Privacy Policy

Last updated: July 24, 2026

The short version: we store what you need to plan trips, we don't sell your data, and Gmail access is read-only, optional, and used only to find trip-related confirmations.

What we collect

• Account info — your name and email, provided through our sign-in provider, Clerk.
• Trip content — itineraries, bookings, tasks, notes, packing lists, and chat messages you create while planning.
• Voice dictation — audio you choose to record is sent to our AI provider only to create the transcript you requested. Tabiya records usage metadata such as duration, but does not retain the audio recording.
• Diagnostics — sanitized technical events (errors, load failures) used to keep the app working. These never include passwords, tokens, or message contents.
• Billing and usage — Stripe or Apple transaction references, subscription state, purchases, and per-account AI usage metering. We do not store full card numbers or Apple payment credentials.

Gmail access (optional)

If you choose to connect Gmail, Tabiya requests read-only access and uses it for one purpose: finding travel confirmations (flights, hotels, activity bookings) relevant to your trip and adding them to your plan. Specifically:

• We never send, delete, or modify your email.
• When Gmail is connected, selected message metadata and body text may be sent to Google's Gemini service solely to determine whether a message is travel-related and extract the booking details the feature shows you. Google does not use this data to train its models under our service terms.
• We store the extracted booking details (for example a flight number and time) in your trip — not your inbox or full message bodies.
• OAuth tokens are encrypted at rest, and you can disconnect Gmail at any time from settings, which revokes our access.
• We do not allow employees or contractors to read Gmail data unless you explicitly ask us to inspect specific data for support, it is necessary to investigate a security issue, or disclosure is required by law.

Tabiya's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How your data is processed

We use a small set of service providers to operate Tabiya: Clerk (authentication), Railway (hosting and database), Stripe and Apple (payments), and Google (Gemini models that power the assistant). Your chat messages and relevant trip context are sent to the AI model to generate replies; they are not used to train models under our agreements. We don't sell personal data and we don't run third-party advertising or tracking.

Sharing

Trip data is private to you and people you explicitly invite. If you create a public share link, only a deliberately filtered, read-only view is exposed — confirmation numbers, contact details, and private notes are never included.

Retention and deletion

Your data is kept while your account is active. Diagnostic events expire after roughly 30 days. You can permanently delete your account from Settings; shared-trip ownership must first be transferred to an eligible collaborator. Account deletion immediately removes account-private content, connected-account tokens, and identifying chat records. Solo trips are deleted; shared-trip content remains available to its continuing collaborators after ownership transfer. We retain only limited billing, fraud-prevention, deletion-audit, and de-identified usage records when needed to meet legal, accounting, security, or service-integrity obligations. Disconnecting Gmail deletes the stored tokens immediately. You may also contact support@gettabiya.com for help.

Cookies

We use only functional cookies: keeping you signed in, remembering a guest planning session, and unlocking share links you've entered a password for. No advertising cookies.

Contact

Tabiya is an independently operated service based in California, United States. Privacy questions or deletion requests: support@gettabiya.com.