Privacy

Who is responsible

Taralets is operated by Yvonne Palaganas, who is responsible for decisions about the collection and processing of personal information for the service. For privacy questions or requests concerning your personal information, write to support@taralets.club.

Taralets is run by one person rather than a company. Under Philippine data protection practice, an individual acting as a personal information controller is the de facto Data Protection Officer, so Yvonne is also Taralets’ privacy contact. There is no separate privacy department or legal team, and no regulatory registration or certification is claimed.

What is collected

These are the categories of personal information Taralets holds:

• Your account. Email address, the name you choose to display, and optionally a phone number, a timezone, a language and a profile photo. Also when you accepted these terms and this policy, and whether your account is allowed to start new trips.
• Sign-in and security information. Handled by Supabase Auth on Taralets’ behalf: your password is stored by Supabase as a hash and is not readable by Taralets or by anyone else, alongside timestamps such as when the account was invited, created and last signed in.
• Trips you take part in. The trip’s name, destination, dates, currency and status; your role and the period of your membership; the itinerary with its times and places; bookings and their reference numbers; checklist tasks; announcements; and in-app notifications.
• Names the group uses. An organizer can set what a trip calls you. It applies on that trip and nowhere else, your own account name is left untouched, and it is shown to you as well as to everybody else. An organizer can also list a traveller who has no account and is never going to have one — a grandmother, a child — by name alone, so the group’s arithmetic can include them; that name is written by the organizer, not by the person it names. Where a group sorts itself into households, each household has a name too, usually a family’s.
• Requests and your answers to them. Organizers can ask travellers for things like flight details, passport information, insurance, dietary requirements or an emergency contact. What you write in reply can be sensitive, and is treated as such — see Who can see it.
• Money the group records. Expenses with their amount, currency, date and who paid; how each is split between people; settlement payments; budget lines; and contributions to a shared travel fund. Balances and suggested settlements are calculated from these entries — Taralets works out what the group’s own records add up to. It does not independently know, verify or determine what anyone actually owes anyone else.
• Documents you upload. Files such as passports, insurance, booking confirmations or receipts, and the title and kind you give them.
• Memories you keep. Photos, notes, and the date and place you attach.
• Invitations. The trip, the role offered, when the link expires, and a name the organizer writes to remember who a link was for. The link itself is never stored — only a one-way hash of it, so a copy of the database cannot be used to join anything. When an account is created from an invitation, the email address and name entered on that screen.
• Passes you buy. When you redeem a Trip Pass or an Organizer Pass, Taralets records which kind of pass it was, the trip a Trip Pass was spent on, when an Organizer Pass’s year ends, and Gumroad’s reference for the sale. The licence key itself is never stored — only a one-way hash of it, which is what stops one key being used twice. Taralets never receives your card or your billing details.

There is no location tracking, no access to your contacts, no device fingerprinting, and no profile built about you for advertising.

Why it is processed

Taralets uses this information to:

• provide the trip-planning and collaboration service;
• create accounts, sign you in and keep you signed in;
• manage invitations and who belongs to which trip;
• store your content and show it only to the people your settings allow;
• let a group coordinate — plans, bookings, tasks, requests and announcements;
• calculate and display balances and settlements from the expenses the group enters;
• keep the service secure, available and working correctly;
• answer you when you write for support or exercise your rights;
• meet obligations that apply under law.

Who can see it

Being on a trip is not permission to see everything on it. Access rules are enforced on the server and in the database itself, on every request, rather than relying solely on what the interface displays:

• Documents are private by default. A document marked “Only me” can be opened by you alone — the trip organizer included. No role has an override. You may share one with the whole trip, or with named people, and you may withdraw that at any time. Only you can edit or delete your own.
• Memories work the same way. Private to you, shared with the trip, or shared with named travellers — your choice, and only you can edit or delete your own.
• Answers to requests are visible to you and to the trip’s organizers, and to the wider trip only when that answer is explicitly shared with it.
• Your profile — your name and photo — is visible to people you share a trip with. You control your own photo and can remove it at any time.
• Trip content such as the itinerary, announcements and expenses is visible to that trip’s members, according to their role. Individual itinerary items and their bookings can be restricted to the travellers taking part in them.
• Nothing is visible to people outside a trip, or to anyone signed out, with one exception you have to switch on yourself: a share link for the plan, described next.

Sharing a plan outside the trip

A trip’s organizers can create a link to its itinerary. Anyone holding that link can read it without a Taralets account, so it is as public as wherever you put it. Nobody else on the trip can create or remove that link, and no link exists until an organizer makes one.

What such a page contains, and what it does not:

• It carries the plan. The name the organizer gave the share, the destination, how many days it runs, and each item’s title, description, type, local time of day, place, address and map coordinates.
• It does not carry people. No traveller is named, nobody’s profile or photo appears, and who an item was for is not included.
• It does not carry bookings, money or notes. No provider, confirmation number, reference or amount; no expenses, contributions or balances; no notes written on an item. No document, receipt or memory is reachable from it.
• It does not carry the trip’s own name, which is often the most personal thing about it. The shared page shows a name the organizer writes for it.
• It does not carry your dates. Items appear as “Day 1, Day 2” with the local time of day. The dates you are actually away are not published.
• Items restricted to some of the group are left out entirely, as are cancelled ones. Marking something as visible to only some of the trip is therefore also the way to keep it out of a share.

Stopping the share makes the link stop working for everyone, immediately and permanently; sharing again creates a different link. We ask search engines not to list these pages, but that is a request they choose to honour rather than something we can enforce, and it does nothing about a link that is forwarded. Anyone who opened the page while it was live may have copied the plan into a trip of their own, and stopping the share does not reach those copies — they contain only what the page showed. A record that the link existed, including the name the organizer gave it, is kept after it is switched off so the trip can account for what was shared.

Files

Documents, memory photos and profile photos are held in private storage. None of them has a public address. When you are allowed to see one, the server checks that first and then issues a link that works for a few minutes and then stops working.

Reading a document for you

Taralets can read a booking confirmation, a receipt or an itinerary and fill in the form in front of you, so you do not have to retype what is already printed on the file. This is the only part of Taralets that sends anything you have stored to another company, so here is exactly how it works.

• Only when you ask. Nothing is scanned when you upload it. A document is sent only when you press a button that says so — Read it, Fill the booking from this file, Fill this in from the receipt — and only the one document you chose.
• Nothing is saved from it until you accept it. What comes back fills boxes on screen. You can change or clear any of them, and nothing reaches your trip until you save the form yourself. On an imported itinerary, every entry arrives with a tick you can remove.
• Every read is written down. Who asked, which document, when, and whether it worked. Everyone on the trip can see that list — including people who cannot open the document itself, because the fact that a file was read belongs to the trip even when its contents do not.
• There is a limit. Twenty documents per trip in any thirty days.
• It is Anthropic that reads it, through their API. Under Anthropic’s commercial terms, material sent that way is not used to train their models and is deleted within thirty days. Taralets keeps the document itself where it always was, under the rules in Who can see it.

If you would rather nothing left Taralets, do not press the button. Every form it fills can be filled by hand, and nothing about a trip depends on it.

Who else processes it

Running Taralets requires infrastructure providers, which process information on its behalf:

• Supabase — the database, sign-in and file storage.
• Vercel — hosting and serving the website itself.
• Resend — delivers the email Taralets sends you: an invitation to a trip, the link that lets you set up an account, and a password reset if you ask for one. Taralets sends no marketing email of any kind.
• Anthropic — reads a document when, and only when, you press a button asking it to. See Reading a document for you below. Nothing is sent automatically, and nothing else you store is sent at all.

These providers process information as necessary to provide their services to Taralets, subject to their applicable contractual, security and privacy obligations. Taralets does not sell personal information, does not share it for advertising, and does not use it to train anything.

Gumroad sells the Trip Pass and the Organizer Pass and is the merchant of record for that sale. It is deliberately not in the list above, because it does not process anything on Taralets’ behalf: you buy from Gumroad directly, giving your email address and payment details to Gumroad under Gumroad’s own privacy policy, and Taralets never receives your card. In the other direction, when you paste a licence key, Taralets sends Gumroad that key and the product it is checking it against — not your name, not your email address, and not which trip you are unlocking.

Taralets’ primary database and file storage are hosted in Supabase’s Tokyo (ap-northeast-1) region. This describes where the database and stored files live; it is not a claim that every operation performed by every provider — such as serving a page, delivering an email, or reading a document you asked to have read — happens in that one region. A document sent to be read leaves that region for as long as the reading takes.

Cookies

One kind only: the cookie that keeps you signed in. It is set when you sign in and cleared when you sign out. Taralets sets no advertising, analytics or tracking cookies.

Working offline

If you install Taralets on your phone, it keeps a copy of a small, fixed set of pages so they still open without a signal: a trip’s itinerary and its announcements, both of which show trip-visible content only. Documents, memories and the short-lived links to files are not cached for offline use.

Signing out asks the app to clear what it kept. Two honest limits: a page cached before you were removed from a trip can remain on that device until it is cleared or replaced, and Taralets can only clear its own cache — it cannot control copies your browser, device or operating system may hold.

How long it is kept

Information is kept only for as long as reasonably necessary for the purposes it was collected for — including keeping a group’s shared trip record intact, security, backups, and any legal or accountability obligation. There are no fixed deletion periods, and this policy does not invent any. In practice:

• Your account information is kept while the account exists.
• Shared trip content — plans, bookings, tasks, requests, announcements — belongs to the trip and is kept while the trip exists.
• Financial records are kept as part of the group’s history. Removing an expense keeps it, with the reason given, rather than erasing it, so nobody else’s balances silently change.
• Documents and memories are kept until you delete them. Deleting one in the app removes the stored file as well as the record of it.
• Operational and security records, including provider logs and backups, are kept for as long as those providers retain them and as long as they are useful for keeping the service secure and recoverable. A deletion is therefore not instantly reflected in every backup.

Archiving a trip is not deletion. An archived trip is moved out of the way and keeps everything in it. It is still stored, and its members can still open it.

Deleting your account

There is no self-service delete button in the app today. To have your account deleted, write to support@taralets.club and it will be carried out. Because trips are shared, deletion behaves as follows:

• Your profile is deleted — your name, email address, any phone number and your profile photo.
• The trips you were on are not deleted. They belong to the group. If you owned one, ownership passes automatically to the most senior remaining member so the others do not lose it; if nobody is left to inherit, that trip is archived rather than deleted.
• Your membership record stays, without you attached to it. The group’s expenses, splits and activity point at that membership, so deleting it would leave everyone else’s balances wrong. The link between it and your account is severed and it no longer carries who you were; the app shows it simply as someone who left the trip.
• Your private documents and memories stop being reachable by anyone, including you, because nobody can hold the membership they belonged to. Note that this makes them inaccessible — it does not by itself erase the underlying files. Anything you had shared with the whole trip stays visible to that trip.

So if you want files erased rather than merely unreachable, delete them in the app before asking for your account to be deleted — that removes them from storage as well as from the database. You can also ask, at support@taralets.club, for specific content to be erased. Free text that you or others typed — an expense note, a memory caption, an announcement — may still mention you by name, and can be corrected or removed on request.

Your rights

The Philippine Data Privacy Act of 2012 gives you rights over your personal information. Subject to applicable law and any lawful limitations, these include the right to be informed, to access your data, to have it corrected, to object to how it is processed, to request its erasure or blocking, to obtain a copy in a portable form, and to be indemnified for damage caused by inaccurate or unlawfully obtained data. Some of these can be limited — for example where information forms part of another person’s record, such as a group’s shared financial history, or where the law requires it to be kept.

Much of this you can do yourself in the app: view and correct your profile, change what is shared with whom, and delete your own documents and memories. For anything else, write to support@taralets.club. We will respond without undue delay and generally within 30 working days. Where permitted by law, complex or numerous requests may take longer, and we will explain the reason for any extension.

If you are not satisfied with how a request was handled, you may complain to the National Privacy Commission of the Philippines.

Security

Access is decided on the server and in the database on every request, rather than relying solely on what the interface displays. Files are held in private storage that cannot be read without permission being checked first, and are served through links that expire in minutes. Invitation links are stored as one-way hashes, so a copy of the database cannot be used to join a trip.

No system is without risk, and nothing here promises otherwise. If you find something wrong, please write to support@taralets.club rather than posting it publicly.

If there is a data breach

If Taralets experiences a personal data breach that requires notification under applicable law, we will notify the affected individuals and the National Privacy Commission as required by law and within the periods it sets.

Children

Taralets accounts are intended for adults, and children should not create accounts themselves. Children may appear in trip plans, documents and memories created by adult users as part of a family or group trip.

A child can also be listed as a traveller by name, with no account, so that a shared bill can account for them. That name is written by the organizer and is visible to the trip: the child is not asked, has nothing to sign in to, and has nothing to consent to, so the adult who adds them is responsible for doing so. If you would rather a child were not named on a trip, ask whoever organises it to remove them, or write to support@taralets.club.

Changes

If this policy changes, the “last updated” date at the top changes with it. Where a change materially affects how your personal information is handled, you will be told in the app before it takes effect. See also the terms of use.