Privacy policy

Last updated: 22 October 2026

This policy explains what personal data Chuni Trip Planner ("CTP", the "app") collects, why, who it is shared with, how long it is kept, and your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Chuni Trip Planner is the Data Fiduciary for CTP. Contact us at support@tech-dev.in.

1. What we collect

You give us:

• Account details: email address, name, password (stored only as a hash), and optionally a username, photo, short bio and home city.
• Trip content: trips, dates, destinations, day plans, notes, checklists, bookings, files and photos you upload, journal entries, polls and votes, expenses and who they were split with, chat messages, comments and reviews.
• Payment details you choose to share with your trip groups: a UPI ID, a phone number and a UPI QR image, so friends can pay you back. We never see or handle the payments themselves; they happen in your UPI app.
• Emergency contacts you add (name, phone number, relation), used only to text them when you raise an SOS.
• Booking emails you forward to your trip's address or paste into the app, so we can add the booking to the trip.
• Messages to the AI planner, and reports or messages you send to us. Collected when you use CTP:
• Location, only if you allow it:
  • Near me, maps and weather: your position while you use these features.
  • Approximate city from your IP address: when phone location is off, to centre maps near you. It is worked out on our own server, shown only to you and never stored.
  • Live location sharing (off until you turn it on): while it is on, your phone sends your position about once a minute, also when the app is in the background. Android shows a "Sharing your location" notification the whole time. Members of trips happening now see your position. Friends on the Chunis map see only your city. Turning it off stops it at once and deletes your stored position.
  • Route recording: while you share live location with a trip that is happening, your route is saved so the group can see the trip's route and the trip story. You can delete your route from the trip menu.
  • Arrival alerts: while you share live location with a trip, reaching a booked stay tells the group.
  • Hangouts: if you turn on automatic hangouts, being within about 150 m of a friend who also turned it on records a hangout. Bump uses your position for a moment to find the friend bumping next to you.
  • SOS: when you raise an SOS, your position is sent to the members of your trips and to a private link you can text to your emergency contacts. The link shows your live position until you end the SOS or after 24 hours.
• Device details for notifications: a notification token, the device type and app version.
• Basic logs: IP address, request times and error reports, to keep CTP secure and working. We do not collect Aadhaar, bank account or card details. We do not sell your personal data. Sponsored listings: some local businesses pay to be shown, always labelled "Sponsored", to people whose trips go to their destination. We pick them from your trip's destinations on our server; the business never learns who you are or where your trip goes. We count how many times each listing is shown and tapped per day, without linking the counts to you. A business only gets your details if you call, message or visit it yourself.

2. Why we use it

We use your data only for these purposes, on the basis of your consent or for the legitimate uses allowed by section 7 of the DPDP Act:

• to create and secure your account (sign-in, verification codes, preventing abuse and fraud);
• to run the features you use: sharing trips with the people you invite, splitting expenses and settling up, chat, maps and search, live location, SOS, check-ins, polls, hangouts, reminders and notifications;
• to read booking emails into your trips;
• to answer your AI planner questions;
• to fix bugs and keep CTP running;
• to meet legal obligations and respond to lawful requests.

3. Who we share it with

• Other trip members see what you add to trips you share with them, your live position and route while you share with the trip, your check-ins and your SOS. People you chat with see your messages. Your public profile (name, username, photo, bio) is visible to other CTP users, subject to your privacy settings.
• Everyone, when a trip owner shares a finished trip in the Trip Feed: the trip's day-by-day plan and the parts the owner chooses (where the group stayed, how they travelled, notes, and spend per person by category). Members appear by name and photo only if they turn that on themselves; others show only as a number. Booking and ticket numbers, phone numbers, emails and payments between members are never shown. Your comments, likes and reviews on posts are visible to other users. The owner can take the post down at any time.
• Only you, to choose your Trip Feed: the posts you like, save, open, comment on, use or mark "Not interested", what you search for and the places of your own trips decide which shared trips you see first. Other people never see this, and you can clear your searches at any time.
• People you choose to send a link to: your SOS live-location link, a pay link in a WhatsApp reminder, a shared trip page or your shared India map. Anyone with such a link can open it until you turn it off (SOS links stop showing your position when the SOS ends).
• Service providers (Data Processors) who process data for us under contract: our hosting provider; our email provider, to send verification codes and notices; OpenAI, which receives your AI planner messages and the trip details needed to answer them (not your email address); and phone platform notification services (Google, Apple) to deliver notifications.
• Map, routing, place, weather and currency services (OpenStreetMap-based maps, search and routing, Open-Meteo, Frankfurter, Wikimedia) receive search text and coordinates, never your name or email.
• Authorities, only when Indian law requires it. Booking emails are received by our own mail server, not a third-party mail service. Some processors store data outside India. We only transfer data to countries not restricted by the Central Government under section 16 of the DPDP Act.

4. On your device

To work without a network, the app keeps a copy of your recent trips, plans, bookings and expenses on your phone (up to 30 days for trips you save for offline, 7 days otherwise), and on Android and iOS the map tiles of areas you save. Signing out deletes this copy.

5. How long we keep it

We keep your data while your account is open.

• Live position: kept only while sharing is on. Positions older than 12 hours are not shown to trip members.
• Recorded routes: kept with the trip until you delete your route or the trip is deleted.
• SOS alerts: end after 24 hours at most. Check-ins are shown for 3 days. When you delete your account we sign you out everywhere, remove your email, username, photo, bio, payment details, emergency contacts, location, routes and devices, and show your name as "Deleted user". Expenses and messages you added to trips shared with other people stay in those trips, no longer linked to your identity, so the group's records and balances stay correct. Logs are kept for up to 90 days. Backups expire within 30 days.

6. Your rights

Under the DPDP Act you can:

• Access a summary of your data and how it is processed: download a copy from Settings → Account → Download my data.
• Correct and update your data: edit your profile, trips and content in the app.
• Erase your data: delete content, delete your recorded route from a trip's menu, or delete your account from Settings → Account → Delete account.
• Withdraw consent at any time, as easily as you gave it: turn off live location, automatic hangouts or notifications in the app or your device settings, or delete your account. Withdrawal does not affect processing done before it.
• Nominate someone to exercise these rights if you die or become unable to: write to us at support@tech-dev.in.
• Seek grievance redressal: write to our Grievance Officer at support@tech-dev.in. We reply within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

7. Security

We use encryption in transit (HTTPS), hashed passwords, short-lived sign-in tokens, signed links, rate limits and access controls, and we limit staff access to what is needed. If a personal data breach happens, we will inform you and the Data Protection Board as the DPDP Act requires.

8. Children

CTP is not meant for children under 18 without a parent or guardian. We do not knowingly process a child's data without verifiable parental consent, and we do not track or target children. If you think a child is using CTP without consent, write to support@tech-dev.in and we will delete the account.

9. Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it applies, and ask for your consent again where the law requires it.