GroupTrip

Privacy

Updated October 13, 2026. GroupTrip lets adults create an account, sign in, manage private groups, and build trip sites that owners and admins can publish. General photo or document uploads, payments, and surveys are not open yet. Mailing-list subscriptions are not open yet.

Information used for your account

We store your email contact, the sign-in method you prove you control, account creation and status information, and when you accept our terms and privacy notice. Your account is private; there are no public member profiles.

With Google sign-in, Google supplies an account identifier and email address so we can recognize you. We request basic sign-in and email permissions only. We do not request your Gmail messages, contacts, files, calendar, or ongoing access to Google services. We do not sell Google account information or use it for advertising.

With email sign-in, SparkPost delivers the link you request. Creating an account does not subscribe you to marketing emails. Authentication links and Google responses are used to complete your sign-in, not published as content.

Cookies and security records

A secure session cookie keeps you signed in. Sessions expire after 7 days of inactivity or 30 days in total. Email links last 30 minutes and Google sign-in attempts last 10 minutes. We store security events under a random account reference and use hashed rate-limit counters to limit abuse.

Your private groups

We store group names, adult memberships and access levels, invited email addresses, and records of access changes. Owners and admins can see group members’ contact emails and pending invitation addresses. Members see the group home but cannot see those contacts. An invited person who confirms their email can see the inviter’s contact when deciding whether to join. A group has no public page of its own; only trip sites its owners or admins publish are public.

SparkPost delivers requested invitations and email confirmation links. After you choose to continue an invitation, a secure cookie holds that invitation’s secret link so you can finish signing in. It expires within seven days. Invitations do not subscribe you to announcements. After confirming your invited email, you can decline and stop further invitations from that group. We keep a keyed, hashed address for that choice while the group exists; contact support if you later want to change it.

Your private trip-site drafts

Group owners and admins can build a trip site in the editor. We save the trip name, optional destination and approximate timing, your draft text, theme choice, page settings, and a limited set of earlier or competing edits. We record editing activity under a random account reference. Current owners and admins in that group can edit and preview its drafts. Members and people outside the group cannot access them.

Drafts belong to the group. Saving or previewing a draft does not publish it; only Publish does. Do not enter traveler records, children’s information, medical or financial information, private schedules, or live locations.

Published trip sites

When an owner or admin publishes a trip site, its saved words, look, logo and published Updates become public at its address, and anyone with the link can see them. Published pages ask search engines not to index them. That request is not access control: a link can be shared or found. Public pages set no cookies and do not automatically show account contact emails. Contact details organizers include in published content are public. Publishing an Update never sends an email.

We record when each organizer accepts the site rules and keep random references for publishing and unpublishing activity; each retained published Update version also stores the publisher’s account ID, which is cleared if that account is deleted. We keep up to 20 published versions of each site and each Update. Retained site versions keep their logos; older versions are removed as new ones are published. Unpublishing keeps those saved versions. Removing the group removes them through the bounded cleanup process described below. Publication activity and retry records become eligible for cleanup after 90 days. Unpublishing, a pause by GroupTrip, or closing the group takes its sites offline at once. Copies others already saved can’t be recalled.

Each site has a Report this site link. Reports go by email to contact@grouptrip.me; the report page stores nothing. We keep report emails in our support inbox to handle them.

Optional writing help during site setup

When this test feature is available, choosing Create my site sends the description you enter and your group name to OpenAI to write a private starting draft. A requested redo sends the original description, the change you ask for and the site’s current words. If a reply does not fit the site’s sections, we may ask OpenAI once to correct its format. Leave out contact details, information about children and health details. Adult celebration names and milestones you include may appear in the draft. Review all the words before using them.

I’ll build the site myself uses your words without calling OpenAI. The starting description is saved as editable private About text and may remain in the group’s limited draft history after a generated draft replaces it. A failed redo keeps the current draft unchanged; an unsaved change request stays only in the open tab. We do not save raw provider responses or reasoning, or use browser storage for these descriptions. We request that OpenAI not store the response, but provider-held processing records follow OpenAI’s policies.

We retain content-free operation and expense records to limit use and account for provider costs. Detailed operation metadata becomes eligible for cleanup after 90 days. Minimal setup allowance counts remain while the group exists. Group deletion removes the setup record and detaches its expense records from the group and account; unknown provider costs can remain reserved for reconciliation. Saving a generated draft does not publish it.

Private group logos

When logo uploads are available, current group owners and admins can upload PNG, JPEG or WebP group branding and explicitly select it for a private trip draft. Members and people outside the group cannot access the logo library or draft images. Upload only branding you have permission to use, without personal information or photos of children.

We check and resize the image, remove embedded metadata, and store processed copies privately in Cloudflare R2. The original upload is discarded after processing or a failed attempt. We do not retain its original filename. We store the group, originating trip, random author reference, file size, dimensions, checksums, processing state and links to saved drafts or copies.

Replacing a logo creates a new image. Removing it from a trip does not erase an image held by a saved or competing copy. Unreferenced logos become eligible for removal after at least seven days; unfinished uploads after one hour. Closed-group and verified account deletion queue the group’s images for removal after their saved references are removed. Storage failures are retried, so removal may occur later. Images contributed to other groups remain theirs.

Private logo storage has count and size limits. Keep your own original logo. R2 provides durable storage, but GroupTrip does not currently offer an independent image backup or guaranteed recovery of a deleted image. Restoring service data and restoring images require coordinated operator review.

Retention and deletion

We keep your account until you request its deletion. After verifying ownership, we remove its sign-in identities, agreement records, and sessions from the active service. Security events are retained for up to 90 days before becoming eligible for cleanup. Expired sign-in records and rate-limit counters become eligible after 24 hours. Cleanup runs in small batches when authentication is used, so removal may occur later on an inactive service.

Invitation and account confirmation records become eligible for removal 24 hours after they expire. Invitations expire after seven days, and account confirmation links after 30 minutes. Ownership offers expire after 24 hours and become eligible for removal a day later. Removed memberships are eligible after eight days once linked invitations and offers are gone. Access-change history is eligible after 90 days. Closed groups become eligible for removal after 30 days; verified account deletion can remove your closed groups sooner. These removals also run in small batches.

Each trip keeps its current draft, up to 20 saved or recovery copies and resolved competing edits combined, and up to 20 unresolved competing edits separately. Unresolved copies are not removed to make room for another copy. Editing-activity records become eligible for cleanup after 90 days. Removing a closed group also removes its trips, drafts, and saved or competing copies in the same bounded cleanup process. Closing a trip alone does not delete its draft.

You can leave groups you do not own. Before deleting an owner’s account, the owner must transfer ownership to someone who accepts it, or close the group. Verified deletion also clears revoked memberships and unused invitation proofs. Other groups keep their drafts, including text you contributed and its random author reference. The hashed invitation-stop choice and random-reference security history remain until their normal expiry. Service code backups contain no account or draft records. Provider-managed database backups and operational logs follow the providers’ retention policies.

InterServer hosts the service, Cloudflare delivers and protects its traffic, routes support email, and stores processed group logos privately in R2, Google provides Google sign-in, and SparkPost delivers requested email. These providers may retain operational logs or backups under their own policies. Deleting an account does not immediately remove copies from provider-managed backups or logs.

Your choices

For access, correction, deletion, or privacy questions, email contact@grouptrip.me. We verify that an account belongs to you before acting on requests. GroupTrip does not accept accounts or personal information directly from children. Do not submit anyone’s private travel, medical, or financial records.

What this site uses

We have not added advertising, behavioral analytics, or third-party fonts. If you choose a light or dark appearance, the site may remember that preference in your browser. It does not put contact details or trip records there.

The hosting and network providers may process connection information, such as your IP address, to deliver and protect the site.

Contact

For privacy questions, email contact@grouptrip.me.