Privacy Policy · The Trip Binder

The short version

Connections to our service use HTTPS (TLS) encryption.
Passwords are stored only as one-way hashes. Nobody can read them.
Who can see a student’s medical, allergy and dietary details is enforced by our database, not just by the screen.
Health information on a trip is deleted 30 days after the trip ends.
No advertising, no ad trackers, no third-party analytics. We never sell data.
Designed to support FERPA and COPPA obligations. See sections 5 and 6.

1. Who we are

The Trip Binder ("we," "us," or "our") is operated by Wondernook Studios LLC. We provide a mobile and web app that helps teachers, chaperones, families and students run school trips: rosters, schedules, attendance, buses, rooms, documents, photos and trip messages.

2. Who this policy covers

This policy applies to everyone who uses The Trip Binder:

Organizers: teachers and school staff who create and run trips, and the co-organizers they invite.
Chaperones: adults invited to help supervise a trip.
Guardians: parents and legal guardians linked to a student.
Travelers: students aged 13 or older, and adults, who join a trip with their own account.

It also covers students who never create an account. An organizer can add a student to a trip roster, and that record is stored and used for the trip whether or not the student or a parent ever signs in.

3. Information we collect

3a. Account information

When you create an account we collect your name, email address and, if you choose a password, a one-way hash of it. You may add a phone number and a profile picture. If you sign in with Apple, Google or Microsoft, we receive your name and email address from that service, never your password there.

We ask for your date of birth to confirm you are at least 13. Password sign-ups give it when they register. Accounts created with Apple, Google or Microsoft are asked for it the first time they use the app. We also record when you accepted our Terms of Service and this policy.

3b. Student records

Student information comes from three places: the organizer (typed in or imported from a roster file), the student’s family, and the student. When a student traveler changes their own details, the change goes to the organizer to approve. Depending on what the school and family provide, a record can include:

Name, nickname, date of birth, grade, gender, school, student ID number and student email address
A photo
Music program details: instrument, ensemble and voice part
Parent and guardian names, phone numbers and email addresses, and emergency contacts
Flight details: airline, booking reference, e-ticket number, flight numbers and seats
Bus, room and group assignments, and a count-off number
General notes written by the organizer
Any extra roster fields the organizer creates

3c. Health and medical information

A traveler’s record on a trip can hold emergency contacts, allergies, dietary restrictions, medical notes, the over-the-counter medicines the family allows, and behavioral and other notes. This information usually comes from the school’s permission form, and each trip keeps its own copy: nothing is carried from one trip to the next. Families can also upload documents such as signed permission slips. We use this information only to keep students safe on the trip, and we delete it 30 days after the trip ends (see section 10). Section 8 explains exactly who can see it.

3d. Trip and activity data

We store what people create on a trip: the trip’s name, places and dates, the schedule, groups, buses, hotel rooms, attendance marks and their history, requests to join a trip, family room and bus sign-ups, inventory items, trip documents, chat messages and their attachments, announcements, and photos added to the trip album.

3e. Device, location and notifications

If you allow notifications, we store a push token for your device so we can send you trip alerts. It is removed when you sign out or delete your account.

If you allow location access, the phone app uses your approximate location while a trip is active to show local weather. It is rounded to about 1 km before it leaves the app, sent to our weather provider only to get the forecast, and never stored on our servers. If you decline, weather uses the trip’s destination instead.

The phone app keeps an offline copy of trip information so it works without a signal: trip details, the roster and emergency information, traveler photos, trip documents it has saved (on Wi-Fi), and messages you have written but not yet sent. All of it is encrypted on the device with a key that belongs to your account, and all of it is deleted when you sign out. A file exists unencrypted only for a moment while it downloads, and a document only while you have it open.

3f. Information collected automatically

Our hosting providers record IP addresses and browser or device type in sign-in sessions and service logs, for security and reliability. When the app hits an error, we send an error report to Sentry with email addresses and account IDs removed. We record a small number of product events in our own database (for example, that a trip was created or a roster was imported) linked to your account, and which screens of the app you open and for how long. Screen records name the kind of screen (such as “Roster”), never what is on it. For student accounts they are not linked to a trip and are deleted after 90 days; other screen records are deleted after about 13 months. We do not use advertising or third-party analytics tools, on this website or in the app.

When you sign up on this website, we record which link or page brought you to sign up: the first page of the site you opened and any campaign tags on that link, kept in our own cookie for up to 30 days and then with your account. If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, we ask you first and set that cookie only if you choose “Allow”; if you choose “No thanks”, we record nothing about how you found us, and we remember your answer in a cookie for 6 months. If you sign up in the app, we record only whether it was the iPhone or Android app.

4. How we use information

We use the information we collect only to:

Run the app and the trips you are part of
Let organizers, chaperones, families and travelers communicate
Send push notifications and emails about your trips and your account
Check identity when a family member or student links to a student record
Produce trip materials you ask for, such as calendars, rosters, luggage tags and exports
Answer support questions, including with an AI assistant (see section 7)
Keep accounts secure and find and fix problems

We do not use your information or student information for advertising, marketing profiles, or anything unrelated to running trips.

5. Student education records and FERPA

Student information that a school provides may be an "education record" under FERPA. We handle it on the school’s behalf, use it only to provide The Trip Binder to the school and to the families and staff on the trip, and share it only with the service providers in section 7 and as section 8 describes. A school or district that needs a signed data privacy agreement can contact us.

6. Children’s privacy (COPPA)

The Trip Binder is not directed to children under 13. Every account needs a date of birth showing the person is 13 or older, and we do not let anyone younger create an account. This check relies on the date the person gives us.

A school may still add a younger student to a trip roster. That student cannot sign in. Their information is entered by the school and managed by the school and the student’s family.

If you believe a child under 13 has an account, contact us at contact@thetripbinder.com and we will delete it.

7. Service providers we use

These companies process data for us so The Trip Binder can work:

Supabase: our database, sign-in, file storage and server functions, hosted on Amazon Web Services in the United States (Ohio).
Vercel: hosts this website.
Cloudflare: stores trip album photos (R2, in North America), receives email sent to our support address, and runs the Turnstile check that stops automated sign-ins on the website.
Amazon Web Services (SES): sends our emails, in the United States. We keep a 90-day log of delivery events, which includes recipient addresses.
Google Workspace: a copy of every email sent to our support address is kept in our company mailbox.
Expo, Apple and Google: deliver push notifications. A notification can contain a chat message and its sender’s name, an announcement, or, for trip staff, the names of travelers marked absent. Apple also delivers Lock Screen trip trackers, which show an event’s name and meeting point.
Anthropic: runs the AI support assistant and the itinerary importer. The assistant receives your support messages, with email addresses, phone numbers and card numbers removed first. Names are not removed. The importer receives the itinerary file an organizer uploads.
Sentry: error reports, in the United States. Email addresses, sign-in tokens and account IDs are removed. The text of an error can still contain other details.
Stripe: processes purchases on the website. Stripe receives the buyer’s email address and account ID. Card details go straight to Stripe; we never see or store them.
RevenueCat: manages purchases made in the iPhone and Android apps. It receives an account ID only. Apple and Google handle the payment.
Apple, Google and Microsoft: optional sign-in. We receive your name and email address.
Open-Meteo: weather forecasts. It receives a city name, or your approximate location as described in section 3e.
Maps and place search: OpenStreetMap and Photon (map tiles and place search), Apple Maps on iPhone and Google Maps on Android. They receive map requests and the place names an organizer types. We send no names or account details with a place search.
Pushover: sends our team phone alerts about the service, such as when a new account is created. For travelers and anyone under 18, the alert shows only the first letter of the email address and its domain, with no name.

We do not use Google Cloud Vision or collect passport data. Passport capture exists in our code but is switched off.

8. Who can see what

Inside the app, access follows each person’s role on a trip:

Trip owners and co-organizers see the whole trip, including every traveler’s health information.
Chaperones see the travelers on their trip: name, photo, date of birth, grade, notes, flight, bus and room details, emergency contacts and health information. If the organizer restricts a chaperone to one group, that chaperone sees only that group’s travelers.
Families see and update their own child’s emergency contacts and health information. They also see the notes and extra fields the organizer adds, except fields the organizer marks Staff only. The organizers are told when a family changes something.
Guardians see only their own children.
Travelers see their own record and never another traveler’s.
Chat. Messages in a trip conversation are seen by the people in that conversation. Trip owners and co-organizers can also read every direct message on their trip, including one between a chaperone and a student; they cannot post in a direct message they are not part of. Both apps say this wherever a direct message is shown.
Trip photos can be seen by everyone on the trip and by the families of its travelers.
Our team can see account and trip information to give support. To view a traveler’s health details, our support tools require a written reason, record the access, and email an alert.

We do not sell, rent or trade personal information or student information. We share it outside the app only with the service providers in section 7, when the law requires it, or, with notice to you first, as part of a merger or sale of the business.

9. How we protect it

Data travels over HTTPS (TLS).
Passwords are stored as one-way hashes.
Row-level security rules in the database decide which rows each person can read or change.
The database decides who can read health information: the trip’s staff (within any group restriction), the traveler’s parents and the traveler. No setting can widen that.
Documents, chat attachments and album photos open through links that expire after one hour. Roster photos use links that expire after 30 days.
Profile pictures, trip cover images and inventory item photos are not private: anyone who has the link can view them.
Album photos are resized on your device before upload, which removes the location and camera details stored inside the image.
Invitation links for co-organizers, chaperones and guardians are stored only as SHA-256 hashes. Family sign-up links (for choosing a room or bus) are stored as issued and work for anyone who has the link until it expires, so treat them like a password.
Uploads are limited to allowed file types and sizes.
Two-factor authentication (an authenticator app code) is available to every account. It is optional.
The phone app can be set to require Face ID or a fingerprint to reopen. Everything it keeps for offline use — trip data, traveler photos, saved documents and unsent messages — is encrypted with AES-256, using a key for your account kept in the device’s secure keychain. A document is decrypted to a temporary file only while it is open, and deleted when you close it.

10. How long we keep information

Accounts: until you delete your account in the app. Deleting it removes your profile, sign-in, trip memberships, and the documents you uploaded, apart from the safety copy described below.
Trips: a trip is marked completed 14 days after its return date. Its documents and cover image are deleted 365 days after the return date on a paid plan, or 90 days on the free plan. We email the owner 30 days and 7 days before.
Health information (emergency contacts, allergies, dietary restrictions, medical notes, over-the-counter medicines and behavioral notes), and custom fields marked Medical, are deleted from a trip’s records 30 days after the trip ends. A legal hold on the trip pauses this.
Everything else on a trip (roster, student details, other custom fields, attendance, chat, photos) stays until the trip is deleted. A trip’s owner or co-organizers can delete it once it is a draft or has been cancelled.
Student records: removing a student from a trip, or deleting a trip, does not delete the student’s record. It stays until we delete it at the school’s or family’s request (see below).
Chat messages: deleting a message removes it from the chat, but we keep its text as part of the trip record.
Passport and identity documents: we do not collect them. Passport capture is switched off.

Deletion at a school’s or family’s request

A school or district can ask us to delete a trip and its students’ information by writing to contact@thetripbinder.com. We then delete the trip and everything on it — roster, attendance, chat messages, announcements, documents, album photos and the images sent in chat — and the record of every student who is only on that trip. Stored files (documents, photos, chat images, the cover image and students’ photos and documents) are queued and removed from storage by our nightly cleanup; a trip with a large photo album can take a few nights. If a student is also on another trip, or their record is linked to a family account, we keep that record and tell the school. We also delete the trip’s copies in the safety archive, except anything under a legal hold; a chat image attached to a held message is kept with it until the hold ends, then deleted. A family can ask us to delete their child’s record the same way. Deleted data can remain in our hosting provider’s backups until those backups expire.

Safety copy after an account or trip is deleted

The Trip Binder puts adults and minors in shared trip conversations. So that a later child-safety or law-enforcement inquiry cannot be defeated by deleting an account or a trip, we keep a restricted copy of some content after deletion:

Chat messages (with any image sent in them) and announcements, and any abuse reports about them, for 2 years. Each is kept with its author’s name and email address so it stays attributable. When the copy expires, the image is deleted with it.
When an account is deleted, we keep only its name, email address and account ID with that content. Not its date of birth, phone number or photo.
Content under a preservation request, legal hold or open investigation is kept until that matter closes.

This copy is not part of the product. You, other members and trip organizers cannot see it, it is used for nothing else, and it is deleted automatically when the period ends. We rely on our legitimate interest in protecting minors, and on the establishment, exercise or defence of legal claims (GDPR Article 17(3)), to keep it despite a deletion request.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or take a copy of your personal data, or to limit how we use it. To use any of these rights, contact us at contact@thetripbinder.com. California residents have rights under the CCPA/CPRA. EU and EEA residents have rights under the GDPR.

12. Guardian rights over student information

A guardian linked to a student can view and edit the child’s record, including their emergency contacts and health information, and ask us to delete the record.

13. Changes to this policy

We may update this policy when our practices or the law change. For a material change, we will post a notice in the app and update the date at the top of this page.

14. Contact us

Wondernook Studios LLC
contact@thetripbinder.com