Privacy Policy

1. Who We Are

TripNoti ("we," "our," or "us") is a flight price intelligence application developed and operated by Aaron, an individual developer based in Malaysia. TripNoti is available on Android (Google Play Store) and iOS (Apple App Store).

Contact: support@tripnoti.com
Website: https://tripnoti.com
Operating from: Malaysia

This Privacy Policy applies to the TripNoti mobile application, its associated website at tripnoti.com, and any related services we provide.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: When you register using your Email address, Google Account, or Apple ID, we receive your name and email address.
• Flight Search Data: Origin, destination, travel dates, and passenger class that you enter when searching for or tracking flight routes.
• Communications: When you contact us via support@tripnoti.com, we receive the contents of your message and any attachments.

2.2 Information Collected Automatically

• Device Information: Device model, operating system version, unique device identifiers, and mobile network information.
• Location Data: With your explicit permission, we collect your approximate or precise geographic location to help suggest relevant departure airports and regional flight deals. You may deny or revoke this permission at any time via your device settings.
• Usage Data: App features accessed, screens viewed, search queries performed, and the time and frequency of your interactions with the app.
• Push Notification Token: A device-specific token generated by Firebase Cloud Messaging (FCM) used solely to deliver price drop alerts and relevant notifications to your device.

2.3 Subscription & Payment Information

If you subscribe to TripNoti Premium, all billing and payment information is processed directly by RevenueCat in conjunction with the Apple App Store or Google Play Store. We do not receive, store, or process your credit card or payment details. We only receive confirmation of your subscription status from RevenueCat.

3. How We Use Your Information

We will never use your data for advertising profiling or sell it to data brokers.

4. Third-Party Services

TripNoti integrates with the following third-party service providers. Each provider has their own privacy policy governing how they handle data:

We select our third-party providers carefully and only share the minimum data necessary for them to provide their services.

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We only share your information in the following limited circumstances:

• With Service Providers: As listed in Section 4 above, solely for the purpose of operating the app.
• For Legal Compliance: If required by law, court order, or governmental authority, we may disclose data to comply with legal obligations under Malaysian law or applicable international law.
• To Protect Rights: We may disclose data where necessary to protect the rights, property, or safety of TripNoti, our users, or the public.
• Business Transfer: In the event of a business sale, merger, or acquisition, your data may be transferred. You will be notified of any such change and given the option to delete your account.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Account Data: Retained for the duration of your account. Deleted within 30 days of account deletion request.
• Flight Search & Tracking Data: Retained for up to 12 months after your last active session, then anonymized or deleted.
• Push Notification Tokens: Deleted immediately upon account deletion or when you disable notifications.
• Subscription Records: Retained for 7 years as required under Malaysian financial regulations.
• Support Communications: Retained for 2 years from the date of resolution.

7. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request that we delete your account and all associated data ("right to be forgotten").
• Portability: Request your data in a machine-readable format (applicable under GDPR).
• Withdraw Consent: Withdraw consent for location access or push notifications at any time via your device settings.
• Opt-Out of Notifications: Manage or disable push notifications in your device's notification settings.

To exercise any of these rights, contact us at support@tripnoti.com. We will respond within 30 days.

Malaysian users are protected under the Personal Data Protection Act 2010 (PDPA). EU/EEA users are protected under the General Data Protection Regulation (GDPR). US users may have additional rights under state-specific privacy laws (e.g., CCPA in California).

8. Data Security

We implement industry-standard security measures to protect your personal data:

• Encryption in transit: All data transmitted between the app and our servers uses HTTPS/TLS encryption.
• Encryption at rest: Data stored in Supabase databases is encrypted at rest.
• Access Control: Access to user data is strictly limited to the developer and authorized service providers on a need-to-know basis.
• Authentication: We use Firebase Authentication with industry-standard OAuth 2.0 protocols for secure sign-in.

While we take all reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. In the unlikely event of a data breach that affects your rights and freedoms, we will notify you and relevant authorities as required by law within 72 hours.

9. Children's Privacy

TripNoti is intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18 years of age.

If you are a parent or guardian and believe that your child under the age of 18 has provided us with personal information, please contact us immediately at support@tripnoti.com and we will take steps to delete such information promptly.

10. International Data Transfers

TripNoti is operated from Malaysia. Our third-party service providers (Google Firebase, Supabase, RevenueCat) may process and store data on servers located in the United States and other countries whose data protection laws may differ from those in your country.

Where we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission (for EU data transfers)
• Service providers who have certified compliance with applicable data protection frameworks

By using TripNoti, you acknowledge and consent to the transfer of your data to these countries.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send a notification to your registered email address or via in-app notification.
• Where required by law, request your renewed consent.

Your continued use of TripNoti after the effective date of the revised policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically.