Privacy and data

Local-First Travel Apps: What Actually Gets Uploaded, Feature by Feature

"Your data stays on your device" is a common promise. What it rarely tells you is which fields leave your phone the moment you tap Share, switch on a reminder or buy an upgrade. Using TripBoard as the example, this article lists them one feature at a time.

閱讀繁體中文版

Privacy & featuresPublished October 14, 2026Updated October 14, 20269 min read

travel app privacy
local-first
no account
backup

A travel app collects a lot: where you are going, which hotel you booked, which flight you take on which day, who is coming with you, and who paid for dinner. Put together, that is a fairly complete record of where you will be and with whom.

Most people never ask where that record lives until a new phone shows up with an empty app, or an email arrives saying the privacy policy has changed. This article skips the abstract principles and answers one concrete question: to make its features work, what is the minimum a travel app actually needs to upload?

Three architectures: cloud account, local-first, fully offline#

Travel apps roughly fall into three camps, and the difference is where the master copy of your trip lives. Each one has a cost; none of them is free.

How the three architectures handle new phones, sharing and reminders

Scroll the table horizontally

	Cloud account	Local-first	Fully offline
Where the master copy lives	The provider's servers; your phone holds a cache	Your device; the server only keeps what specific features need	Only on your device
Account required	Yes, usually email or social sign-in	Not necessarily; TripBoard has none	No
Switching phones	Sign in and it is back	Export a backup and import it yourself	Export and import yourself, if it is possible at all
Sharing with companions	Invite people to co-edit	A copy is uploaded only when you choose to share	Screenshots or exported files
Pre-trip reminders	The server knows your trip and can push any time	Only the fields a schedule needs, when you opt in	Your phone's own alarms or calendar

Cloud apps are the most convenient, and the price is that the provider keeps a full copy of every trip; if it leaks or the service shuts down, you have no say. Fully offline apps are the most private, and the price is that anything involving other people barely works. Local-first sits between them: nothing is uploaded by default, and when you use a feature that needs a server, only the minimum that feature needs is sent.

What local-first means in TripBoard#

TripBoard keeps your trips in IndexedDB, the database built into your browser. That is a property of the architecture, not a slogan: the server-side database has no table for trips, expenses or photos at all, and there is no user account system.

Data that only exists on your device

The trip itself: name, destination, dates, day plans and places, including place photos.
Flights, packing lists and notes.
Every expense, prepaid cost, currency exchange record and cash wallet.
Your travel companions and the bill split between them.
The bank account you enter when settling up, stored separately and left out of backups too.

The server holds six kinds of data, and nothing else: Pro activation codes, share links, contact form messages, rate-limit records that block abuse, push subscriptions, and push schedules. Here is where each of them comes from.

Feature by feature: what each one uploads#

Sharing is the only feature that uploads trip content, because your friends need to open it on their own phones. When you tap Share, the upload is the content the share page displays:

Trip name, destination, start and end dates, and the share card's theme colour.
Each day's date, plus the name, time, category and note of every place that day.
Flight details (flight number, airline, airports and times, seat, terminal and so on).
Not included: place photos, expenses, the companion list, or your trip notes.

A share link follows your edits, but its lifetime counts from the last update: 24 hours on the free plan, 7 days on Pro, then it is deleted automatically. Friends opening the link again and again does not extend it. The free plan allows one trip to be shared at a time and the only way to end it is to let it expire; Pro can stop sharing or swap in a new link at any time. The token that controls the link stays on your device, and the server keeps only a hash of it.

Two other kinds of sharing deserve a separate note. A settlement share is a one-off snapshot that does include expense names, amounts, who paid, who owes whom, and a bank account if you choose to add one; it also expires after 24 hours or 7 days. Emailing a trip sends the recipient's address and a trip summary (name, destination, dates, each day's place names and times, plus the budget if you set one) through the server to the email provider. When a share link is created, the server also stores a hash of your IP address, used only to cap how many links can be created.

Trip reminders: the one upload that happens without sharing#

Reminders 7 days before, 1 day before and on the morning of departure, plus a settle-up reminder the day after the trip, are pushed by the server on the right date. To do that the server has to know which day, which device, and what to say, so switching on reminders for a trip uploads the following (setup details in the iPhone push notifications guide):

The trip name, the trip's local ID number, and the send date of each reminder (worked out from the start or end date; the start date itself is not uploaded).
Which reminder times you ticked, and the date each reminder was last sent.
The push endpoint and encryption keys your browser provides, your interface language and your time zone offset.

The settle-up reminder has one detail worth knowing: whether it fires depends on whether the trip still has unsettled expenses, and that check happens only on your device. The server never sees amounts or settlement status; all it sees is whether a reminder is scheduled for that day. Reminders are off by default, turning them off for a trip deletes that trip's schedule, and records of sent reminders are cleared automatically after a while.

Pro activation: a code bound to a device#

When you buy Pro, payment is handled by Lemon Squeezy; TripBoard never sees or stores your card number, and the email address you enter is used only to send your activation code. When you enter the code, the app sends the code and a device identifier generated in your browser to the server, which binds the code to that device. What the server remembers is the code, the plan, and which device it is bound to. None of it touches your trips.

Contact form: your message and some diagnostics#

Sending feedback from the contact page or settings uploads the category you chose, the message you wrote, and a short block of diagnostics: browser version, the URL of the page you were on, language, whether the app is installed to the Home Screen, and screen size. It is delivered to the developer by email so the problem can be reproduced.

What is never uploaded#

Place photos: no feature uploads them, share links included.
Trip notes, packing lists, currency exchange records and cash wallets.
Expenses, bill splits and the companion list: the single exception is a settlement share you create yourself, and that snapshot is deleted when it expires.
Day plans: uploaded only when you share a trip by link or email, in the form described above.

One more category of traffic, for completeness: weather lookups send a city name or coordinates to the server, which forwards the query; exchange rates are fetched from a public rates service. The site also runs anonymous traffic statistics and ad-conversion tracking, which record events such as which page was viewed or which button was tapped. Those events carry no trip content.

The trade-offs: local-first is not free#

If the server does not have your trips, the server cannot rescue them either. That is the most practical cost of local-first:

Moving devices is manual: export a ZIP backup from Settings and import it on the new device. Pro can protect the backup file with an AES-256 password.
Clearing browser data clears your trips: clearing the cache, removing site data or deleting the Home Screen app can all wipe IndexedDB. Back up before you leave and again when you get home.
No multi-device sync: the trips on your phone and your laptop are two independent copies that never merge.
Some settings belong to one device: reminders must be switched on again on a new device, and control of a share link does not travel with a backup, so you share again after restoring.

If several people need to edit the same itinerary at once, or you hop between phone and laptop all day, a cloud-account app may suit you better. Local-first fits the pattern where one person plans the trip and shares it with everyone before departure.

How to check whether an app's claims are true#

"Your data stays on your device" is easy to write and harder to deliver. Whatever travel app you use, here are three checks you can run yourself:

Read how specific the privacy policy is: a good one says which fields each feature uploads, how long they are kept and how to stop it, rather than one line about valuing your privacy. The TripBoard privacy policy lists its push reminder fields this way.
Watch the network requests: open your desktop browser's developer tools, go to the Network tab, then add a trip or an expense and see whether any request carries that content. A local-first app should stay quiet at that moment.
See whether it needs an account: a service you must sign in to almost certainly stores your data on its servers, because the whole point of the account is to get that data back on another device.

FAQ#

What does local-first mean?

The master copy of your data lives on your device and the app works without a server day to day. Only when you use a feature that needs one, such as sharing or push notifications, does it upload the minimum that feature requires. Unlike a cloud-account app, the server never holds a full copy of your trips.

Does TripBoard upload my trips to the cloud?

Not in normal use. Trips, expenses, companions and photos stay in your browser's IndexedDB. When you choose to share, a copy without photos or expenses is uploaded and expires 24 hours after the last update (7 days on Pro). When you switch on trip reminders, only scheduling fields such as the trip name and send dates are uploaded. The full list is in the privacy policy.

Will I lose my trips when I change phones?

They do not move on their own. Export a ZIP backup from Settings on the old device and import it on the new one. Trip reminders need to be switched on again on the new device, and share links need to be shared again.

Does clearing my browser cache delete my trips?

It can. Trips are stored as site data in your browser, so clearing site data or removing the Home Screen app may delete them. Export a backup before you leave and again when you get home.

No account. Your trips stay on your device.

Open it and start planning, no sign-up needed. Create a trip to try it, or read the full privacy policy first.

Start planning your trip