Privacy Policy

1. Who We Are

TripNoti ("we," "our," or "us") is a flight price intelligence application developed and operated by Aaron, an individual developer based in Malaysia. TripNoti is available on Android (Google Play Store) and iOS (Apple App Store).

Contact: support@tripnoti.com
Website: https://tripnoti.com
Operating from: Malaysia

This Privacy Policy applies to the TripNoti mobile application, its associated website at tripnoti.com, and any related services we provide.

2. Information We Collect

2.1 Information You Provide Directly

Account Information: When you register using your Email address, Google Account, or Apple ID, we receive your name and email address.
Flight Search Data: Origin, destination, travel dates, passenger class, target prices, and route preferences that you enter when searching for or tracking flight routes.
Booking and Referral Records: When available from booking partners or affiliate networks, we may receive limited booking or referral records such as booking reference, route, travel dates, price, currency, and booking status to show your trip history.
Communications: When you contact us via support@tripnoti.com, we receive the contents of your message and any attachments.

2.2 Information Collected Automatically

Device Information: Device model, operating system version, app version, notification identifiers, and mobile network information.
Approximate Region Information: We may infer your country or region from your IP address, device locale, or account settings to set currency, improve regional flight suggestions, and localize the app experience. TripNoti does not collect GPS or precise location unless a future version clearly requests location permission.
Usage Data: App features accessed, screens viewed, search queries performed, and the time and frequency of your interactions with the app.
Push Notification Token: A device-specific token generated by Firebase Cloud Messaging (FCM) used solely to deliver price drop alerts and relevant notifications to your device.
In-App Notification Status: We may store whether you have read app update notices so that we can show unread indicators and recent announcements correctly.

2.3 Subscription & Payment Information

If you subscribe to a TripNoti paid plan, all billing and payment information is processed by the Apple App Store or Google Play Store and managed through RevenueCat. We do not receive, store, or process your credit card or payment card details. We only receive subscription-related information needed to manage access, such as your active plan, entitlement status, renewal or expiry date, and store purchase status.

3. How We Use Your Information

Purpose	Data Used	Legal Basis
Provide and operate the TripNoti service	Account info, flight search data	Performance of contract
Send price drop alerts and notifications	FCM token, tracked routes	Performance of contract / Consent
Personalize flight suggestions to your region	Approximate region information, account settings	Legitimate interests / Performance of contract
Manage subscriptions and access	Account info, subscription status	Performance of contract
Improve app performance and fix bugs	Device info, usage data, diagnostic logs	Legitimate interests
Respond to your support queries	Communications, account info	Legitimate interests
Comply with legal obligations	All relevant data	Legal obligation

We will never use your data for advertising profiling or sell it to data brokers.

4. Third-Party Services

TripNoti integrates with the following third-party service providers. Each provider has their own privacy policy governing how they handle data:

Service	Purpose	Privacy Policy
Google Firebase	Push notification delivery through Firebase Cloud Messaging (FCM)	firebase.google.com/support/privacy
Supabase	Authentication, backend database, user profiles, tracked flight routes, settings, notification read status, and price data	supabase.com/privacy
RevenueCat	Subscription status, entitlement management, and in-app purchase access control	revenuecat.com/privacy
Travel Data Providers, Booking Platforms, Airline Partners, and Affiliate Networks	Flight price data, booking links, referral tracking, and limited booking status information where available	Subject to each partner's respective privacy policy
Backend Price-Checking and Web Data Processing Providers	Refreshing tracked route prices and checking flight fare information more frequently for paid plans	Subject to each provider's respective privacy policy
IP Geolocation Provider	Approximate country or region detection for currency and regional app settings	Subject to the provider's respective privacy policy
Vercel	Web hosting and delivery of the tripnoti.com website	vercel.com/legal/privacy-policy
Google Sign-In / Apple Sign-In	Third-party authentication providers	Subject to Google's / Apple's respective privacy policies

We select our third-party providers carefully and only share the minimum data necessary for them to provide their services.

TripNoti may earn a commission when users open booking links or complete purchases through travel partners or affiliate networks. This does not increase the price you pay.

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We only share your information in the following limited circumstances:

With Service Providers: As listed in Section 4 above, solely for the purpose of operating the app.
For Legal Compliance: If required by law, court order, or governmental authority, we may disclose data to comply with legal obligations under Malaysian law or applicable international law.
To Protect Rights: We may disclose data where necessary to protect the rights, property, or safety of TripNoti, our users, or the public.
Business Transfer: In the event of a business sale, merger, or acquisition, your data may be transferred. You will be notified of any such change and given the option to delete your account.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

Account Data: Retained for the duration of your account. Deleted within 30 days of account deletion request.
Flight Search & Tracking Data: Retained for up to 12 months after your last active session, then anonymized or deleted.
Booking and Referral Records: Retained only as long as needed for trip history, support, fraud prevention, payment reconciliation, or legal obligations.
In-App Notification Read Status: Retained while your account is active and deleted with account closure.
Push Notification Tokens: Deleted immediately upon account deletion or when you disable notifications.
Subscription Records: Retained for 7 years as required under Malaysian financial regulations.
Support Communications: Retained for 2 years from the date of resolution.

7. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Request that we correct inaccurate or incomplete data.
Deletion: Request that we delete your account and all associated data ("right to be forgotten").
Portability: Request your data in a machine-readable format (applicable under GDPR).
Withdraw Consent: Withdraw consent for push notifications at any time via your device settings.
Opt-Out of Notifications: Manage or disable push notifications in your device's notification settings.

To exercise any of these rights, use Settings > Delete Account in the App where available, or contact us at support@tripnoti.com. We will respond within 30 days.

Malaysian users are protected under the Personal Data Protection Act 2010 (PDPA). EU/EEA users are protected under the General Data Protection Regulation (GDPR). US users may have additional rights under state-specific privacy laws (e.g., CCPA in California).

8. Data Security

We implement industry-standard security measures to protect your personal data:

Encryption in transit: All data transmitted between the app and our servers uses HTTPS/TLS encryption.
Encryption at rest: Data stored in Supabase databases is encrypted at rest.
Access Control: Access to user data is strictly limited to the developer and authorized service providers on a need-to-know basis.
Authentication: We use Supabase Auth and third-party sign-in providers such as Google Sign-In and Apple Sign-In with industry-standard OAuth protocols for secure sign-in.

While we take all reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. In the unlikely event of a data breach that affects your rights and freedoms, we will notify you and relevant authorities as required by law within 72 hours.

9. Children's Privacy

TripNoti is intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18 years of age.

If you are a parent or guardian and believe that your child under the age of 18 has provided us with personal information, please contact us immediately at support@tripnoti.com and we will take steps to delete such information promptly.

10. International Data Transfers

TripNoti is operated from Malaysia. Our third-party service providers, including Google Firebase, Supabase, RevenueCat, travel data partners, booking platforms, affiliate networks, backend price-checking providers, and IP geolocation providers, may process and store data on servers located in the United States and other countries whose data protection laws may differ from those in your country.

Where we transfer data internationally, we ensure appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs) approved by the European Commission (for EU data transfers)
Service providers who have certified compliance with applicable data protection frameworks

By using TripNoti, you acknowledge and consent to the transfer of your data to these countries.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

Update the "Last Updated" date at the top of this page.
Send a notification to your registered email address or via in-app notification.
Where required by law, request your renewed consent.

Your continued use of TripNoti after the effective date of the revised policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically.

Table of Contents