Privacy policy

Version 2026-11 · Last updated: 15 October 2026

1. Who we are

Triplune is made by Triplune, Waselakehof 4 - 9250 Waasmunster (postal address), Belgium, enterprise number BE 1001.811.050. We are the controller of the personal data described in this policy. You can reach us through the contact form or at info@triplune.com.

This policy covers the Triplune app for iPhone and iPad, the web app at app.triplune.com and this website, triplune.com. In this policy, “we” and “us” mean Triplune (the company), and “Triplune” also means all three services. It's the only privacy policy for Triplune: the privacy link in the app and the web app leads here.

2. What we collect and why

Your account

When you sign up, we ask for your name, email address and a password, and we store your preferred language. We store your password only as a secure hash (bcrypt), never the password itself. We need these details to create your account, sign you in and contact you about your account. They're required: without them we can't create an account.

We also record which version of the terms of use and this privacy policy you accepted when you signed up, so we can show what you agreed to.

Legal basis: performance of our agreement with you (the terms of use).

Year of birth and how you found us

Sign-up also asks for your year of birth, which is required: without it we can't check the minimum age and can't create an account. We store the year, not your full date of birth. Sign-up can also ask how you heard about Triplune (for example Instagram, the App Store or a friend; if you choose “Other”, you can type a short answer). That question is optional: you can skip it, and skipping it changes nothing about your account. Both answers are stored with your account.

• We use your year of birth to check that you meet the minimum age (see section 9), and to make statistics about which age groups use Triplune.
• If you answer how you found us, we use it to make statistics about which channels bring people to Triplune.

The statistics in our admin panel are totals per group. The people who run Triplune can also see the individual short answers given under “Other”, with the date. We don't use your year of birth or how you found us for the assistant, for advertising or to make decisions about you.

Legal basis: for the age check, our legitimate interest in, and our responsibility for, only offering Triplune to people old enough to use it; for the age statistics, our legitimate interest in understanding who uses Triplune. For how you found us: your consent, which you give by choosing to answer. You can object to the age statistics, or withdraw your answer about how you found us, at any time by asking us (see section 8); we then remove or stop using it.

Your trips

Your trips, their destinations, the places you save (with their coordinates), your day plans, checked-off items and the notes you write are stored on our server so they sync between your devices. We don't look at your trips, except when you ask us for help with a specific problem or when we have to investigate a breach of the terms of use.

Legal basis: performance of our agreement with you.

Location

If you allow it, the app uses your device's location on the device itself, for example to show where you are on the map or to search nearby. We don't send your live location to our server and don't store it. What we do store are the destinations of your trips and the coordinates of places you add to a trip, whether you add them yourself, through the assistant or by importing them.

Maps, place search and travel times

Maps, place search, place details, map images and travel times come from Apple Maps. To provide them, the following goes to Apple:

• what you type when you search for a place, together with the area you search in (the centre and size of the map, or the trip's destination);
• the start and end coordinates when Triplune calculates a route or travel time between two places;
• the coordinates of the area shown when Triplune creates a small map image of a trip or place.

Some of these requests come straight from your device, others from our server (for example when the assistant searches for places). Apple handles them under the Apple privacy policy. We don't send your name or email address with them.

Legal basis: performance of our agreement with you.

The assistant

The assistant is part of Premium. It's powered by Anthropic, the company behind the Claude AI model. Before you use the assistant for the first time, the app explains what it sends to Anthropic and asks for your explicit permission. When you ask a question, we send Anthropic:

• your question and the earlier messages in the same conversation;
• trip details the assistant needs to answer. In the general assistant, that's a list of up to 50 of your trips (with their titles, destinations and dates); in a conversation about one trip, that trip's places, day plans, items and notes;
• the results of tools the assistant uses, such as place searches (through Apple Maps), park opening hours and wait times, and, when an answer needs current information, a web search that Anthropic carries out for us;
• proposals the assistant made earlier in the conversation;
• the current time and your device's time zone, so the assistant understands dates and what “today” means.

We don't send your name or email address with it. But anything you type yourself, in a question or a note, goes along as you wrote it. So don't put sensitive personal information (such as health details or passport numbers) in your questions or notes.

We use Anthropic's commercial API. Under Anthropic's commercial terms, Anthropic doesn't use what we send to train its models. Anthropic keeps that data for a limited time and may keep it longer where that's needed to enforce its usage policy (for example to detect misuse) or to comply with the law. Anthropic acts on our behalf as a processor.

We store your conversations and the assistant's proposals in our own database so you can read them back. For each question we also store which AI model answered, how many tokens it used and what it cost, to apply the Premium limits and keep the costs under control.

Legal basis: performance of our agreement with you (you choose to use the assistant), and the explicit permission you give in the app before your first question. You can withdraw that permission at any time in the app, under Settings → Assistant → AI consent: turn it off, and nothing more is sent to Anthropic; the assistant asks for your permission again before you can use it next time. You can also withdraw it by asking us through the contact form. Withdrawing doesn't affect what was sent before. Without your permission, the assistant isn't available; the rest of Triplune keeps working.

Purchases

Premium and the trip pass are sold by Apple through the App Store. Apple is the seller: it handles the payment, invoicing, refunds and its own purchase records. We never see your card or payment details. Our server receives a signed purchase confirmation from Apple and stores the product, the transaction IDs, when it started and ends, whether it renews, and whether it was refunded. We need this so Premium works on all your devices, including the web.

Legal basis: performance of our agreement with you.

Devices and sign-in sessions

For each device you're signed in on, we store a session with the device name, when it was last used and when it expires, so you can see and sign out your devices in Settings. On our server, the session token is only stored as a secure hash. The usable token is kept on your device: in the iPhone and iPad app in the iOS Keychain, and in the browser in a secure session cookie (see section 4).

Legal basis: performance of our agreement with you.

Support

When you contact us through support in the app, we store your messages and the screenshots you add (JPEG or PNG). If you turn it on yourself, your message also includes diagnostic details: the app version, the iOS version, your device model, your language, the sync status (how many changes are waiting or failed, when the last sync ran, and short codes of the last sync errors, without the content of your trips) and where your Premium comes from (for example a subscription or a trip pass). We use all this only to help you.

The administrators of Triplune read your support messages. While they help you, they also see your name, email address, Premium status and number of trips. Administrators can add internal notes to a conversation; these aren't visible to you.

When you send a message, the administrator gets a notification email with the start of your message. When there's a reply, you get a notification email that you have a new reply, without the reply itself; you read it in the app.

A support conversation is closed after 6 months without activity and deleted 2 years after it was closed. When you delete your account, your support conversations are deleted immediately.

Legal basis: performance of our agreement with you.

Support and administration

The people who run Triplune can see account details (name, email address, year of birth, how you found us, Premium status and sign-in dates) to give support and prevent misuse. When you ask for help, an administrator can, temporarily, view Triplune as you to see the problem. Actions by administrators on an account, such as blocking it, deleting it or viewing as the user, are recorded in an audit log, so it's always clear who did what.

Legal basis: our legitimate interest in helping you, preventing misuse and keeping administrators accountable.

Technical logs

Our servers keep short-lived technical logs to keep Triplune running and fix errors. These logs can contain technical details such as the time, the function that was requested, an error message and an IP address. The server in front of Triplune doesn't keep logs of every visit.

Legal basis: our legitimate interest in running a secure, working service.

The contact form on this website

When you use the contact form, we receive your name, email address, topic and message by email and use them to reply. To keep out spam, the form uses Cloudflare Turnstile, which checks signals from your browser and your IP address to tell people from bots. To stop the form from being flooded, our server also keeps a scrambled (hashed) form of your IP address and the time of your message; it's deleted after at most 24 hours.

Legal basis: our legitimate interest in answering your message and protecting the form.

Park wait times

Opening hours and wait times for theme parks are fetched by our server from the public service themeparks.wiki. No personal data is sent to them.

Automated decisions

We don't make decisions about you that are based only on automated processing and that have legal or similarly significant effects. Automatic limits, such as the number of trips or assistant questions, are the same for everyone with the same plan.

3. What we don't do

• We don't show ads and don't use advertising or tracking cookies.
• We don't track you across other companies' apps or websites.
• We don't sell or rent your personal data.
• We don't use your data to train AI models, and Anthropic doesn't either (see “The assistant”).

4. Cookies and local storage

The web app at app.triplune.com only uses cookies it needs to work. They aren't used for tracking or advertising.

The assistant in the web app remembers, in your browser's local storage, whether its panel is open for a trip. That stays in your browser and isn't sent to us.

The iPhone and iPad app stores your trips on your device so they work offline, and keeps your sign-in token in the iOS Keychain. This website, triplune.com, sets no cookies; Cloudflare Turnstile on the contact page may store what it needs to run the check.

5. Who we share data with

We only share data that's needed, with these parties. Processors work on our behalf, only on our instructions and under a data processing agreement. Independent providers decide themselves how they handle the data, under their own privacy policy.

When a processor handles data outside the European Economic Area, we use one of the safeguards the GDPR allows: for Anthropic the EU–US Data Privacy Framework certification, for Cloudflare the EU–US Data Privacy Framework certification. You can ask us for more information about these safeguards, or a copy of them, through the contact form.

We may also share data when the law requires it, for example on a valid request from a court or the police.

6. How long we keep it

• Your account and everything in it: as long as your account exists. When you delete your account, we immediately and permanently delete your account details, trips, places, plans, conversations with the assistant, support conversations, our copy of your purchase records and your sessions.
• Things you delete: a trip, place or plan item you delete is first marked as deleted, so your other devices learn that it's gone. After 30 days it's permanently erased. Conversations about a trip are erased with that trip.
• Backups: kept for at most 90 days, then overwritten. If we ever have to restore a backup, we delete deleted accounts again right away. For that, we keep only the anonymous account number of a deleted account (no name, email or content), for at most 90 days.
• Assistant cost records: the model, token and cost figures per question are kept for our cost administration for at most 2 years. When you delete your account, they stay without any link to you until then.
• Audit log: entries about actions on your account are kept for at most 2 years. When your account is deleted, they're anonymised before that: no email address, no reason text written by an administrator, and no link to your account.
• Purchases at Apple: Apple keeps its own purchase and invoice records, under its own policy.
• Sign-in sessions: until you sign out or the session expires; expired sessions are deleted.
• Support conversations: closed after 6 months without activity, deleted 2 years after closing, and deleted immediately when you delete your account.
• Technical logs: short-lived and limited in size (about 30 MB per service), so older entries are overwritten automatically.
• Contact form messages: as long as needed to handle your question, and at most 2 years. The scrambled (hashed) IP address used against flooding: deleted after at most 24 hours.

7. Deleting your account

You can delete your account yourself, at any time: in the iPhone and iPad app under Settings → Delete account, or in the web app under Settings. You confirm with your password. Deletion is immediate and permanent and can't be undone (see section 6 for what's kept).

Deleting your account doesn't cancel an App Store subscription. Apple bills it, so cancel it in your Apple Account settings first. The app warns you about this and links to Apple's subscription settings.

If you can't sign in (for example because your account is blocked), ask us to delete it through the contact form.

8. Your rights

Under the GDPR you have the right to access your data, get a copy of it in a common format, correct it, have it deleted, restrict how we use it, and object to how we use it when we rely on our legitimate interest. Where we rely on your permission, you can withdraw it at any time.

• You can correct most details yourself in Settings, and delete your account yourself (section 7).
• For a copy of your data or anything else, send us a message through the contact form or email info@triplune.com from the address you use for Triplune. If we can't be sure the request comes from you, we may ask you to confirm it.

We reply within one month. If a request is complex, that can be extended by two months; we'll tell you if so, and why.

If you think we handle your data wrongly, you can file a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be), or with the authority in the EU country where you live or work.

9. Age

Triplune is for people aged 13 and older. Sign-up asks for your year of birth and doesn't accept people who are too young. If you believe a child under 13 has an account, tell us and we'll delete it.

10. Security

All traffic to Triplune is encrypted (HTTPS). Passwords are stored only as secure hashes. Session tokens are stored on our server only as hashes; on your device they're kept in the iOS Keychain or in a secure session cookie. Access to our servers is limited to the people who run Triplune, and we keep backups so your trips don't get lost. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

11. Changes

When we change this policy, we update the version and the date at the top. If a change matters for how we use your data, we'll tell you in the app or by email before it takes effect, and where needed we'll ask for your permission again.

12. Contact

Questions about privacy? Use the contact form or email info@triplune.com.