💳 Trip Wallet OS

by Go Cellular LLC

Data Deletion

Updated: October 9, 2026

Trip Wallet OS has no accounts. Almost everything lives on your phone, so most deletion happens right in the app. The data we can hold on a server is: an optional shared Family Trip; daily usage counters (a random install ID and a hashed network address with a request count, reset every day); web-app install events (a random visitor ID); and, only if that feature is on, a forwarded booking email for up to 7 days. Details below.

Delete data on your device

• One expense / document / event: open it and use its delete (🗑) action. Travel Docs documents are removed from the app's private storage when deleted.
• One trip: Home → My Trips → open the trip → Delete (confirm “Delete this trip?”). This permanently erases that trip's expenses, receipts, flights, boarding passes, documents, timeline and notes; other trips and your settings stay.
• Current trip only: Settings → Data → Reset Current Trip. The Medical Card is one device-wide record and is not part of a trip: edit or clear its fields in the card.
• Everything: Settings → Data → Reset All Trip Wallet OS Data (you must type RESET). This erases all trips, documents, the Medical Card, settings, the App Lock PIN and the app's random install ID on this device.
• Uninstalling the app also removes all local app data from the device.

Delete Family Trip data from our server

If you created or joined a shared Family Trip, the shared trip is on our server (hosted on Railway) so members can share a budget. We store: trip name, budget, dates, currencies, a random join code, member display names, the destination country chosen for the trip, and the shared expenses (label, merchant, note, amounts, split). Receipt photos are stored only if the trip owner turned on photo sync and a member's device opted in (off by default); they are visible to everyone in that trip. The data is kept until the trip owner deletes the trip — there is no automatic expiry yet.

• Trip owner, in the app: only the person who created the trip can delete it. Open Home → Family Trip (the Budget tab) → Delete shared trip. This immediately and permanently removes the shared trip, its member list, all synced expenses and any synced photos from the server — for every member. Each member keeps whatever is stored locally on their own phone.
• Other members: you can leave the trip, which only disconnects your phone; it does not delete the server copy. To have your display name removed from the trip, email gocellularfix@gmail.com with the trip's join code (or trip name and approximate dates) and we'll handle it, normally within 7 days (and no later than 30 days).
• By email (owner who can't use the app): email the same address from the trip owner's side with the join code and we'll delete the trip, normally within 7 days (and no later than 30 days). Every member holds the join code, so it does not prove who owns the trip: we may ask for details only the owner would know (such as the trip name, dates and member names) before deleting.

Other data we can hold, and how to ask

• Usage counters: an install ID and hashed network address kept with a count for the current day, then reset. They cannot be tied to a person and need no deletion.
• Web-app install events: recorded with a random visitor ID stored in your browser (up to 400 days). Clear the site data for app.tripwalletapp.com to remove the ID from your browser. Our retention target for raw events is 90 days, after which they become daily counts; the clean-up is a job we run, so events can remain stored longer until it runs. To have events with your visitor ID deleted sooner, email us the ID.
• Forwarded booking emails (only if that feature is on): kept up to 7 days; expired messages are removed the next time the inbox is used.
• Provider and hosting logs: our hosting providers (Railway, Netlify) and the AI, speech and data providers handle what they receive under their own policies and may keep standard logs or backups that we do not control. We cannot delete data from their systems, but we send them only what the Privacy Policy describes.
• Other requests (access, correction, deletion): email gocellularfix@gmail.com; see Your choices and requests. We can only find records if you give us an identifier such as a Family Trip join code or your visitor ID.

What we don't store

Trip Wallet's server does not keep AI scan photos or AI translation text after a request completes, so there is nothing of that kind to delete on our server. Those photos and text are processed by a third-party AI service (Anthropic) under its own terms. The Travel Docs feature and the Medical Card never leave your phone (the AI scanner sends only the photo you choose, after consent; do not scan passports, IDs or boarding passes with it). Exchange-rate requests contain no personal data. Live flight-status lookups (flight number and date, when that feature is on) are held in server memory for a few minutes to hours and are not written to our database. Web analytics (PWA): raw events have a 90-day retention target and then become daily counts (see above); the random visitor ID lives in your browser storage, which you can clear at any time. Daily usage counters reset each day.

What deletion means

Deletion is permanent. There is no recycle bin, no account recovery and no cloud backup held by us. A forgotten App Lock PIN can only be resolved by the in-app full reset, which erases the local data it protects. Export a backup (Settings → Data → Export Backup) before deleting anything you might want back.