Privacy & Cookies

Last updated 27 September 2026. This notice describes the personal data Trip Tonic processes, why, where, and the third parties involved. Who is responsible and how to reach them is in section 6.

1. Information you share with us

1.1 Basic account information

You can view the public landing page without an account. To plan trips you must create an account with an email address, a username, a display name, and a password (or sign in through a supported identity provider). Your username and display name are visible to the people you share trips with — you can use a pseudonym. You may optionally add an avatar, timezone, and locale.

1.2 Trip content

Trips on Trip Tonic are private to their members, not public. When you create or join a trip, the content you add — itinerary items, chat messages, comments, expenses, wishlist entries, polls, and anything you ask the Tonic assistant (section 2.4) — is stored by us and visible to the other members of that trip. Think carefully before adding sensitive information, and remember that trip mates keep their own view of shared content even if you later delete yours.

1.3 Preferences

You can optionally store travel preferences — travel style (pace, budget, interests) and, if you choose to provide them, dietary restrictions and accessibility needs. They are voluntary and can be edited or removed at any time from your profile. Your travel style is sent with your requests to the Tonic assistant so its suggestions suit you. Dietary restrictions and accessibility needs are not sent to the assistant.

2. Additional information we receive about you

2.1 Log data

When you use the service, our hosting providers process technical log data such as your IP address, browser type, and the requests you make: the application runs on Render, Frankfurt (Germany), the database and sign-in on Supabase, AWS region eu-north-1 (Stockholm, Sweden). We use this data to operate the service securely — authentication, abuse prevention, rate limiting and debugging.

2.2 Cookies & local storage

Storage needed to sign you in (Supabase auth cookies) and to remember your choices (cookie decision, open panels, whether you have seen the tour) is always active. Opening a study invitation link also stores which study it was, for at most a week, until you sign in. Optional analytics run only after you select Accept in the cookie banner; declining costs you nothing.

2.3 Usage analytics (only with your consent)

If you accept, we record which pages you open and which features you use, with a random session identifier and your account id, in our own database (ux_events, stored with the rest of your data in Stockholm). The app contains optional connectors for PostHog, Google Analytics and Sentry error reporting. None of them is connected at present, so no data is sent to them. If we connect one, we will update this notice and ask for your consent again first. We run no advertising trackers and no session recording.

2.4 AI features

When you ask Tonic something, your message, your travel style if set, and relevant trip context (destination, dates, saved places, the recent chat and the display names of the trip's members) are sent to Google's Vertex AI (Gemini) to generate the reply. We use Google's EU endpoint, so these requests are processed within the EU. To answer some questions Tonic also looks things up: place searches go to the Google Maps Platform, background questions to Wikipedia (Wikimedia Foundation, United States), and weather questions to Open-Meteo. These receive only the search terms, article titles, or coordinates and dates of the lookup — never your message or your account — and may be processed outside Switzerland and the EU, including in the United States. AI output can be wrong — verify important details yourself.

The assistant is part of the trip chat, not a private conversation. What you ask Tonic and what it replies are visible to every member of that trip, and plans it drafts are shared with the trip. Please do not type sensitive personal information (for example about health or religion) into the chat.

2.5 Research study (only if you joined through a study link)

Trip Tonic is the subject of a Master's thesis. If you opened the app through a study link, you were shown a separate consent form before anything was recorded. With that consent, the app additionally stores your questionnaire answers, a copy of each request you send Tonic with technical details of how it answered, what you did with its suggestions, your thumbs ratings and your device type (laptop, tablet or phone). The consent form describes this in full. Nothing of this is recorded for anyone who did not join through a study link, and deleting your account deletes it and withdraws you from the study.

3. Information we share and disclose

3.1 Sharing you control

Trip content is disclosed to the members of that trip. Invite links you create let the people you share them with join the trip and see its content — share them only with people you trust.

3.2 Service providers and where they process data

Switzerland recognises the EU and EEA as providing adequate data protection, which covers the database, the application, account emails and the assistant. The lookups Tonic makes on Google Maps, Wikipedia and Open-Meteo carry no account data and may be processed outside Switzerland and the EU; for Google in the United States we rely on the Swiss–U.S. and EU–U.S. Data Privacy Frameworks and/or Standard Contractual Clauses.

3.3 Law, harm, and the public interest

We may preserve or disclose personal data if we believe it is reasonably necessary to comply with a law or legal process, to protect the safety of any person, or to prevent abuse of the service.

4. Managing your personal information

4.1 Access, export, and deletion

You can correct your data in the app at any time. From your profile page you can export your data in a machine-readable format and delete your account. Deletion is immediate and permanent: your account and personal data are deleted, trips of which you are the only member are deleted with it, and content that must remain for other trip members (e.g. expenses affecting their balances) is disassociated from your identity.

4.2 Retention

Analytics events are deleted after at most 365 days; expired invites and stale AI suggestions after 90 days. Account data is kept until you delete your account. Research-study data is kept as the study consent form states.

5. Changes to this policy

We may revise this policy; the current version is always available at this address. If we make a material change, we will notify you in the app before the change takes effect.

6. Who is responsible, and how to reach us

Trip Tonic is operated by Gian Andri Hofmann, Master's student at the University of St.Gallen (HSG), Switzerland, who is responsible for the processing described here. To exercise your rights (access, correction, deletion, data portability, objection) or to ask a question, write to gian.hofmann@student.unisg.ch.

Processing is governed by the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation. You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your local supervisory authority.