Privacy Policy

Effective date: 3 November 2026. This Privacy Policy explains how Tripomonk Travel Private Limited (“Tripomonk”, “we”, “us”), the developer of the Tripomonk app (Android package com.tripomonk.app) and the website app.tripomonk.com, accesses, collects, uses, shares, retains and deletes your personal data. It follows applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, and the Google Play User Data policy.

1. Who we are and how to reach us

Developer / data fiduciary: Tripomonk Travel Private Limited, India.
Privacy contact (grievance officer): tripomonk@gmail.com, or the WhatsApp support option inside the app. We acknowledge privacy requests within 72 hours and resolve them within 30 days.

2. Personal and sensitive data we collect

Account details: name, email address, mobile number, password (stored only as a secure hash by our login provider) and an optional profile photo. If you sign in with Google, we receive your name, email address and profile photo from Google.
Booking and traveller details: trek, dates, number of travellers, traveller names, phone numbers, email addresses, emergency contact details, booking status and e-tickets.
Permit applications: name, phone number, trek, dates, group size and nationality you submit to apply for trekking permits.
Payment details: payment ID, amount and payment status received from Razorpay. Card numbers, UPI PINs, bank and wallet details are entered directly with Razorpay; we never see or store them.
Community content and messages: photos, videos, stories, captions, comments, reviews, likes, follows, saved posts and the direct messages you send to other users. If you allow another user to call you, your mobile number is shared with that user.
Location: Approximate location — when you open the app we look up your rough country and city from your IP address (through the ipwho.is service) to pre-fill your country dialling code and show nearby content. Precise location — only when you tap “Start tracking” in the trail navigation screen, and only after you grant location permission. Precise location is used on your device to show your position on the trail and is not uploaded to our servers or used in the background.
Camera: only when you choose to scan a ticket QR code or take a photo/video to post. The camera feed is processed on your device; only the photos and videos you choose to post are uploaded.
Photos and videos from your device: only the files you pick to upload as a post, story or profile photo. We do not scan your gallery.
Notifications: if you allow notifications, a push token for your device so we can send booking updates, trip alerts and community activity. You can switch notification types off in Settings → Notifications.
App activity and diagnostics: which screens you view and for how long, login events, device and browser type, and error information, used to run, secure and improve the app.
Support and applications: the details you give us in support tickets, guide applications, host/partner applications and trip listings.

We do not access your contacts, call logs, SMS, microphone, files outside the ones you pick, or the list of apps installed on your device.

3. How we use your data

To create your account, sign you in and keep your account secure.
To process bookings, permits, payments, refunds and e-tickets, and to communicate about your trip.
To run trek operations and safety coordination, including contacting your emergency contact if needed.
To provide community features: your profile, posts, comments, follows, messages and notifications.
To keep the community safe: new posts are checked automatically for adult or explicit content before they go live.
To provide optional AI features, such as a personalised trek training plan.
To understand how the app is used, fix problems and improve our services.
To comply with legal, tax and accounting obligations and respond to lawful requests.

We use your data only for the purposes above. We do not sell your personal data and do not use it for purposes unrelated to the app.

4. Who we share data with

We share personal data only where needed for the purposes above, with:

Trek operations teams, trek leaders and guides — traveller, booking and emergency contact details for your trip.
Supabase — hosting, database, file storage and login for the app.
Google — Google Sign-In (if you choose it), Google Maps/Places (location search and maps), and the Gemini AI service for automatic content moderation of posts and for AI training plans. Only the content needed for that feature is sent.
Razorpay — payment processing.
Email and push notification providers — to deliver login codes, booking emails and notifications.
WhatsApp (Meta) — only when you choose to contact our support team through WhatsApp.
Microsoft Clarity and Meta Pixel — only if you accept analytics cookies (see section 5).
Other users — content you post publicly and your profile are visible to other users; if your account is private, only approved followers can see your posts and message you.
Government or legal authorities — when required by law, for permits, or to protect the safety of travellers.

Our service providers may process data outside India and are allowed to use it only to provide their service to us.

5. Analytics cookies (optional)

Only if you tap “Accept” on our cookie notice, we load Microsoft Clarity (heatmaps and session recordings of how the app is used) and the Meta Pixel (to measure our Facebook/Instagram ads, for example page views and completed bookings). If you decline, neither loads. You can change your choice at any time in Profile → Settings → Data & privacy.

6. Consent

We ask for your consent on the sign-in screen before creating your account, and we ask for Android/browser permissions (location, camera, notifications) only at the moment you use a feature that needs them. You can withdraw consent at any time in Profile → Settings → Data & privacy or by revoking permissions in your device settings. Withdrawing consent does not affect processing already done, but some features may stop working.

7. How we protect your data

All data is encrypted in transit using HTTPS (TLS). Our database enforces access rules so users can read and change only the data they are allowed to, staff access is limited by role, and payment card data never touches our systems. No system is perfectly secure, but we review our safeguards regularly and will notify you and the authorities of a personal data breach as required by law.

8. How long we keep your data

Account, profile, posts, comments and messages: while your account is active. Removed within 30 days after you delete your account.
Booking, permit and payment records: kept for up to 8 years after the trip, as required by Indian tax and company law, then deleted.
App activity data: up to 12 months, then deleted or anonymised.
Support tickets: up to 2 years after the ticket is closed.
Backups: deleted data may remain in encrypted backups for up to 30 more days before being overwritten.

9. Deleting your account and data

You can ask us to delete your Tripomonk account and its data at any time, without needing to reinstall the app:

In the app: Profile → Settings → Account & security → Delete my account.
Without the app: email tripomonk@gmail.com with the subject “Delete my Tripomonk account” from the email address or mobile number linked to your account.

We verify the request comes from the account owner and complete the deletion within 30 days. We delete your profile, profile photo, posts, stories, comments, likes, follows, saved items, messages and push tokens. We keep only the booking, permit and payment records we are legally required to keep (section 8), and we delete those when the legal period ends. You can also delete individual posts or comments yourself at any time, or ask us to delete specific data without deleting your account.

10. Your rights

You can ask to access a summary of your personal data, correct or update it, delete it, withdraw consent, nominate another person to exercise your rights in case of death or incapacity, and raise a grievance with us. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

11. Children

The app is meant for users aged 18 and over and is not directed at children. Minors may travel only through a booking made by a parent, guardian or lead traveller, who provides the minor’s details with verifiable consent. We do not knowingly create accounts for children; if we learn that a child has created an account, we will delete it.

12. Changes to this policy

If we change this policy, we will update the effective date above and, for significant changes, tell you in the app before the change takes effect.

By using the Tripomonk app, you agree to this Privacy Policy. See also our Terms of Service.