Version 2026-10-03
Comitivo, Inc. (“Comitivo”, “we”) runs the Comitivo website and iPhone app. This policy says what we collect, why, who else receives it and the choices you have. Dietary needs are also covered by our consumer health data policy.
Your sign-in email or phone number, the name and photo you choose, optional home city and payment handles, and the settings you pick. We record when you confirmed you are 18 or older and which version of these documents you accepted.
For plans: the plans you create or join, your answer (in, maybe or can’t go), who invited you, the deadlines you mark done, cover photos organizers upload (we remove location and camera details from photos), the invite links you make and how often they were used, and the people you have shared plans with.
From your device: the kind of device or browser, the app version, your time zone and, if you turn notifications on, a token to reach your phone. We also record which screens and features you use (see “Analytics and error reports”). Each section below covers what a feature collects.
A sign-in email holds a code and a link. The part of the link that signs you in is never sent to our servers until you press Continue. On the website’s sign-in forms, Cloudflare Turnstile checks that a person, not a program, is asking for the email; to do that Cloudflare sees your IP address and details about your browser. It also checks the first answer from someone answering without an account (below), on a page whose address holds no link. It doesn’t run on invite or share pages.
If you’re signed in to Google in your browser, the website’s sign-in page may offer to continue with your Google account. Google then knows you visited that page. If you’ve signed in with Google before, it can sign you straight back in, except right after you sign out. Google shares your name, email address, profile photo and Google account ID with us, the same as with the Continue with Google button. This doesn’t run on invite pages either.
If you sign in with Apple, we keep a token from Apple, encrypted, only so that when you delete your account we can tell Apple to stop Comitivo using your Apple ID. It’s deleted once Apple has done that.
If you sign in with Microsoft, Microsoft shares your name, email address, Microsoft account ID and whether Microsoft has verified that address. Nothing from Microsoft loads until you choose it.
Anyone with an invite link sees the plan’s name, dates and cover photo. When the plan’s organizers turn on “Show who’s going on invite pages”, the link also shows who invited you (their name and photo), the organizers, the names and photos of up to four people who are in, how many are in or might be, the place and an estimated cost per person. Someone who isn’t signed in sees first names only; a signed-in person with the link or an invitation sees full names, except on links where an organizer approves new people. Link previews in chat apps show only the place and the inviter’s first name. People who can’t go are never shown.
So you can copy or share a link you made again later, we keep an encrypted copy of it that only you can open, while the link works and you’re in the plan. Each time you open it is recorded. The copy is deleted as soon as the link is turned off, expires or is used up.
You can turn off “Show me on invite pages” in Settings: invite pages and invitations then never show your name or photo, though you still count in how many are going, and invitations you send still say they’re from you. Signed-in visitors never see people they’ve blocked or who blocked them. Organizers can turn links off at any time, and links stop working on their own after 90 days or the day after the trip.
When you share a poll, a deadline, a schedule item or something added to the plan into another chat app, the link shows anyone who has it the plan’s name and cover and that one thing’s own words: a poll’s question and options, a deadline’s title and due date, or an item’s title and start time. It never shows who shared it, who is going, votes or counts, places, notes, booking codes or costs. An answer tapped on the link is sent only after you sign in, and only if you’re in the plan, unless the plan lets people answer without an account (below); a share link never adds anyone to a plan. Links stop working when the poll closes, the deadline passes or the item starts, after 90 days at most, or when the person who shared them leaves the plan, and whoever shared a link, the poll’s creator or an organizer can stop it sooner.
When a plan’s organizers turn on “Let people answer without an account”, someone with one of its poll’s share links or its invite link can vote or say if they’re in with just a first name and the first letter of their last name, after confirming they’re 18 or older. Their name and answer are shown to the people going in the plan, marked “not signed up”, and organizers can rename or remove them. Guests never see results, names or anything else in the plan.
So the same browser can change or delete its answer, we keep a random code in a cookie on that browser for a year. Our database keeps only a scrambled form of it that can’t be matched to the browser without a key only our servers hold. We don’t ask guests for an email address, phone number or password, so we can’t contact them. Their IP address is used only to limit how many people can answer from one place and is kept no longer than a day for that.
Guest answers are deleted 30 days after the plan ends (or 180 days after the last answer if the plan has no end date), when the guest deletes them, or when an organizer removes them. If the same browser later signs up and joins the plan, the answers move to the new account.
Your packing list for a trip is yours alone: organizers, other people in the trip and the assistant never see it, and what’s on it never shapes suggestions. On iPhone it’s kept on your phone too, so you can tick things off without a signal. It’s in your data download, and it’s deleted when you leave the trip or delete your account. “Save as my list” keeps one copy for your next trips until you delete your account.
Messages, reactions and photos you send in a plan’s chat are seen by the people in that channel: Everyone is the whole plan, and Going is the people who are in or might be. We remove location and camera details from photos. When a message is removed, its text and photo are deleted right away. We don’t read your messages, except one that someone reports to us.
If you turn on notifications in the iPhone app, we keep a token for your device so we can send them through Expo’s and Apple’s push services, and drop it when you sign out. Notifications and emails say who did what, never what a message says. We keep your time zone, updated from your phone or browser when it changes, so quiet hours and the daily summary follow your local time. You choose what reaches you in Settings, and every email that isn’t essential has a link to stop it.
If you turn on Product news email (in Settings, or with the box when you sign up), we put your email address and first name on our mailing list at Resend, which sends our email for us. Product news comes from news.comitivo.com, and for those emails only we see whether each one was opened and which links were clicked, so we can tell what’s useful. Other Comitivo email isn’t tracked. Every product news email has a link to stop; stopping, turning it off in Settings or deleting your account takes you off the list. Members who joined before November 2, 2026 had it turned on for them and can turn it off the same way.
When you invite someone by email, we send them one invitation and keep only a scrambled form of the address, so we can match it if they sign up with it. We never tell you whether an address already has an account. The link in that email carries their address in a part of the link the browser doesn’t send to us, so their answer can email them a sign-in link with one tap.
Reservations you add to a plan (flights, stays, cars, meals and so on) are seen by everyone in the plan. Confirmation codes are encrypted and shown only to the people a reservation is for and the person who added it; they never appear in chat, notifications, emails or your calendar link.
When you forward a booking email to your Comitivo address or upload a PDF or screenshot, we receive it through Resend, keep it privately for 7 days, and read only the booking details from it. If the email has no machine-readable booking details, we send its text and attachments to Anthropic’s Claude, which reads them for us and, under our agreement with Anthropic, isn’t used to train its models. The result is a draft only you see until you add it to a plan. Drafts you don’t add are deleted after 30 days. Email from an address that isn’t yours, or that mail checks can’t confirm came from you, waits until you approve it; we then remember a scrambled form of the address.
Place search goes through MapTiler, which receives what you type but not who you are. Maps on the website load from MapTiler too, so MapTiler sees your IP address and the area shown. Your calendar link shows your reservations to anyone who has the link, without codes, notes or costs; you can turn it off in Settings. If you open a booking site’s link on a reservation marked “not booked yet” (such as “Search on Booking.com”), the site receives the place (with the reservation’s name, if no place was picked from search), dates and number of people going, never who you are. The same goes for the searches in a trip’s Book it section: the site receives the trip’s place, dates and number of people going, and Google Flights only the place and dates, never where you’re leaving from. For each of these we record which site and plan it was for, and keep that for 2 years. For now these are plain links and we earn nothing from them; a link we may earn a commission from says so beside it.
When organizers set up rooms for a stay, the people going and the organizers see the rooms and who is in each bed, and any extra or discount on a room. A room you ask for is seen only by the organizers. The list of things to bring, with who added and who claimed each item, is seen by everyone in the plan. Your bed, room requests and claims go when you stop going or leave the plan.
Things you add to a plan’s schedule (an activity, a meal, a night out or a meet-up), with their time, meeting place and note, are seen by everyone in the plan, with your name as the person who added them. So is whether you said “I’m in” or “Not me”; your answers go if you leave the plan or can no longer go. If you said you’re in, we send you a reminder 30 minutes before, except during your quiet hours, and your calendar link leaves out what you said “Not me” to.
The schedule also shows you what’s missing for you, such as a night with no stay or a dinner with nothing planned, worked out from what you can already see. Nobody else sees yours. Organizers can set a trip’s pace (full days or relaxed), which everyone in the trip sees. When you choose “Not needed”, we remember it only on your device: in a cookie for that trip on the website, or on your phone. It never reaches our servers.
Flights you add to a plan appear on its arrivals board for the people in the plan, with their status, gate and baggage claim, and the status you set yourself (such as “Landed”). If you’re not flying, how you’re getting there (by car, train or bus) and when you expect to arrive appear there instead. To follow a flight we send its airline, flight number and departure airport to Aviationstack, never who is on it. If a delay puts your connection at risk, we tell you and the plan’s organizers. We delete the flight status records when no plan uses them, and your flights and arrival plans 30 days after the trip.
About 24 hours before each of your flights, we remind you to check in; the reminder never holds a confirmation code, and we keep a record that it was sent for 30 days after the flight. If you use Live Activities on iPhone, your flight’s status, gate and times, or the arrivals board’s first names and times, show on your Lock Screen. Their updates reach your phone through Apple’s push service, and we keep the activity’s token only while it runs, at most 24 hours. The trip widget shows your next trip, or your own next item today, from what’s already on your phone. Neither ever shows a confirmation code, seat, cost, note or anyone else’s flight number, and you can turn Live Activities off in Settings.
Expenses, receipt photos and payments you record are seen by everyone in the plan. We remove location and camera details from receipt photos. Comitivo never moves money: settle-up buttons open Venmo, PayPal, Cash App or Revolut, or show a Zelle email or phone to copy, and you mark the payment yourself. A Zelle phone is your verified sign-in number, shown only to people in your plans when you turn it on; we don’t keep another copy. To convert currencies we ask Frankfurter for the European Central Bank’s rates, sending only the currencies and the date.
When someone asks for payment for an expense, the people asked see what they owe and to whom. Organizers and the person being paid see who has paid; organizers also see who hasn’t. Everyone else in the plan sees only how many have paid. To suggest payments that change currency as little as possible, we work out which currency each person uses from the time zone saved on their phone; other people see only the currency, never the time zone.
The estimated cost per person is worked out from the plan’s reservations and the organizers’ estimates, and every member sees it. Your own reservations’ costs are added only in your own view, and private budgets never feed it.
In polls, everyone sees the results; in an anonymous poll nobody, organizers included, can see who voted for what. Your budget for a trip is encrypted and seen only by you. Others see only one line, the lowest budget among people going who added one, rounded down, and only once at least three others have (accounts newer than a week don’t count toward that yet); it says “everyone” only when everyone going has added a budget. It never has your name, but in a small group of friends people may still guess whose budget set it. An organizer can turn budgets off for a trip: then nobody is asked for one and nothing reads them, and the budgets already added are kept, unused, until budgets are turned back on. You can still remove yours.
Photos you add to a plan’s album are seen by everyone in the plan, who can also download the full-size versions. We remove the location from the full-size photo unless you turn on “Keep photo locations” for that upload; the smaller copy shown in the album never has location or camera details. You or an organizer can delete a photo at any time, and deleting your account deletes the photos you added.
To show the forecast and warn of unusual weather or storms, we send the coordinates of the trip’s destination (or of the airports on travel days) and the dates to Open-Meteo, never who is going. We keep the forecast for that place, not for you.
Allergies, diets (including religious diets), not drinking alcohol and the short note you add are health information. We collect them only after you agree on a separate screen, and we record that you agreed. We store them encrypted. You choose how they are shared, and can change it at any time. If you choose “Show my dietary needs to the people in my trips, with my name”, people going in your trips see your diets, allergies and whether you drink, with your name, and so does the trip assistant when one of them asks it; people who can’t go and people only invited don’t. Otherwise organizers of your plans see only combined counts, such as “Vegetarian: 2”, from people going, and only once at least three others have added theirs (accounts newer than a week don’t count toward that yet); never your name. Your note is never shown to anyone, whichever you choose. In a small group of friends, people may still guess who a count is about, and before you save we show you exactly what others will see. The trip assistant uses what you chose to share when people in your plans ask it for suggestions, and may mention it in its answer; to do that it sends it, never your note, to Anthropic’s Claude. We use them only for your allergy card and your group’s needs: never for ads, never sold, and never shared with partners. They are never sent to our analytics or error reports. The iPhone app keeps a copy of your allergy card on your phone so it works offline, and removes it when you sign out. You can download your dietary needs with your data, and deleting them (which also withdraws your agreement) takes effect immediately. Our consumer health data policy has the details and your rights.
The tastes you pick (what you love, like or skip) help suggest places your group will enjoy. If “Share my tastes” is on, people in your plans see them with your name. We ask the first time you save a taste, and nothing is shared until you answer; you can change it any time in Settings, and before you turn it on we show you exactly what people would see. If it’s off, others see your tastes only added up with at least two other people’s, never with your name, though in a small group of friends people may still guess. If you suggest something we should add to the list (“Suggest it”), we keep the word with your account for a year so we can review it; it isn’t a taste and nobody else sees it. When you skip something for tonight or a trip, the people in that plan see it with your name; it never changes your tastes. While “Learn from my votes and check-ins” is on (it is unless you turn it off), we note the kinds of places you vote for, go to and rate after a trip, and suggest tastes for you to confirm; nothing is added until you do. We never guess your tastes from chat, photos or location. We delete votes and check-in answers used for suggestions after 24 months, and you can reset everything in Settings. When someone in your plan asks the trip assistant for ideas, it uses tastes the same way: yours by name only if you share them.
When you ask the trip assistant a question, we send it, with your earlier questions in that conversation and the plan details it needs (the plan’s name, dates and place, its reservations without codes or notes, the forecast, flight status, and the group’s needs and tastes, by name only for people who chose to share them), to Anthropic’s Claude, which answers for us and, under our agreement with Anthropic, isn’t used to train its models. Anything you write in a question, including about your own health, goes to Anthropic with it, so leave out what you don’t need to say. To find places, we send what the assistant searches for and roughly where the trip is to Google Places, never who is asking. We don’t keep your questions or the answers: they stay on your device, and only you see them unless you share one to the plan’s chat. We keep a record that you asked (when, in which plan, and what it cost) for one year, without the question or the answer. “Add to plan” makes a draft only you see, with the place’s name, address and location from Google.
“Suggest a plan for” a day works the same way: the assistant gets the trip’s pace, that day, and any note you add, and drafts the day. We don’t keep the draft; what you choose to add becomes your own schedule items, which everyone in the plan sees. The schedule’s “Only on your dates” come from a list we keep for each place, matched to the plan’s place and dates only, never to who you are.
Only if you turn it on in the iPhone app, for one trip at a time, the app uses your location to tell the people going and the organizers about how far away you are. By default they see only the minutes, and we don’t store your position; if you choose to share your exact position, we keep only the latest one. Sharing stops when you pause it, after 24 hours or at the end of the trip, and we then delete what was shared. Your location is never sent to our analytics, advertisers or the trip assistant.
If you report a message or a person, we receive the report with that message and the plan’s name, and review it within 24 hours. Blocking someone hides their messages and notifications from you; they aren’t told. Feedback you send, with any screenshot you attach, reaches us by email. We keep reports and feedback for one year. When we reply, the reply is saved with your feedback, shown under Your reports and emailed to you from support@comitivo.com.
Ideas you suggest go only to us, like feedback. If we publish an idea, everyone signed in sees its cleaned-up title, description and status, never who suggested it. Your votes are yours to see; others see only the count. When an idea you suggested or voted for ships, we tell you once in the app, and by push or email only if you turned on Product news.
To learn which features people use and where they get stuck, the website, the iPhone app and our servers record events in PostHog, such as which screen you opened or that you added a room, with your account ID, the platform and the app version. Events never include message text, plan names, destinations, email addresses, phone numbers, links with tokens, dietary needs, tastes, budgets or locations. PostHog is set to discard your IP address, and nothing runs on invite pages.
On the website we also count page visits with Vercel Web Analytics, which uses no cookies. It gets only the kind of page (for example “a trip’s bring list”), never its address, so no trip, booking or link in it, plus the browser, device type and country, which Vercel works out from the visit without keeping your IP address. Invite and share pages aren’t counted.
When something breaks, the website and the iPhone app send an error report to Sentry: what went wrong, on which screen, and the kind of device or browser and app version. We strip message text, tokens, codes and exact locations first, and Sentry is set not to keep IP addresses. On the website only, a report can include a short recording of the minute before: where you clicked and how the page changed, with every word, everything you typed, every link and every picture hidden. Nothing is recorded when nothing goes wrong, on invite pages or in the iPhone app. Recordings are deleted after 30 days.
Now and then we may ask a short optional question, at most once a quarter, never in chat, dietary needs or sign-in. Your answer and any comment go to PostHog without anything about your plans.
The website uses cookies that keep you signed in and protect sign-in (including a short-lived one for Google sign-in). In your browser’s storage it keeps a PostHog ID, when we last asked you a survey question and whether your time zone is saved; a trip assistant conversation stays in the tab until you close it. Cloudflare Turnstile and Google sign-in may set their own cookies on the sign-in page. If you answer without an account, a cookie keeps a random code for a year so that browser can change its answer (see Answering without an account). We use no advertising cookies and don’t track you on other sites.
These companies process information for us, only to provide their service to Comitivo and under agreements that limit what they can do with it:
These companies may keep what they receive for a short time under their own policies, for example to prevent abuse. Booking sites and payment apps receive information only when you open them, under their own policies.
We may share information if the law requires it, such as a valid court order; to protect someone’s safety or stop fraud or abuse; or to enforce our terms. If Comitivo is sold or merged into another company, your information may move to it, and this policy’s promises go with it; we’ll tell you before your information falls under a different policy.
There are no public profiles. People in your plans see your name, photo, your answer and anything you choose to share. People outside your plans see only your name and photo, and only if you asked to join a plan they organize, invited them or were invited by them, or are connected through an earlier plan; or, when a plan shows who’s going, if they have one of its invite links and you’re in it, organize it or sent them the link (see Invite links). Your email address and phone number are never shown unless you turn that on.
A few Comitivo staff can open a support view of an account to help with problems, after a second sign-in step with an authenticator app, and every time they do it is recorded with a reason. That view shows things like when the account was created, how it signs in and error codes, with the email address hidden until needed. It never shows messages, tastes, dietary needs, budgets, confirmation codes, locations or photos. Staff see a message only when someone reports it, and can’t sign in as you.
Everything travels encrypted, and everything we store is encrypted. Dietary needs, budgets and confirmation codes are encrypted a second time, so a copy of the database alone doesn’t reveal them. Photos and receipts are stored privately and shown through links that expire within an hour. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.
We keep your account while you use it, and each section above says how long a feature keeps its data. Plans and their chat, photos and expenses stay until an organizer deletes the plan or you delete your own content. If an account isn’t signed in to for 3 years, we email twice and then delete it. Backups we keep in case of an outage hold deleted data for up to 30 days.
Your information is stored in the United States by us and the companies that help us, and some of them may process it elsewhere. If you use Comitivo from another country, your information is handled under this policy wherever it goes.
Comitivo is for people 18 and older. We don’t knowingly collect information from anyone younger; if we learn an account belongs to someone under 18, we delete it.
We never sell your information, share it for advertising based on what you do elsewhere, or share your dietary needs, tastes or budgets with advertisers or partners. We don’t use your information to make decisions about you that have legal or similarly significant effects.
From Settings you can download everything we store about you, change what you share, correct your profile, delete your dietary needs, tastes and budgets, and delete your account.
When you delete your account, we remove your personal information within 30 days. A few things stay so your group’s records still work: expenses you were part of stay without your name so others can settle up; in other shared content your name becomes “Former member”; your messages show “Message removed”; and reports you made are kept for their year without your name. Backups hold it a little longer, as above.
Wherever you live, you can also ask us to tell you what we hold about you, give you a copy, correct it or delete it, by emailing support@comitivo.com. We answer within 45 days, may need to confirm it’s you, and won’t treat you differently for asking. Someone you authorize can ask for you, with proof that you did. If we turn down a request, you can appeal by replying to our answer, and we’ll decide within 45 days and tell you how to contact your state’s attorney general if you still disagree.
We don’t sell or share your information for advertising, so there’s nothing to opt out of; we treat a Global Privacy Control signal as that request anyway. Because we don’t track you across other sites, we don’t respond differently to Do Not Track signals.
If you sign in with your phone number, we text you sign-in codes, and other texts only if you turn them on. We don’t share your phone number or text-message opt-in with third parties or affiliates for their marketing or promotional purposes. Reply STOP to stop texts, or HELP for help; message and data rates may apply.
The version date at the top says when this policy last changed. When a change matters, we tell you and ask you to accept the new version the next time you sign in. Before we use your dietary needs in a new way, we ask for your agreement again.
Comitivo, Inc., a Florida corporation. support@comitivo.com