Privacy Policy

Effective date: July 25, 2026 Last updated: August 5, 2026

This Privacy Policy explains how the operators of Bluprint ("Bluprint," "we," "us," or "our") collect, use, share, and protect your information when you use the Bluprint mobile application and related services (the "Service").

Bluprint is operated by its two founders; Rinah Seo (d/b/a Bluprint) is the responsible party and data controller for the personal information described in this policy. If you have any questions about this policy, contact us at bluprintsupport@gmail.com. To exercise your privacy rights (such as accessing or deleting your data), see Section 7.

1. Who We Are

Bluprint is a travel-planning app. It lets you create trips, build itineraries, track expenses and bookings, get AI-generated trip plans, import bookings from forwarded confirmation emails, invite other people to collaborate on trips, follow other users, and publish trips for others to discover.

We are the data controllers for the personal information described in this policy.

2. Information We Collect

2.1 Information you provide directly

Account information. When you sign up, we collect your email address, a username, and a display name. If you register with a password, it is handled and stored in hashed form by our authentication provider (Supabase) — we never see or store your plaintext password.
Google sign-in (optional). If you choose to sign in with Google, we receive basic profile information from Google associated with your account, such as your email address, name, and Google profile picture. We do not receive your Google password.
Profile information. A profile photo (you may choose a preset avatar or upload your own image from your device's photo library), plus any other profile details you choose to add, and your preferred app language.
Trip content. Information you enter to plan trips, including trip names, destinations, dates, itinerary items and visits, flights, hotels, transportation, expenses (amounts and currency), notes, and any other content you add to a trip.
Travel books and recaps. If you create a travel book, we store its configuration and any photos you choose to upload from your device's photo library. Travel books and their photos are private to your account — they are not visible to trip collaborators or the public, they are stored in private storage only your account can access, and the app displays the photos using short-lived signed links. Trip recaps are generated from your existing trip data; if you save or share a recap image, it is saved to your device (with your permission) or shared through your device's share sheet — we do not receive a copy.
AI planning inputs (optional). If you use the AI trip-planning features, the information you provide for the plan — such as your destination, dates, preferences, budget level, notes, and the places already in your trip — is used to generate suggestions. See Section 2.3.
Forwarded emails (optional). If you use the email import feature, you can forward a booking confirmation email to a trip-specific Bluprint email address. We process the email's content to extract booking details (for example, a flight, hotel, or reservation) into a draft that you review before anything is saved to your trip. We do not store the raw email. We keep only the extracted draft plus the email's subject line and sender address for context, and unreviewed drafts are automatically deleted after about 30 days. Only forward emails you have the right to share.
Collaboration and social data. People you invite to a trip, trips you publish publicly, accounts you follow and that follow you, accounts you block, and ratings or interactions on published trips.
Reports. If you report a published trip or a user, we collect the report — which content or account you reported, the reason you selected, and any details you type in — linked to your account. Reports are used only for moderation: they are reviewed by us (a copy is delivered to our support inbox) and are never shown to the reported user.
Consent records. Whether and when you accepted our Terms of Service and Privacy Policy (including the version), and whether you opted in to marketing communications.
Communications. If you contact us (e.g., by email), we keep your messages and contact details to respond.

2.2 Information collected automatically

Usage and device data. Basic technical information needed to operate the app, such as device type, operating system, app version, and log/diagnostic data. This is processed by our infrastructure providers (Supabase, Expo) to deliver and secure the Service.
Push notification tokens. If you allow notifications on your device, we store a device push token so we can deliver push notifications to you. You can stop this at any time by turning off notifications in your device settings or adjusting your notification preferences in the app.
Approximate location from IP address. When you view flight price estimates, we may use your IP address to estimate your departure city. We do not collect your device's precise GPS location (see Section 2.4).
Map interactions. Trip maps are rendered by Mapbox, so when you view a trip map, get walking/driving routes between stops, or download a map for offline use, the coordinates of the places involved (and your device's IP address, as with any internet request) are sent to Mapbox to serve the map tiles and routes.
Offline data on your device. If you download a trip for offline use, its content and map tiles are stored locally on your device and can be removed in the app's offline-trips settings.
In-app notifications. We generate records of notifications shown to you within the app (for example, a trip invitation or a new follower).

2.3 AI features

Some features use artificial intelligence provided by Anthropic (the Claude models) as a data processor:

AI trip planning. When you request an AI-generated plan, your planning inputs (Section 2.1) are sent to Anthropic to generate itinerary suggestions.
Email import. The text of a confirmation email you forward is sent to Anthropic to extract structured booking details.
Translations. Short AI-generated texts (such as the reason a place was suggested) may be sent to Anthropic to translate them into your app language.

We send only what is needed for the feature to work. Under our API arrangement, Anthropic does not use this data to train its models.

2.4 What we do not collect

We do not collect your device's precise or background location. Maps and place search show locations you look up or add, but the app does not track where your device is. (We may derive an approximate city from your IP address for flight price estimates, as described in Section 2.2.)
We do not knowingly collect payment card or banking information. Expense amounts you type in are plain numbers for your own budgeting — they are not connected to any payment processing. Bookings you make through links in the app happen on third-party sites, not in Bluprint.

3. How We Use Your Information

We use the information above to:

Create and manage your account and authenticate you.
Provide core features: building trips, itineraries, expenses, bookings, and collaboration.
Generate AI trip-plan suggestions, extract booking drafts from emails you forward, and translate AI-generated text, when you use those features.
Show you indicative hotel and flight prices for your trip (including estimating your departure city from your IP address for flight prices).
Enable social features you choose to use, such as following users and publishing trips.
Show you relevant in-app notifications, and deliver push notifications to your device if you have allowed them, based on your notification preferences.
Maintain, secure, and improve the Service, and prevent fraud, abuse, or violations of our Terms.
Review reports you or other users submit, moderate reported content and accounts, and apply blocks you set.
Enforce our anti-copying rules for published trips.
Communicate with you about the Service, and — only if you opted in — send marketing or product-update messages.
Comply with legal obligations.

Legal bases (for users in the EEA/UK). Where applicable law requires a legal basis, we rely on: performance of our contract with you (to provide the Service), your consent (for marketing and optional features), our legitimate interests (to secure and improve the Service), and compliance with legal obligations.

4. How We Share Information

We do not sell your personal information. We share information only as follows:

With other users, at your direction. When you invite someone to a trip, your collaboration content is visible to them. When you publish a trip, its content and your public profile (username, display name, avatar) become visible to anyone who can use the Service. When you follow or are followed, that relationship is visible per the app's social features.
With service providers who process data on our behalf, under contracts that limit their use of it:
- Supabase — authentication, database, and file storage (hosts your account, trips, and uploaded images).
- Google — sign-in (OAuth) and Places (to let you search for places and see place details and photos).
- Mapbox — renders trip maps, provides walking/driving routes between stops, and serves offline map downloads (receives the coordinates being mapped or routed and your device's IP address).
- Anthropic — AI processing for trip-plan suggestions, email parsing, and translations (see Section 2.3). Anthropic does not use this data to train its models.
- Cloudflare — receives and relays emails you forward to your trip's import address.
- Resend — delivers transactional email on our behalf (account verification and other authentication emails, messages you send us through the in-app contact form, and internal copies of content reports).
- Expo / EAS — app build and delivery infrastructure, and delivery of push notifications via Expo's push service (which in turn uses Apple and Google notification services).
- LiteAPI and Travelpayouts (Aviasales) — supply indicative hotel and flight prices. We send them trip parameters such as city, dates, and party size — not your name or account details — though your IP address may be used to estimate your departure city for flight prices.
- Pexels — supplies stock imagery shown in the app (we request images from them; we do not send them your personal data).
- Frankfurter — supplies currency exchange rates for converting expense amounts (we send only currency codes, no personal data).
App stores (Apple App Store, Google Play) — to distribute the app and process any store-level interactions, subject to their own privacy policies.
For legal reasons — if required by law, regulation, legal process, or to protect the rights, safety, and property of Bluprint, our users, or others.
In a business transfer — if Bluprint is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

5. International Data Transfers

Bluprint is initially offered to users in North America, and we intend to expand to other regions over time. Our service providers may process and store data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for international transfers. By using the Service, you understand your information may be transferred to and processed in these locations.

6. Data Retention

We keep your personal information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal information within a reasonable period, except where we must retain certain data to comply with legal obligations, resolve disputes, or enforce our agreements. Content you shared with others (for example, a trip you published or contributions to a shared trip) may persist where others retain copies or where deletion would disrupt a shared trip.

7. Your Rights and Choices

Depending on where you live, you may have rights to:

Access the personal information we hold about you.
Correct inaccurate information (much of this you can edit directly in the app).
Delete your account and associated personal information.
Object to or restrict certain processing, and withdraw consent at any time (for example, by turning off marketing or notification preferences).
Data portability — receive a copy of certain information.

How to exercise them. You can edit your profile and notification preferences in the app at any time. To request access, deletion, or a copy of your data, email bluprintsupport@gmail.com. We will respond within the timeframe required by applicable law.

Verifying your request. To protect your information, we may need to verify your identity before acting on a request — typically by confirming that you control the email address associated with your account. You may use an authorized agent to submit a request on your behalf; in that case we may require proof of the agent's authorization and may still verify your identity directly.

Account deletion. You can request deletion of your account and personal data at any time by emailing bluprintsupport@gmail.com or using the in-app account deletion option where available.

7.1 United States — California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA ("CCPA"), gives you the right to:

Know / access the categories and specific pieces of personal information we have collected about you, the sources, the business purposes for collecting it, and the categories of third parties to whom we disclose it.
Delete personal information we have collected from you, subject to certain exceptions.
Correct inaccurate personal information we maintain about you.
Opt out of the sale or sharing of personal information. We do not sell or "share" (as defined under the CCPA) your personal information, including for cross-context behavioral advertising, so no opt-out is required — but you may still contact us with any questions.
Limit the use of Sensitive Personal Information. See "Sensitive Personal Information" below — because we use it only for permitted purposes, no "Limit" option is required.
Non-discrimination. We will not discriminate against you for exercising any of these rights.

To make a request, email bluprintsupport@gmail.com. We will verify and respond as described in "Verifying your request" above.

Notice at Collection

In the 12 months preceding the effective date, we collect the following categories of personal information. "Retention" for every category is the same: we keep it for the life of your account and delete or de-identify it within a reasonable period after account deletion, except where a longer period is required by law (see Section 6).

CCPA category	Examples we collect	Source	Business purpose	Disclosed to
Identifiers	Email, username, display name, Google account ID, device/app identifiers, device push tokens, IP address in logs	From you; automatically from your device; from Google (if you use Google sign-in)	Account creation, authentication, operating and securing the Service, delivering push notifications	Service providers (Supabase, Google, Expo); other users at your direction
California customer records (Civ. Code §1798.80(e))	Name/display name, email address	From you	Account management and communication	Service providers (Supabase)
Commercial information	Expense amounts and currencies you enter for your own budgeting; booking details you enter or import from confirmation emails you forward (e.g., flight, hotel, and reservation details)	From you (entered in the app or extracted from emails you forward)	Provide trip, expense, and booking-import features	Service providers (Supabase, Anthropic for parsing, Cloudflare for email relay); collaborators you invite
Internet or network activity	App usage, log and diagnostic data, app version, OS/device type	Automatically from your device	Operate, secure, and improve the Service	Service providers (Supabase, Expo)
Geolocation data	Approximate city estimated from your IP address (flight price estimates only) — we do not collect precise or background device location	Automatically from your device	Show indicative flight prices from your likely departure city	Service providers (Travelpayouts)
Audio/visual information	Profile photo/avatar you upload; images you add to trips and travel books	From you	Display your profile, trip, and travel-book content	Service providers (Supabase); other users at your direction (travel-book photos are private to your account and not shared)
Sensitive personal information	Account login credentials	From you / your authentication provider	Authenticate and secure your account only	Authentication provider (Supabase)
Inferences	Not collected — we do not build profiles or draw inferences about you	—	—	—

Sensitive Personal Information

The only Sensitive Personal Information we collect is your account login credentials, and we use them solely to authenticate you and keep your account secure. We do not use or disclose Sensitive Personal Information for purposes that would entitle you to a "Limit the Use of My Sensitive Personal Information" right under the CPRA.

"Shine the Light" (Cal. Civ. Code §1798.83)

California residents may request information about our disclosure of personal information to third parties for those third parties' own direct marketing purposes. We do not share your personal information with third parties for their direct marketing purposes.

Do Not Track

Some browsers and devices transmit "Do Not Track" (DNT) signals. Because there is no common industry standard for interpreting DNT signals, and because we do not track you across third-party websites or services for advertising, we do not currently respond to DNT signals.

7.2 EEA / UK

If you are in the EEA or UK, you have the rights described above under the GDPR/UK GDPR, including the right to lodge a complaint with your local data protection authority.

8. Children's Privacy

Bluprint is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are under the age of majority in your jurisdiction, you may use the Service only with the involvement and consent of a parent or legal guardian. If you believe a child under 13 has provided us personal information, contact bluprintsupport@gmail.com and we will delete it.

9. Security

We use industry-standard measures provided by our infrastructure partners — including encryption in transit, hashed passwords, and database access controls — to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Third-Party Services

The Service relies on and links to third-party services (Google, Supabase, Anthropic, Cloudflare, Resend, Mapbox, Expo, LiteAPI, Travelpayouts, Pexels, Frankfurter, and the app stores). Their handling of data is governed by their own privacy policies, and we encourage you to review them. In particular, if you follow a booking link from the app to a third-party travel site, anything you do there (including making a booking or payment) is governed by that site's terms and privacy policy. We are not responsible for the privacy practices of third parties.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app or by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by the laws of the State of California, United States, without regard to its conflict-of-laws rules.

13. Contact Us

If you have questions, requests, or complaints about this Privacy Policy or your personal information, contact us at:

Email: bluprintsupport@gmail.com