Last updated: 2026-11-02
This policy explains what data Tabibito ("the app", "we") collects, what we use it for, who we share it with, and what you can do about it.
Tabibito is operated by Daniel Rodríguez (Costa Rica). If you have questions about this policy or want to exercise any of your rights, write to us at legal@tabibitotravel.com.
When you create an account: your name, email address, and password. Your password is never stored in plain text -- it's stored as an irreversible hash (argon2).
When you use the app: the trips you create or are added to (title, destination, dates, description, budget), and the flights, accommodations, activities, expenses, and checklist items you add inside each trip, including amounts, notes, and whether you marked them private or visible to the rest of the group.
When you invite someone to a trip: the invited person's email and the role you assign them.
When you use the AI Budget Estimator: the destination, dates, number of travelers, travel style, accommodation type, and interests you enter to generate the estimate.
When you subscribe to Premium: your subscription status (active, expired) and a customer/subscription identifier from Paddle, our payment processor. We never see or store your card number -- Paddle handles that directly.
We don't sell your data. We only share it with the providers we need to make the app work:
Tabibito uses a small number of cookies: one to remember your preferred language (Spanish/English), and an authentication cookie (httpOnly, meaning page JavaScript can't read it) that keeps you signed in. Neither is a tracking or advertising cookie.
Tabibito shows ads through Google AdSense. If you're in the EEA, UK, or Switzerland, or in certain US states, we show a consent message -- through a Google-certified consent management platform -- before any ads are personalized. Rejecting personalization is as easy as accepting it, directly from that same message.
Within a shared trip, expenses, flights, and accommodations marked private are only visible to whoever paid for them, created them, or has a split tied to them. Public items are visible to any trip member.
This privacy setting controls what other trip members see from each other -- it doesn't limit our own access to the data as the platform operator, described in the rest of this policy.
We keep your account and trip information while your account is active. If you delete your account, we immediately anonymize your email and password. Your name is anonymized too, with one exception: if you still owe money to someone else in a shared trip at that moment, we keep your real name on that specific debt so the person you owe can still recognize who it is -- this doesn't apply the other way around, if people instead owe money to you.
You can edit your name, email, and password directly from your profile in the app at any time, and delete your account yourself from that same page (after confirming your password) -- no need to write to us for that.
There's no self-service button yet to export your data -- write to us at legal@tabibitotravel.com and we'll process it manually, usually within a few days.
You have the right to request a copy of your data, its correction, or its deletion, to the extent applicable law allows.
Passwords are stored with an argon2 hash (irreversible). Connections to the app are always encrypted (HTTPS). No system is 100% secure, but we take reasonable measures to protect your information.
Tabibito isn't directed at children under 13, and we don't knowingly collect data from children under that age.
If we make significant changes to this policy (for example, when enabling advertising or a new provider), we'll note it on this same page along with the last-updated date.
For any question about this policy, write to us at legal@tabibitotravel.com.