose them

Connecting a mailbox is optional. With separate trip import permission and provider authorisation, Google or Microsoft grant whole-mailbox read access. Gmail requests https://www.googleapis.com/auth/gmail.readonly to search messages and inspect booking evidence in their bodies. This permission technically allows read-only access to messages across the connected mailbox, not only travel emails. Gmail metadata-only access cannot read message bodies, so it is insufficient to identify confirmations and extract booking details. Gmail searches known travel senders within a trip-related date window and inspects sender and subject headers first. Outlook lists sender and date metadata within that window, which can include unrelated mail. Each check considers up to 50 messages. Bodies from recognised travel senders may include marketing or other non-booking content. Manual Gmail checks also open travel-looking forwarded messages before checking their embedded original sender; a misleading subject can therefore expose unrelated content temporarily. Some messages may need to be read to determine whether they are travel-related. These are application-level safeguards, not a limitation imposed by Google on the permission. Filtering limits processing but cannot guarantee that every accessed message concerns travel. TRIBA does not use Gmail access for unrelated product features, advertise to you or sell email data.

Email bodies are processed temporarily in memory, capped at 20,000 characters for extraction, and are not retained, logged or sent to AI. Gmail full-message responses can include inline MIME content; the parser skips named attachments and does not download separate attachments. TRIBA retains extracted booking facts (title, date, time, place, type and status) and one-way identifiers for duplicate and reference matching, not full messages or documents. Titles may be extracted from subject lines. High-confidence, body-backed confirmed bookings matching one owned trip can be imported automatically; ambiguous items, shared-trip contributions and material changes require review. TRIBA does not save traveller or passenger details as separate fields, although a title taken from a subject line could contain a name. A detected email is not itself proof that a reservation remains valid. Saved itinerary visibility follows trip sharing permissions, not mailbox access.

The configured daily cleanup removes titles, places and local times from pending, rejected and superseded suggestions older than 90 days; dates, status, hashes and operational associations remain. Accepted booking records and itinerary entries remain until deleted through applicable account or trip controls. A cleanup configuration is not a guarantee of its successful execution. Disconnecting removes stored tokens and withdraws TRIBA import permission. Gmail provider revocation is attempted but is not guaranteed; you can also verify or remove access in your Google account. Already saved bookings remain. This connection does not send, delete or modify email, invite attendees or write to calendars. Google and Microsoft handle authorisation and API requests under their own notices.

Booking.com data portability, if you choose it

TRIBA has implemented a one-time data-portability import that remains in testing; a real authorised export has not yet been verified end to end. Where available, you must request a secure export link from Booking.com, supply it to TRIBA and authorise access on Booking.com’s own page, separately from TRIBA’s trip-import permission. A button alone does not retrieve all your bookings. TRIBA does not request your Booking.com password or continuous access. Booking.com handles its authorisation and export under its own privacy notice.

The import temporarily processes the export on the server to extract supported accommodation, flight, car, taxi and attraction booking facts: titles, dates, places, types and status, with one-way identifiers for duplicate and booking-reference matching. Other categories, including reviews, messages and payment information, are not imported. The original export is not retained as a file. The secure link is stored encrypted for the single-use authorisation attempt and cleared when that attempt is consumed or disconnected; attempts expire after ten minutes, which does not itself guarantee immediate deletion of an unused link. Access tokens are used for the import and not stored. Extracted suggestions, source information and import status remain account restricted. Date matching and duplicate checks do not guarantee accuracy: suggestions and cancellation notices wait for your review and do not automatically create or change shared itinerary entries.

Disconnecting withdraws TRIBA import permission, clears unused authorisation attempts and removes pending Booking.com suggestions. Already accepted bookings and itinerary entries remain until removed through applicable controls or a deletion request. This import does not make, modify or cancel reservations, pay providers or send your Tribe profiles, wellness readings or itinerary to Booking.com. The technical integration does not imply a Booking.com partnership, endorsement or verified live service. If you choose an external booking link, you deal with that provider under its own terms and privacy notice; following a link or importing a record is not confirmation of a new reservation.

Google user data and Limited Use

TRIBA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. TRIBA requests read-only Gmail access to discover confirmed bookings and related updates or cancellations for its booking import and sync feature. We do not use Gmail data for advertising, sell it or use it to train generalised AI or machine-learning models. Transfers are limited to providing this user-facing feature, security or applicable legal requirements under that policy. Human access is limited to specific user-authorised support, necessary security investigations or legal obligations under that policy. Imported itinerary facts may support suggestions for that trip within its applicable permissions; raw email bodies are not sent to AI.

Shared moments and learning

Adults you accept into your Tribe can see trip summaries and only photos you explicitly share with them. People with access to a shared photo can react and comment on it. Those interactions are visible to the photo owner and other adults with access to that photo. Each adult may separately allow structured reaction and comment activity to inform their Tribe’s suggestions. With that permission, TRIBA records the photo reference, account references, reaction type or comment activity and time in a private intelligence ledger; it does not copy comment text or image contents into that ledger. Turning this permission off deletes associated ledger events. A separate optional permission allows reaction counts to contribute to broad community patterns. Those patterns expose only country and emoji totals once at least ten opted-in Tribes and thirty reactions contribute; they do not include photos, comments or account identities. Sharing still works without either learning permission.

How we use information

We use the information to run your account, manage your Tribe and trips, make contextual experience suggestions, resolve problems and improve the beta using feedback. Suggestions are automated and may be incomplete or wrong. We do not use connected Oura readings as a basis for medical advice.

Who handles information

Lovable and the application’s infrastructure and authentication providers process information to technically host, develop and operate the application for TRIBA. This does not make Lovable a separate TRIBA business or a travel-booking provider. If you choose Google sign-in, Oura, Gmail, Outlook or Booking.com data portability, those providers handle authorisation and service requests under their own notices too. We do not sell personal information. A connection to one provider does not authorise access to your other apps. Service providers and storage may operate outside your country.

Your choices: sharing, learning and action are separate

TRIBA treats each of these as its own permission. Sharing decides what other people in your Tribe can see. Learning decides whether your activity may inform suggestions — for you, for your Tribe, or (separately, and only in aggregate) across Tribes. Action decides whether TRIBA may take a step on your behalf, and material steps always need your explicit approval. Turning one on never turns on another, and you can change them in Settings. Signals TRIBA learns are treated as tentative, and you can correct or withdraw them. Raw wellness readings are never shown to other members by default.

Control, security and retention

Your account controls access to your Tribe and trip information. Provider tokens are encrypted in server storage. Oura summaries and imported booking candidates are account restricted. Disconnecting Oura attempts to revoke its token and removes TRIBA’s stored Oura tokens and synced readings. We keep other account information while needed to provide the beta, handle requests and meet applicable obligations. To ask to access, correct or delete your information, or to raise a privacy concern, use the TRIBA contact page. We will review your request and respond through that channel.

Retention and deletion

We keep information only while it is needed to run your account and the beta, resolve issues, and meet legal obligations. Disconnecting a service removes its stored tokens; you can delete trips, entries and photos, or ask us to close your account and delete your information, subject to records we must keep by law (for example, acceptance and payment records).

Changes

We may update this Policy as the beta changes. We will update the effective date here and give additional notice when a material change calls for it. Other proposed travel, social or wearable connections are not active merely because they are discussed in the product roadmap; each needs its own integration and your choice to connect it.