Privacy

What we collect, why we need it, where it goes, how long we keep it, and how to make us delete it. Written to be checkable against what the app actually does.

Effective 31 August 2026 · Last updated 10 September 2026

Who we are

TripKaro is a voice travel assistant for India. In the language of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

Contact for any privacy question, correction or deletion request: skjainmiah.ds@gmail.com. We answer within 7 days.

The short version

You sign in with your mobile number. That number is your identity here.
The app reads travel events in your calendar — two months back and two months ahead — so trips appear without you typing them. Only travel events are sent to us, and only if you leave the backup switch on.
Your voice is sent to speech services while you are talking. We do not keep recordings — but we do keep what was said, until you ask us to delete it.
A photograph of a ticket you scan is kept for ninety days, so we can check the reader against it.
If your pack includes journey tracking, we store your position about every half hour while a journey is running, and delete each one after thirty days.
We do not sell your data. There is no advertising in this app and no ad network in it.
You can delete everything we hold, by asking.

What we collect, and why

Because you gave it to us

Data	Why	Kept for
Mobile number	It is how you sign in and how we tell one traveller from another. Verified by a one-time code.	Until you delete your account
Name	The assistant greets you by it. Required.	Until you delete your account
Email	Optional. Only so an itinerary can be emailed to you.	Until you delete your account

Anything else you type into your profile — such as gender, which helps fill in booking forms — stays on your phone and is never sent to us.

Because you granted a permission

Permission	What we do with it	Does it leave your phone?
Microphone	Hear you during a voice conversation.	Yes — audio streams to our speech services while you speak. See Voice.
Location	Answer "how long to the airport from here" and work out when to leave. If you have a pack that includes journey tracking, also follow a journey while it is running.	A position is sent with a request that needs it, and held only for that answer. While a journey is being tracked, positions are also stored — see Following a journey.
Calendar	The only way trips are found automatically. Read-only, two months back and two months ahead, looking for travel events. Google already adds flights, hotels, trains and buses to your calendar from Gmail, so most bookings are there. Nothing is ever written to your calendar.	The journey we work out from it — where and when. Non-travel events are filtered out on the phone and never sent. Where your phone cannot make sense of a travel event on its own, that event's title, place and notes are sent to be read; see below. Nothing is sent at all with the backup switch off.
Camera	Photograph or pick a ticket so it can be read.	Yes. The image is sent to be read, and we keep it for ninety days so we can check how well the reader is doing its job — see Photographs of tickets.
Contacts	The app no longer asks for this at all. It once did, for a feature that was never finished, so the permission has been removed.	No. Your contacts are not read, and nothing from them is sent.
Notifications	Tell you your train is late or your platform changed.	No.

The app cannot read your messages or your notifications. Earlier builds did both. Both have been removed entirely — there is no SMS permission and no notification access — so trips are found from your calendar alone. The trade is that a booking confirmed only by SMS, with no email and no calendar entry, will not appear on its own; you can still add it by voice or by scanning the ticket.

We do not read your call log either. An earlier build asked for that permission and never used it. Removed.

Your sign-in code. When a verification code arrives, Android shows you its own dialog asking whether TripKaro may read that one message. We never see any other message, and the app holds no SMS permission to fall back on.

Because the app was used

Your trips and journeys — where you are going, when, and on what.
What you asked and what the assistant answered, as text, so a conversation can continue across turns.
Technical records of each call — how long it took, which recogniser and model served it, what it cost us. Used to keep the service working and affordable.

Voice, specifically

When you speak to TripKaro, your audio goes to our server and on to a speech recognition service, which turns it into text. The text is answered by a language model, and a synthesis service turns the reply back into speech.

We do not keep recordings of your calls. The app contains a call-recording feature used for debugging voice problems. It is switched off in production and stores nothing while it is off. If we ever need to turn it on to investigate a specific fault, we will ask the affected traveller first; recordings made that way are deleted after 7 days automatically.

The written record is a different matter, and it is kept. What was said — the words and their timings, not the audio — is stored against your account and kept until you ask us to delete it. Typed conversations are kept the same way, for the same reason: the point is to read back a conversation that went wrong, and a problem that only shows up over a season cannot be found in a week of history. Ask us and it goes.

Your calendar, specifically

This is the most sensitive thing the app reads, so it is worth being precise. Since September 2026 it is also the only automatic source — the app holds no SMS permission and no notification access.

Your calendar is read on your phone, within a four-month window: two months back, two months ahead.
Only events that look like travel are sent to us. Birthdays, meetings and everything else are skipped on the device, before anything is sent.
Read-only. Nothing is ever added to or changed in your calendar — it is shared with family on many phones, and an event you did not create appearing in it would be a surprise.
What we store is encrypted, with a key held separately from the database. A copy of the database on its own cannot be read.
It is filed under a hashed identifier, so the stored messages do not carry your name or number alongside them.
It expires by itself after 30 days. This is not a cleanup job someone has to remember to run.
At most 60 messages are kept at a time — a working set for current journeys, not an archive.
The assistant is never given your messages. When you talk to it, it receives the ten-digit booking reference, not your correspondence.
One exception, and it is worth stating plainly. Indian operators word their confirmations differently and change them often, so when the app cannot make sense of a travel message on the phone, the text of that message is sent to a language model to be read. It only ever applies to messages already judged to be travel confirmations, there is a cap per scan, and the extracted journey is what we keep — not the message.

You can switch this off. Settings → Back up journeys. With it off, nothing derived from your messages or calendar leaves the phone. It is on by default so that your trips survive changing or reinstalling your phone; turning it off means they do not.

Following a journey, specifically

Journey tracking is part of the Regular and Frequent packs. It is the only thing in TripKaro that stores where you have been, so it is worth being exact about it. If your pack does not include tracking, none of this happens and nothing is stored — the app is refused when it tries.

What is stored	Latitude, longitude, speed, accuracy and the time. Nothing else. No place names, and no guess about what a place is — a home, a workplace, a hospital. Turning a coordinate into a sentence happens when you ask, against the journey you are on, and is not written down.
When	Only while a journey is being followed.
How often	About every thirty minutes. Anything faster than one fix every five minutes is discarded. Half-hourly is enough to see the shape of a journey and whether it is going to plan, which is all this is for.
How long	Thirty days. No individual position is kept more than thirty days after it was recorded — not thirty days from your last trip. It happens by itself; nobody has to run anything.
Who can see it	You, in the app. And our staff: a member of the TripKaro team with the right role can read a traveller's trail through our internal tools, which is how we investigate a report that tracking went wrong. We say so here because a policy that omitted it would be incomplete.
Deleting it	You can erase your trail at any time from the app, and it goes immediately rather than at the end of the thirty days.
Does it leave us	No. The trail is not sent to any other company and is not used for advertising, which there is none of in this app.

Photographs of tickets, specifically

When you photograph a ticket, the picture is sent to us and read by a model that pulls out the train number, the date, the seat and so on. You then see what it read and confirm or correct it, because a misread ticket looks exactly like a correct one.

We keep the photograph for ninety days. This is the part worth being plain about, because an earlier version of this policy said we did not.

Why we keep it	To check the reader against the picture it was reading. Without the two side by side we cannot tell how often it gets a blurred number wrong, and so cannot fix it.
How long	Ninety days, then it is deleted automatically. Older pictures are also removed early if the store grows too large.
Who can see it	Our staff: a member of the TripKaro team with the right role can open it through our internal tools, and every time one is opened that is written down. It is never shown to another traveller and there is no way to browse it from the app.
What it contains	Whatever is on your ticket — which is usually your name, your booking reference and where you are going. We treat it accordingly.
Deleting it	Ask us and the pictures attached to your account go with everything else.

Your phone's identifiers, and problem reports

Two small things leave your phone that are easy to overlook, so they are written down here rather than left out.

A push identifier and an installation identifier. The first is how Google's notification service knows which phone to wake; the second lets us recognise the same installation when that first one is renewed, so you do not get every alert three times. Neither identifies you as a person, neither is used for advertising, and both stop being useful the moment you uninstall.
Problem reports. When something goes wrong the app can send us what happened — the app version, the phone model, the Android version, and a short trail of what it was doing. Some are sent when you ask; some are sent on their own when the app hits a fault worth knowing about. They are for fixing the fault and nothing else.

Who else sees your data

We use other companies to do specific jobs. They process data on our instructions and for no purpose of their own. We do not sell personal data to anybody, and we do not share it for advertising.

Who	What they get	What for
MSG91	Your mobile number	Sending and verifying the one-time code
Deepgram	Your voice while you speak	Turning speech into text
Murf	The assistant's reply text	Turning text into speech
Google (Gemini)	What you asked, and travel details needed to answer	Answering the question
Anthropic (Claude)	The same, for planning-heavy turns and as a fallback	Answering the question
RailKit	Booking reference, train number, stations, date	Live train and PNR information
Ola Maps	Place names and approximate coordinates	Distances and travel times

Some of these operate outside India, so answering you involves transferring data abroad. We use them under their standard terms as processors.

How long we keep things

What	How long
Account (number, name, email)	Until you ask us to delete it
Trips and journeys	Until you delete them, or the account
Messages synced from your phone	30 days, automatically
Your conversations with the assistant, typed or spoken	Until you ask us to delete them. We keep them so we can read back where the assistant went wrong — a problem that takes a season to appear cannot be found in a week of history
Voice recordings	Not kept. If ever enabled to investigate a fault, 7 days
Photographs of tickets you scan	90 days, automatically
Signed-in session	Up to 60 days, or until you sign out
Push and installation identifiers	Dropped after 120 days without use, or when you sign out
Problem reports you send us	Until the problem is resolved

Your rights

Under the DPDP Act you may:

Ask what we hold about you, and who we have shared it with.
Correct anything wrong — a misspelled name, an old email.
Have it erased. Email us and we will delete your account and everything attached to it.
Withdraw consent at any time. Revoke a permission in Android settings, or turn off Back up journeys. The app keeps working; the features that needed it stop.
Nominate someone to exercise these rights if you are unable to.
Complain to the Data Protection Board of India if we have not dealt with you properly.

Write to skjainmiah.ds@gmail.com for any of these. We reply within 7 days.

Children

TripKaro is not for children under 18. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, tell us and we will delete it.

How we protect it

Everything travels over HTTPS.
Messages synced from your phone are encrypted at rest, with the key held outside the database.
Your session credential is excluded from phone backups, so it cannot be restored onto a device you no longer own.
Access to the server is limited to people who need it, and configuration changes are logged.

No system is perfectly secure. If a breach affects you, we will tell you and the Data Protection Board as the law requires.

Changes

If this policy changes in a way that matters, we will say so in the app before the change takes effect. The date at the top always reflects the current version.