Tripcruncher
Legal

Privacy Policy

Version 1.1 · Effective 30 October 2026

Yarnmaker Pty Ltd (ABN 11 112 559 029, ACN 112 559 029) owns and operates Tripcruncher. In this Privacy Policy, Yarnmaker Pty Ltd is referred to as "Yarnmaker", "we", "us" or "our". This Policy explains how Yarnmaker collects, uses, stores and shares personal information through the Tripcruncher website, application, AI-assisted search, trip-planning tools and related services (together, the "Service").

Yarnmaker is based in Queensland, Australia. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply, together with other privacy laws that apply to our handling of your information. This Policy should be read with our Terms of Use.

1. Information we collect

Depending on the features you use, we collect or may collect:

  • Account and identity information: your name, email address, profile details, social-login profile picture, account identifiers, sign-in provider and information the provider makes available according to your settings.
  • Trip and traveller information: trip titles, dates, destinations, addresses, itineraries, transport, accommodation, activities, booking details, notes, traveller names, permissions, invitations and sharing settings.
  • Preferences and AI search information: home location or origin, interests, budget, travel style, accessibility or dietary needs, crew and vibe notes, search instructions, anchor locations, and the recommendations you request, save or dismiss.
  • Transaction information: if you purchase a paid feature, information such as Search Token purchases and balances, amounts, currency, taxes, receipts, payment status, refunds, disputes and payment-provider references. Full payment-card numbers and security codes are handled by the payment provider and are not stored by us.
  • Communications: support requests, complaints, feedback and other messages you send to us or through our support provider.
  • Technical, usage and security information: IP address, approximate location, browser and device type, operating system, referring pages, pages and features used, dates and times, cookie or similar identifiers, diagnostics, session records, and security or misuse events.
  • Legal and audit information: the Terms version you accept, the Privacy Policy version shown with it, response timestamps, the account and email associated with the response, IP address, privacy choices, account restrictions and administrative audit records.

2. How we collect information

We collect personal information directly from you and automatically when you use the Service. Depending on the features you use, we may also receive information:

  • from another user who adds you as a traveller, records trip information about you or sends you an invitation;
  • from authentication, payment, analytics, mapping, AI, email and support providers; and
  • where authorised or required by law.

If you give us personal information about someone else, you must have their permission or another lawful basis to do so and, where appropriate, make this Policy available to them.

Where practical, you may browse public pages without identifying yourself. You may choose not to provide requested information, but we may then be unable to create an account, process a purchase, provide a personalised search or make another requested feature available.

3. How and why we use information

Depending on the features and circumstances involved, we use personal information where reasonably necessary to:

  • provide, personalise and maintain trips, collaboration, maps, AI searches and requested features;
  • create and secure accounts, authenticate users and apply traveller permissions;
  • process payments, maintain token balances, issue receipts, refunds or recredits, and prevent fraud;
  • send service messages, invitations, security notices and responses to support requests;
  • understand and improve performance, reliability, accessibility and user experience;
  • detect, investigate and prevent misuse, security incidents and breaches of our Terms;
  • keep business, tax, consent and legal records; and
  • comply with law, enforce legal rights and resolve disputes.

We do not sell or rent personal information or share it for cross-context behavioural advertising. We do not use health, accessibility, dietary or other sensitive information for advertising.

4. Legal bases where required by law

Where the EU General Data Protection Regulation, UK General Data Protection Regulation or another applicable law requires us to identify a lawful basis, we identify and document the basis appropriate to each processing purpose. Depending on the purpose, we may rely on one or more of the following:

  • Contract: processing needed to provide the Service or take steps you request before entering into a contract.
  • Legitimate interests: operating, securing and improving the Service, preventing fraud, supporting users and protecting our legal rights, where those interests are not overridden by your rights.
  • Consent: optional analytics, marketing or other processing for which we ask for your specific consent. You may withdraw consent at any time without affecting earlier lawful processing.
  • Legal obligation: processing required to comply with applicable law.

If we process sensitive or special-category information, we also identify an additional condition required by applicable law, such as explicit consent where appropriate.

5. Cookies, browser storage and optional analytics

The Service uses necessary cookies and similar browser technologies for authentication, security, session continuity and remembering privacy or interface choices. These are active because the relevant feature cannot work reliably without them. Blocking necessary storage in your browser may prevent parts of the Service from working.

We use Google Analytics 4 to understand overall use of Tripcruncher and improve the Service. Where our Australian notice arrangement is enabled and our delivery provider reliably identifies your current visit as coming from Australia, analytics may be on after we show the cookie notice, unless you have already refused or turn it off. Closing that Australian notice dismisses it; it does not record consent or change an existing choice. A separate necessary cookie remembers only that the notice was dismissed, not permission to use analytics.

For visits from elsewhere, when we cannot reliably determine the country, or when the Australian notice arrangement is not enabled, we use Google's Basic Consent Mode: the Google Analytics tag is blocked and no analytics data is sent to Google until you select Allow usage analytics. Closing or ignoring that notice keeps analytics off. This includes visits from the EEA, United Kingdom and Switzerland. Global Privacy Control and an existing necessary-only choice keep analytics off everywhere. The core Service remains available without analytics.

When analytics is on, we send generic page categories and titles, reduced referring-site information and approved campaign categories so we can understand visits, sessions, acquisition and which parts of Tripcruncher are used. Referrers are reduced to approved site origins; campaign sources and media use fixed categories, and campaign codes must be on our approved list. Raw referring URLs, query strings, trip and traveller identifiers and unreviewed page paths are excluded. We do not intentionally send Google names, email addresses, trip plans or notes, booking details, precise itinerary information or advertising identifiers. Analytics still uses browser identifiers and is not anonymous simply because we read aggregate reports. Browser and device information, timestamps, general interaction information, IP address and an approximate region may be processed by Google. Google Signals, enhanced measurement, advertising storage, advertising user data and advertising personalisation are disabled.

An explicit privacy choice is stored in a first-party cookie for up to 180 days. If you are signed in, we also store that explicit choice in your Tripcruncher account so it can be applied in another browser that does not yet have its own choice. An explicit browser choice takes priority over the account setting. The Australian default and dismissal marker are not saved as account consent and do not grant analytics permission for a visit elsewhere. Existing refusals remain respected when this notice changes. You can turn analytics off or change your choice at any time through Cookie Settings in the site footer or, when signed in, through your account privacy settings. Turning it off stops future collection from that browser and removes its Google Analytics cookies. This does not itself erase information already lawfully processed; contact us through the Help Centre to request deletion or exercise your rights under applicable law.

You can also delete or block cookies through your browser settings. Doing so may remove the saved choice and cause the notice to appear again. Google provides a separate Google Analytics opt-out browser add-on. For more information, see how Google uses information from sites and apps that use its services.

6. AI Assist and mapping services

When you choose to use AI Assist, we send Google's AI and Maps services the information reasonably needed to perform your request. This may include an anchor name and address, general trip context, crew and vibe notes, interests, budget, dietary or accessibility preferences, search instructions and excluded recommendations. Google processes that information under the terms and privacy arrangements applicable to those services.

Do not put passport details, payment-card information, medical records or other highly sensitive or unnecessary personal information into AI prompts, trip notes or search preferences. If another traveller can be identified from information sent to AI Assist, make sure you have their permission or another lawful basis to use it in that way.

Maps displayed in the Service and links opened on Google Maps may cause your browser to communicate directly with Google, which may receive technical information such as your IP address and the page or map request. AI Assist provides suggestions; it does not make decisions that produce legal or similarly significant effects about you.

7. When we share information

Depending on the features and circumstances involved, we share relevant personal information:

  • with people you invite, collaborators and anyone able to access a public or shareable trip link, according to the permissions and settings you select;
  • with providers that host, secure or support the Service, including cloud hosting, database, authentication, payment, analytics, AI, maps, email and customer-support providers;
  • with professional advisers, insurers, auditors and contractors who need it to perform their work and are subject to appropriate confidentiality obligations;
  • where reasonably necessary to investigate fraud, security threats, misuse or harm;
  • where required or authorised by law, court order or a lawful request from a regulator or enforcement authority; or
  • as part of a genuine merger, financing, sale or transfer of the business, subject to appropriate privacy safeguards.

Third-party websites or booking providers that you choose to open receive information directly from you and handle it under their own privacy policies. A link from Tripcruncher does not make us responsible for that third party's privacy practices.

8. International storage and transfers

Yarnmaker is based in Australia. Tripcruncher's primary hosting is in the United States, and its application, account and trip data are stored there. Our providers may also process information in the United States, Australia and other countries in which they or their subcontractors operate. Your information may therefore be processed in countries other than the country where you live or use the Service.

Privacy laws and government-access rules differ between countries. Where required, we assess providers and transfer arrangements, use contractual or other recognised safeguards, and take reasonable steps to protect personal information. You may contact us for current information about material providers, processing locations and applicable transfer safeguards.

9. Sharing trips and public links

Trip owners control invitations, traveller permissions and public or shareable links. Invited people may be able to view, copy, add, change or delete information according to their access. A person who receives a shareable link may forward it, and information made public may be copied or indexed outside our control. Review a trip before sharing it and remove confidential or unnecessary information. If you receive an invitation you did not expect, contact the trip owner or us.

10. Sensitive information and younger users

Trip preferences can reveal sensitive information, including health, disability, religious or dietary information. Provide it only when genuinely useful, and only provide another person's sensitive information with their consent or where the law otherwise permits. We use sensitive information only for the feature or purpose for which it was provided, or as otherwise authorised by law.

The Service is not designed for children to use without adult involvement. A person under 18 should use it only with permission and supervision from a parent or legal guardian. If you believe a child's information has been provided without appropriate permission, contact us so we can investigate and take appropriate action.

11. Communications and marketing

We may send messages needed to operate or secure the Service, including sign-in, invitation, payment, legal, support and security messages. If we send optional marketing, it will identify us and include a way to unsubscribe. Unsubscribing from marketing does not stop necessary service messages.

12. Security and data breaches

We use technical and organisational safeguards designed to protect personal information, including encryption in transit, access restrictions and secure development practices. Safeguards vary according to the information, risk and service involved. No internet service or storage system can be guaranteed completely secure.

If a data breach occurs, we investigate, contain and remediate it. We notify affected people and relevant regulators when applicable law requires notification, including under Australia's Notifiable Data Breaches scheme where it applies.

13. How long we keep information

We keep personal information only for as long as reasonably needed for the purposes in this Policy, including providing the Service, maintaining security and audit history, resolving disputes and meeting legal, tax, payment and accounting obligations. Retention depends on the information: active trip and account information is generally kept while the account or trip is active; transaction, acceptance, security and dispute records may need to be kept longer; backups are removed on a reasonable cycle.

The browser cookie recording your current privacy choice expires after no more than 180 days unless you replace or remove it sooner. A signed-in account preference remains until you change it, the applicable notice changes, it expires under our settings rules, or the account is deleted, subject to any required retention. The separate notice-dismissal cookie also lasts no more than 180 days. If Google Analytics is enabled, its browser cookies are configured for no more than 180 days. User-level and event-level Analytics retention is configured for two months without resetting on new activity; Google may retain aggregate reports differently. We review retention and delete or aggregate information when it is no longer reasonably needed.

Anonymous or de-identified information that can no longer reasonably identify a person may be retained for analytics, security and service improvement.

14. Your privacy choices and rights

Depending on where you live and the applicable law, you may have rights to access, correct, delete or receive a portable copy of personal information; restrict or object to processing; withdraw consent; and complain to a privacy regulator. These rights may be subject to exceptions. Where applicable, you also have the right not to receive discriminatory treatment for exercising a privacy right.

Some information can be updated directly in the Service or removed by a trip owner. Other requests can be submitted through the Help Centre. We may need to verify your identity and authority before acting. We respond within the period required by applicable law and generally do not charge for making a request. If we refuse or limit a request, we will explain why and identify available complaint options where required.

15. Privacy questions and complaints

Contact us through our Help Centre with "Privacy" in the subject. Describe your concern and include enough information for us to investigate without sending unnecessary sensitive information. We will acknowledge and investigate the complaint and aim to respond within 30 days, or tell you if we reasonably need more time.

If you are not satisfied with our response, you may contact the privacy or data-protection regulator in your place of residence where that right is available. In Australia, you may complain to the Office of the Australian Information Commissioner. A regulator may expect you to give us an opportunity to resolve the complaint first.

16. Changes to this Policy

We may update this Policy as the Service, providers or law change. Each published version shows a version number and effective date. If a change materially affects how we handle personal information, we will provide reasonable notice and seek consent where required. We retain previous versions so changes can be identified.

17. Contact details

Privacy requests and legal notices can be submitted through the Help Centre or sent to: Privacy Officer, Yarnmaker Pty Ltd (ABN 11 112 559 029, ACN 112 559 029), PO Box 5340, Stafford Heights, Queensland 4053, Australia.