Privacy Policy

Sundrift is the controller for account and product data. Trip admins decide who is invited and whether SMS/email is sent through credentials they connect. For questions: [email protected].

• Account. Name, email, profile photo, and sign-in identifiers from Google, X, or email/password.
• Trip content. Itineraries, polls and votes, map pins, photos and captions, expenses and how they are split, chat notes, availability, bucket-list ideas, and booking details you choose to store.
• Contact details you add. Phone numbers and emails used for invites or alerts.
• Location. Coordinates for places you pin or search, and (if you allow it) your device location to show “you are here” on a trip map. We do not continuously track you.
• Device and logs. Basic technical data needed to operate and secure the Service (for example IP address in server logs, browser type).

We use this data to create and run your trips, authenticate you, show shared maps and itineraries, send in-app, email, SMS, or device notifications you or a trip admin enable, keep the Service secure, and meet legal duties. We do not use your trip content to train public AI models, and we do not sell personal information.

Where those laws apply: contract (to provide the Service you asked for), consent (optional device notifications; non-essential cookies if we ever add them), legitimate interests (security, product reliability, showing a trip to people already on it), and legal obligation. You may withdraw consent without affecting processing that does not rely on it.

We share data only as needed to operate Sundrift:

• Other members of a trip you join, as required for that trip.
• Auth providers you choose (Google, X).
• Our database host (Neon / Postgres) to store trip data.
• Twilio or Resend/SendGrid, when Sundrift sends you an invite or alert that a trip organizer requested.
• OpenStreetMap / Nominatim (or similar) when you search or display a map place.
• Authorities if required by law.

We do not sell personal information, and we do not share it for cross-context behavioral advertising (CCPA/CPRA).

Sundrift sets strictly necessary cookies and similar storage to keep you signed in, protect the session, and remember this notice and your display theme. We do not set advertising or analytics cookies. Strictly necessary cookies do not require opt-in under EU/UK ePrivacy rules; we still describe them here. You can clear cookies in your browser; doing so will sign you out.

We keep account and trip data while the trip or account exists, then delete or anonymize it within a reasonable period after deletion (unless we must keep a record for security or law). Server logs are kept only as long as needed for operations and abuse prevention.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object or withdraw consent. EEA/UK residents may complain to a supervisory authority. California residents may request know, delete, and correct, and we will not discriminate for exercising those rights. Email [email protected] to make a request. We may need to verify you.

We may process data in the United States and other countries where our processors operate. Where required, we use appropriate safeguards (such as Standard Contractual Clauses).

Sundrift is not directed at children under 13 (or 16 in the EEA/UK where that is the digital-consent age). We do not knowingly collect data from children below that age.

We use access controls, encrypted transport, and least-privilege credentials (for example Twilio and SendGrid keys stay on the server). No method of transmission is perfectly secure.

We will update the date above when this policy changes and provide additional notice for material changes when practical.

Privacy requests: [email protected]. See also our Terms of Use.