Privacy Policy

Last updated October 23, 2026 · Test version 26

Who we are

Nellie is a travel advisor operated by Oakwood Standard, LLC, a Delaware limited liability company (“we”, “us”). This policy covers Nellie on the web and in the mobile app, including the conversation, trip pages, group trips, shared trip links and the emails Nellie sends.

What we collect

What you tell Nellie

Your messages and the answers you pick, and the trip Nellie builds from them: destinations, dates, how many people are travelling, interests, pace, budget, the itinerary and the hotels you look at, watch or choose.

When you swipe through other options for a part of your plan, such as an activity, a meal or a hotel, we keep the options you liked in the order you put them, and any reason you tap when you pass on one (for example “Too pricey”). The one you rank first is used in your plan. These are kept with that trip, used to plan it, and deleted when the trip is deleted.

Your Nellie chat and Saved list

When you’re signed in, Nellie, at the top of your Chats, is a conversation with Nellie that isn’t part of any trip. We keep its messages and Nellie’s answers. When you share a link or mention something you’d like to do, see or eat somewhere, Nellie may add it to your Saved list: what it is, where it is, your note about it, where it came from (for example the link you shared and the site it’s from) and when. Nellie says so under its reply, with Undo, and you can see, mark as a must and remove what you saved on Home at any time. What you save is yours: on a group trip, Nellie may suggest it to the group without saying who saved it.

When you paste a link in your Nellie chat, the Nellie app on your phone reads that page’s preview, the way a messaging app does: its title, description and picture and, for some videos, the words spoken in them. The app sends this with your message so Nellie can tell what the link is. We keep the site, title, description and picture link with your message; the spoken words are used only to answer that message and aren’t kept. Your phone loads the picture from that site, which receives the usual request information, such as your IP address. Nellie may also look a link up with its read-only web search, which sends the link and a short search query, not your account details or chat history. If Nellie starts a trip from the chat, that trip receives your message and, to plan with, the earlier messages of yours in the chat that matter for it and what you saved for that place, which then shows in the trip.

Messages with people you travel with

You can send messages to anyone who has been on a trip with you, and they can message you. A conversation isn’t part of a trip and stays after the trip ends. We keep each message, who sent it and when, so both of you can see the conversation. Nellie isn’t in these conversations: we don’t give them to the AI model providers, and Nellie doesn’t read them or use them to plan. If you have the app’s notifications on, the other person’s phone gets a notification with your first name and “Sent you a message”, never the words.

Photos and files you send to people. You can send a photo or PDF in a message to someone you travel with, or in a trip’s group chat. Unlike a file you add for Nellie, we keep these, with their name, type, size, who sent them and when, so the others in that conversation can open them: in a message, the two of you; in a group chat, the people on the trip now (someone who leaves the trip can no longer open them). In a group chat, a photo is first sent to an AI model provider to check whether it’s a receipt; a receipt becomes a cost card as described under Group costs and receipts. Any other photo or PDF is shared as it is, and Nellie sees only its name, not what’s in it. Files in messages between two people are never given to AI model providers. Phones that open a file keep a copy in the app’s cache. You can send up to 30 files a day.

Mute, report and block. Muting a conversation stops its notifications and unread count; only you know. Blocking someone stops them messaging you and hides your conversation with them; they aren’t told, and you can unblock them. If you report someone, we keep the reason you chose, any note you add, and up to their last 20 messages to you (a file is listed by its name, not copied), so our team can review it; the person you report isn’t told who reported them.

What you’ve read. For each of your conversations (with Nellie, a trip’s chats, and with people) we keep when you last opened it and whether you muted it, to show what’s new. Nobody else sees this.

What Nellie remembers about you

To make your next trip start closer to right, Nellie keeps a short profile: things like the airport you fly from, who you travel with, food or accessibility needs, and the kind of hotels you tend to pick. Nellie saves these from what you say and choose, without asking first, so if you mention a food or accessibility need it may be saved. When it saves something, it says so under its reply, and “Don’t remember” there removes it straight away. Each item records where it came from, and a few earlier values of an item may be kept until you remove it. You can see this profile in “What Nellie remembers”, opened from the trip brief or account menu, and correct or remove any item, or all of them, at any time. When you forget one item from that page, it is removed from the saved profile immediately. Undo is available for up to eight seconds. To offer it, a copy of the removed item is temporarily held in server process memory, without being written to another table or log. Expired copies are removed on access or by background cleanup, which can be delayed while the server is busy. This is an Undo availability limit, not a guarantee of physical memory erasure at an exact time. A newer change, forgetting everything, account deletion or a server restart makes Undo unavailable.

Languages. Each of Nellie’s replies records the language it is written in, so a chat stays in one language. From the replies in your own chats with Nellie (your Nellie chat and your private trip chats, not group chats), Nellie works out the languages you usually use, most recent first. It uses them to choose the language of a new chat, of a private chat it starts with you on a group trip, and of the few fixed notifications it sends you; on a group trip, the AI model sees them alongside your name. Nothing is asked or set for this: it goes away with the chats it comes from when you delete them, a trip or your account.

What removing does: the item is deleted from your profile, so Nellie won’t bring it into new trips or into group trips. On its own, it doesn’t change the trip where you said it: there, Nellie still reads the recent conversation, so it may still use the item. When you remove an item, you can also choose “Also in this trip”: Nellie is then told not to use or mention it in that trip’s conversation, and it isn’t saved again from that conversation unless you say it again. Either way, earlier messages still show what you wrote, and our records of Nellie’s answers (see below) keep what was said at the time. To remove those too, delete the trip (see “Deleting your data”).

Files you add

If you add a file such as a flight itinerary or a screenshot, Nellie sends it to an AI model provider to read it. We don’t store the file itself, and our servers don’t log its contents; the provider may keep it for a limited time under its terms. We keep the file’s name, type and size, and the details read from it (for example flight numbers, times and airports) as part of your trip. In the Nellie tab, you can add a picture or a PDF to a message: it is read the same way and not stored; we keep its name, type and size with your message, and what Nellie saves from it. Booking references are kept only in masked form (for example •••• K7Q).

Voice input

When you use voice input while signed in, we send your recording to OpenAI to turn it into text in its original language. For a trip, we may include only its destination and place names to help recognise spellings. Nellie processes audio in memory and discards it after the request; we do not save it to disk, a database, logs or analytics. The transcript returns to your device and is not saved as a message or remembered until you send it. OpenAI processes recordings under its own data policies. We keep account-linked duration counters, attempt times and your time zone to enforce the same 30-minute daily limit across devices, with a reset at local midnight. Time-zone changes take effect when the current daily window ends. Failed transcription attempts and silent clips count toward the limit once their duration has been verified. These usage counters are removed when your account is deleted.

Your account

You can use Nellie without an account. Signing in (with Google or an email code) is needed to save trips across devices, to get email alerts, to join a group trip and to book. We receive your email address and an account identifier from the sign-in service. Our sign-in provider keeps records of sign-ins, such as the time, IP address and browser. Nellie has its own accounts; they are not shared with any other product.

Price watching and alerts

If you watch a hotel or book a refundable room, we keep what is being watched, the prices Nellie finds and when, and what changed. Email alerts need you to be signed in: when you watch a hotel, “Email me too” is on unless you untick it, and a refundable room you book while signed in is watched with email alerts on. We keep your email address with the watch while it runs and remove it when the watch ends. Every alert email has a link to stop it.

Hotel prices

We keep the hotel prices Nellie sees when it searches for you or checks a watched hotel, with the time we saw them and the trip they were found for. We also record whether each price and watch baseline came from the test or live service. We compare prices within the same environment; after an environment change, the next available price becomes a new baseline without a price-change alert. We use these records to show how prices change and to decide when a change is worth telling you about.

Booking details

For a booking we collect the guest’s first name, last name and email address, pass them to our hotel supplier, and keep them with the booking record. In test mode, bookings go only to our supplier’s test service; no hotel receives them. Nellie does not take real payments in test mode. Where the test payment feature is enabled, its processing is described below.

Your trip’s bookings list

For a trip you plan alone, the app lists what on your plan can be booked. We keep, with that trip, who is booking each item (Nellie, or you yourself), its status and a short history of it (for example requested, confirmed, or why it couldn’t be booked), and any confirmation number you type for something you booked yourself. Before you book something yourself, the app opens that place’s or a search website in your browser; we don’t see what you do there. In test mode, reservation requests are simulated: nothing is charged and no business is contacted. Separately, when the team-request preview is enabled for your account, a research, availability, booking-help or team-check request asks the Nellie team to research the items and conditions you submit; it does not authorize a reservation, purchase, payment or cancellation. These records are kept with the trip and deleted with it.

Research requests and team checks

When you submit a research, availability, booking-help or team-check request, we keep the goal you reviewed, the selected plan items and their conditions, the review and submission record, questions and your answers, and the results and sources returned. Authorized Nellie team members may see the information needed to carry out that request, including its submitted conditions, checkpoint and answers. They do not receive your unrelated conversations or full remembered profile. Team members may use software tools to carry out a request, including AI agents that run on our team’s own computers under a team member’s supervision; those tools receive the same request information, and the AI model provider that powers them (OpenAI or Anthropic) processes it to do the work. We keep a record of which team member or tool handled each step. Booking help prepares options and terms for your later review; it does not authorize a reservation, purchase, payment or cancellation. Team checks run subject to team availability and can be stopped from the trip. This preview returns updates in the app; it does not add email or remote push alerts.

Test payment methods, bookings and Watch permissions

When you set up a test payment method, Stripe, our payment processor, receives the details directly through its hosted fields or native PaymentSheet (including Apple Pay). Use test payment details only. Nellie does not receive or store a full card number or CVC through this flow. We keep Stripe customer, setup and payment-method references linked to your signed-in account, setup status, and display details such as card brand, last four digits, expiry, and whether you used Apple Pay or a card. Booking requests and hotel booking records retain the reference of the payment method selected for that request; changing your saved method does not change previous requests. Saving a method does not charge it. These details are private to your account; they are not shown to other trip members or on shared links and are not sent to AI models.

A saved method is separate from permission to book. For a Watch you authorise, we record the confirmed hotel, dates, guests, room and cancellation requirements, financial limits including known mandatory hotel charges, chosen method reference, end date, consent version and confirmation time. We keep supplier and retail prices, transaction references, attempt times and results so we can perform the authorised test action, prevent duplicate submissions, resolve uncertain outcomes and help you. An uncertain result does not authorise another attempt.

You can stop a Watch without removing its saved method. Stopping, editing or expiring the Watch ends its old booking authority; a retained method does not restore it. Removing a saved method from Nellie revokes its local use and affected Watch permissions. This does not cancel an order already submitted or delete Stripe’s own records. We retain records needed to reconcile an attempted action until it can be resolved; account deletion removes Nellie’s local test-payment references and records as described below.

Technical information

Your browser stores a random visitor identifier so Nellie can keep your trips and memory together before you sign in, and your sign-in session if you sign in; a short-lived value is kept during sign-in. Our hosting and network providers process standard request information such as your IP address and browser type, and may keep it in their own logs. To diagnose failed operations, Nellie also writes limited technical warnings to our hosting provider’s logs: fixed error categories, request methods and route patterns, HTTP status codes, recognised validation field names, and the first eight characters of a message event identifier when a chat-started trip is refused. These warnings do not include what you wrote, shared links or files, account or trip identifiers, sign-in tokens, or supplier response bodies. Access and retention follow our hosting provider’s logging controls. Nellie doesn’t use advertising or analytics trackers.

Operational usage accounting

For signed-in travellers, we keep an internal account of AI model calls and token counts when supplied, supplier and signal requests and Watch checks when operational usage accounting is active. It records the account and relevant trip, time, provider or model, units and outcome; unknown usage or monetary costs remain unknown rather than being treated as zero. We use these records only to understand Nellie’s operating costs. This beta accounting does not record delivered savings or determine memberships or service tiers. This ledger does not contain message or file contents, guest details, supplier booking references, payment details or IP addresses, and is not shown to other travellers or on shared links.

Daily limits. Each account has a daily limit on how much it can use Nellie’s AI, and accounts used from the same network or the same device count together, so the limit stays fair. For this, when you’re signed in we note each day that your account was used from a given IP address and device, but only as a one-way code made with a random value that changes every day; the address and the device identifier themselves aren’t kept. These notes are deleted after two days, after which the codes can’t be connected to anything. We use them only to apply these limits and to alert our team to unusual use.

Records of Nellie’s answers

For each answer we keep a record of what was sent to the AI model and what it returned, how long it took and how many tokens it used. A record can include your messages, your trip, what Nellie remembers about you and, on a group trip, the context Nellie had for that answer, which can include what other people on the trip told Nellie privately (see “Shared links and group trips”). We use these records to fix problems and improve the quality of Nellie’s advice. They are not shown on trip pages, to other people on a trip, or on shared links, and they are kept with the trip they belong to.

What Nellie keeps to coordinate a trip

To plan and coordinate a trip over days or weeks, Nellie keeps, with that trip:

• Notes about each person: facts (such as a food allergy or a mobility need), limits (such as a budget) and dated taste from the trip, each with where it was said: in the group chat, or in a named person’s private chat with Nellie. When Nellie saves a note from something you said, it tells you, with Undo. A note can also be about someone else on the trip (for example, “Sam doesn’t eat meat”). If a note is about you, Nellie shows it to you with Undo, without saying who mentioned it.
• Summaries of older messages: one for the group chat and one for each person’s private chat, kept separate so a private chat is never summarised into the group’s.
• Follow-ups Nellie schedules for itself (for example “check the weather the night before”), and messages it wrote during someone’s night that wait for the morning. Nellie reviews a waiting message again before it is sent and may change or drop it.
• What happened on the trip, so Nellie can act at the right moment: new messages, reactions, card taps, people joining or leaving, price or availability changes on what you watch, and deadlines. These records hold identifiers, kinds and times, not message text.
• Polls, proposals and changes: polls Nellie opens and each person’s vote, money or booking actions put in front of one person to confirm (a booking, a cost, a watch, settling up) and whether they confirmed, and “What changed” on the plan with what it was before, so a change can be undone.
• Delivery records: for each message Nellie sends, who it reached, whether they had asked for it, and whether it went in the app, by push or by email. We use these to keep to the limits below.

How we use it

• To plan your trip: understand what you want, suggest ideas, write the itinerary, find and rank hotels, and keep your trip brief up to date.
• To remember your preferences for future trips, as described above.
• To make bookings you confirm or test bookings within a Watch permission you explicitly give, and to look after them and the hotels you watch (for example, telling you when a price drops).
• To run group trips: invitations, the group chat, and who books what.
• To send emails you asked for or that relate to your trip or account: sign-in codes, alerts and invitations.
• To keep Nellie working and secure, fix problems and improve the service.
• To meet legal obligations.

We don’t sell your personal information, share it for cross-context behavioural advertising, or use it to build advertising profiles.

Who we share it with

These providers process information on our behalf or to provide their part of the service, under their own terms. AI model providers receive your information through their business APIs; under their current API terms they don’t use it to train their models by default, and they may keep it for a limited time, for example to monitor abuse. We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganisation of our business.

Shared links and group trips

Private group check-in. A short optional check-in saves your trip interests and pace as past taste labelled with the destination and date, separate from facts such as food or accessibility needs. Past taste is a changing reference for your own future conversations. You can correct or remove it in What Nellie remembers. The check-in recap offers one-tap removal. Your answers, recap and taste are visible only to you; the organizer sees who has finished and the target plan time, never your answers. Nellie uses your answers, including any limit, to plan for everyone, as described below, without saying in the group that they came from you. An unanswered check-in can show one reminder when you open it near the target time; no check-in email or background notification is sent.

Trip addresses. A trip’s own address opens only for the people on it, or, for a trip planned without an account, in the browser it was planned in. Anyone else who opens it is told the trip is private.

Planning progress. Nellie computes how settled each planning decision is and the trip’s phase from the saved brief, selected ideas, itinerary, dates and confirmed hotel records. Trip members can receive this progress with the trip. For a trip planned alone, flight confirmations you upload in your own chat can also inform your progress; they are traveller-supplied information, not independent airline verification. Private flight uploads are not used for a group’s shared progress. Share links do not include this progress.

Shared links. Someone who can change a trip’s plan can create a separate share link for it. Anyone with that link can see the plan: the brief, the itinerary, the hotels and whether a stay is booked. A share link never shows any chat, booking references, who booked, or what Nellie remembers about anyone, and it can’t be used to change the trip. Making a new link stops the old one working, and turning sharing off stops the link working for everyone; neither affects the people on the trip. Anyone who already opened the link may have kept a copy of what they saw.

Group plan reactions. Shared together-parts show who has joined and aggregate Love it, Fine with me and Not for me counts. Love it or Fine with me adds you to that part; Can't make it removes you without an objection. We store your reaction and when you made it. A Not for me reason is requested and stored in your own private chat, never shown to other travellers. Selected places from your private check-in can identify who a part is for; free-text answers and private limits are not quoted on the card. Parts planned around private limits show “For everyone”. Love and Fine are remembered separately as dated past taste from that trip, with an Undo and controls in your memory page; they are hints, not permanent facts about you. We may send one private reminder if you have not reacted. Leaving removes your reactions from the group’s counts; account deletion removes reaction records and private answers.

Group trips and personal plans. We store a single record for each plan item, its owner, who has joined, its sharing choice, and invitations and responses. An item you add starts private with only you participating. Sharing its basics with the trip does not add anyone to it. Inviting a person lets them see that item and choose whether to join; a private invitation does not expose your other items. Only people who join count as going. A person who declines is shown to the inviter as “Can't join this time”. Your price and refund terms, confirmation information and notes stay yours unless you explicitly share the price for that item; confirmation and other private details never become shared. The group may see only that you have a place to stay when its details are private. Others see you by the first name taken from your account. Everyone on the trip sees its shared plan basics, participating people, group chat and changes. Your own chat with Nellie stays private: other people on the trip can’t open it. Your plan items stay private until you share them.

How Nellie coordinates a group. Like a good human coordinator, Nellie uses everything people on the trip tell it to suggest plans that work for everyone: what each person says in their own chat with Nellie, in their check-in, in the group chat and through their reactions, and what it remembers about them, including budgets, health and accessibility needs. It does this for every trip member; there is no setting to keep something you told Nellie out of its planning for the group, so if you don’t want Nellie to use something, don’t tell it, or remove it from what Nellie remembers. In the group chat, and in private replies to other people, Nellie:

• never repeats what you told it privately;
• never says, or hints in a way that singles you out, that a budget, health need, dislike or objection is yours (in a trip of two, “one of us” would single you out, so Nellie avoids it);
• never presses a named person in the group to react, vote or decide;
• never says everyone agreed when someone hasn’t.

Before a message goes to the group, our code and a separate AI check review it against these rules, using the private notes and who they came from; the same check reviews Nellie’s private replies on trips with more than one person. If a group message fails after one rewrite, it is not posted, and the person who asked gets a private answer instead. If the check is unavailable, nothing is posted to the group. These checks reduce mistakes but can’t guarantee that nobody will ever guess something from the plan itself: for example, a plan changed to a shorter walk is visible to everyone. Your reactions (going, Love it, Fine with me, Not for me, Can’t make it) are visible to the group, as they are today; the reason you give Nellie for one is not.

Changes to the shared plan, whether you make them or Nellie makes them after talking with someone, are visible to everyone on the trip in “What changed”. When you make a change yourself, it shows your name.

Polls. On larger trips Nellie may open a poll. While it is open, everyone sees only how many people have voted; Nellie also knows who hasn’t voted, so it can remind them once, privately. When it closes, everyone sees the result and the counts. Nobody, including Nellie, sees who voted for what. You can change your vote until it closes.

Messages Nellie starts. When nobody asked, Nellie sends each person at most one message a day, across trips, and holds messages during your night (10 pm to 8 am where you are) until the morning, when it checks them again. Two exceptions: something going wrong that you need to act on before morning (for example a failed booking), and a sold-out room or table you watch becoming available, which goes only to you and only if you haven’t turned night alerts off for that watch. Replies to your own messages are never held. To know when your night is, we store the time zone your browser or app reports when you use Nellie.

Group costs and receipts. We store a cost’s title, original amount and currency, date, payer, participating people, split, collection timing and confirmation state. If converted, we keep the reference rate, its date and source, and rounded amounts. Only its payer sees a draft; only people included in a confirmed cost can see its card and amounts. People outside that cost receive no cost card, balance or cost-change notification. A private preview shows the information that will be shared before the payer confirms. Your private chat words and receipt photo are never copied into that cost card. A receipt uploaded to the group chat is an original group message and visible to that group; a private upload stays in your own chat. Our existing AI provider reads the receipt image to extract merchant, total including tip, printed currency, date and time. We do not request card details, addresses, transaction identifiers or receipt line items, and do not store the model’s raw extraction response. Images remain with their original conversation until erased.

Settling costs. Nellie computes the balances involving you and suggests transfers; it never sends, holds or verifies money. A reported payment stays pending until its recipient confirms after checking their app or bank. We keep the reporting person, amount, currency, pending/confirmed/undone state and confirmation time. Deleting or editing a cost recalculates balances while retaining confirmed payment records. Optional Venmo, PayPal and Zelle handles are saved to your account and shown as copyable text only to people settling a balance with you; they are never given to the AI or shown on share links. You can edit or clear them. The trip organizer can change its currency; unsupported conversion leaves the original amounts unchanged and asks you to resolve it. We request only currency pairs and a date from the public Frankfurter service using ECB reference rates, without sending account, trip, receipt or payment information. Reference rates are estimates and may differ from a payment provider’s rate. Private balance reminders are limited to one per unchanged balance and count toward the daily limit on messages Nellie starts (see above). Cost-change notices stay in your own costs history. The trip lifecycle check saves one private costs summary for participating people after trip end; it appears in your own Costs view. Leaving a trip keeps your own existing balances accessible so you can settle them, without exposing unrelated later members or costs.

Invitations. Anyone who opens an invitation link sees the trip’s name, dates, cities and the first names of the people on it. If you invite someone by email, we keep their email address with the invitation and send them one invitation email in your name.

Deleting your data

You can delete a trip or your account yourself in Nellie: “Delete this trip” is at the bottom of the trip’s Brief, and “Delete account” is in your account menu. You can also email support@tripwithnellie.com and we’ll do it for you.

• Deleting a trip removes the trip, its conversations, its records of Nellie’s answers, everything Nellie keeps to coordinate it (notes, summaries, follow-ups, waiting messages, polls and votes, proposals, What changed and delivery records), its watches and their email addresses, its invitations and its test bookings. Hotel prices found for it stay as price history without the link to the trip. What you saved stays in your Saved list, without the link to the trip. On a trip shared with others, the button is “Leave and delete my part”: it removes your part of the trip as described for deleting your account below, and the trip stays with the others.
• Deleting your account deactivates access to Nellie immediately and stops your automatic Watches. Your account data remains stored during a 30-day waiting period. At the first scheduled cleanup after that period, we remove your profile, your Nellie chat and Saved list, your conversations with people you travel with (they go for the other person too), every photo and file you sent to people, including in group chats, what you’ve read, your blocks, reports you made and reports about you, every trip only you are on (as above), and your sign-in account with our sign-in provider. Failed cleanup is retried automatically and followed up by our team. Signing in again does not cancel a deletion request; contact support@tripwithnellie.com for help. On trips shared with others, it removes your private chat and its summary, the records of Nellie’s group chat answers, your invitations, limits you told Nellie, the notes Nellie kept about you or from your private chat, your votes, proposals and delivery records, messages waiting for you, and your place on the trip. Your messages in the group chat stay, with your name and a default picture, so the conversation still makes sense for the others, and the change log keeps your name for changes you made. The trip stays with the others, and if you started it, another person on it becomes its organizer. Test bookings you made are kept without your guest details or a link to you.
• Group costs data. Deleting a whole trip removes its costs, split shares, payment records, reminders and receipt images. “Leave and delete my part” removes your costs and shares, payment records involving you, private cost notices and receipt images from that trip, and the photos and files you shared in its group chat (your messages there stay, without the file); costs confirmed by another payer remain with your creator attribution removed. Account cleanup also erases your optional payment handles and applies this removal to shared trips even when your first name remains as a closed-account marker. Removing these local bookkeeping records may change other participants’ outstanding balances, which they see privately. It does not undo a real transfer made outside Nellie. Ordinary leaving keeps your costs accessible until you erase them.
• Test payment records. Account deletion removes Nellie’s local saved-method references, test-payment records and Watch permissions after any unresolved payment or booking attempt has been checked. If an attempt is still unresolved, Nellie asks you to wait before completing deletion so the records needed to verify it are not lost. Removing a method alone prevents its future use in Nellie but keeps records needed to resolve previous attempts and provide support. Stripe may retain its own records under its policies.
• Deletion request records. We keep the account and sign-in identifiers, your email address, the request and due dates, and minimal cleanup status while processing deletion. Your email is removed when Nellie’s account data is erased. After cleanup succeeds, only the identifiers and request/status metadata remain for seven days to prevent an old login token from recreating the account, then are removed.
• Exceptions. Real bookings, when they exist, are kept as long as the booking and our legal obligations require, and used only for those purposes. Copies in our providers’ backups and logs are removed on their own schedules.

How long we keep it

• Trips, their conversations and records of Nellie’s answers: until you delete the trip or your account, or ask us to.
• An invited person’s email address: until the invitation is accepted, revoked or expires (after 30 days).
• Email addresses for alerts: until the watch ends.
• If you leave a group trip, you keep your bookings and can no longer open the trip; your private chat stays private and is kept until you delete your account or ask us to delete it, and limits you told Nellie for that trip are removed; the others keep the shared plan and the group chat, including your messages there. You stop participating in items when you leave. People remaining keep shared item basics that still concern them, without your private booking details, and can take responsibility for them. Your original booking remains yours. Stopping sharing removes the item from other people’s plans and revokes invitations and item access; a single notice appears in the group chat, without private details. Existing copies or previous chat text cannot be recalled. Leaving is not deleting: to remove your part of the trip, use “Leave and delete my part” instead (see “Deleting your data”).
• Research and team-check drafts, submitted instructions, submission identifiers, task questions and answers, check observations, source references and status history: kept with the trip until the trip or your part of it is deleted, or your account deletion completes under the process above. Stopping a request ends future work but keeps its history visible; it does not cancel an external reservation. Trip and account deletion also remove the associated request and worker records. Search source leads and reversible plan-change history are bounded within the trip.
• What Nellie remembers about you: until you remove it, which you can do at any time on a trip page.
• Messages with people you travel with: until either of you deletes their account, or asks us to delete them. Photos and files you send to people: with their conversation or trip, until you delete your account, leave and delete your part of the trip, the trip is deleted, or you ask us to delete them. Reports: until either account is deleted. What you’ve read and muted: until you delete your account.
• Your Nellie chat: until you delete your account, or ask us to delete it. Your Saved list: until you remove items on Home or delete your account.
• What Nellie keeps to coordinate a trip (notes, summaries, follow-ups, polls and votes, proposals, What changed and delivery records): with the trip, until it or your part of it is deleted, or your account is deleted.
• Files you add for Nellie: not stored; their name and the details read from them stay with the trip.
• Saved test payment-method references: until removed from Nellie or you delete your account. Watch consent and test-payment attempt records: while needed to run or reconcile the authorised action and provide support; removed from Nellie when account deletion completes after unresolved attempts have been checked.
• Operational usage accounting: while you keep your account and relevant trip. Deleting a trip removes its linked entries; “Leave and delete my part” removes your linked entries on a shared trip. Account deletion removes your accounting records at the scheduled cleanup after the 30-day waiting period, including entries on shared trips that remain.
• Booking records: as long as needed for the booking, customer service, accounting and legal obligations.
• Hotel prices Nellie has seen: kept as price history; when a trip is deleted, its link to the prices is removed.

Your choices and rights

You can remove anything Nellie remembers about you at any time, stop any price alert from your trip or from the link in the email, turn a trip’s share link off, leave a group trip, delete a trip or your account, use Nellie without an account, and sign out at any time. You can also ask us to access, correct or delete your personal information, or to delete your trips and account, by emailing support@tripwithnellie.com. Depending on where you live (for example California), you may have further rights under local law; we won’t treat you differently for using them.

Do Not Track and Global Privacy Control

Nellie doesn’t use advertising or analytics trackers, and we don’t sell or share personal information for cross-context behavioural advertising. Our pages don’t change what they do when a browser sends a Do Not Track signal. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information, which we don’t do in any case.

Mobile app location, reminders and offline access

The Nellie mobile app can use your location on this phone to show distances. If you separately enable arrival help, the operating system monitors areas near your booked hotel on its check-in day. Nellie does not upload your GPS coordinates or record a continuous route. Location access and notifications are optional and can be turned off in the app or system settings. Arrival events can be delayed or missed.

The app saves itinerary and booking details in device secure storage for offline use; private and group chats are not cached. Offline records expire two days after the trip ends (or after 24 hours for undated trips) and are removed when the app next reads its cache. Signing out clears this account’s cache, reminders and arrival settings on this phone.

If you enable remote trip updates, or allow the app’s notifications, we store a device push token linked to your account and the trips you select or open. We send a generic alert and the trip identifier through Expo’s push service and Apple or Google so you can open the update; these alerts do not contain chat text, hotel addresses or booking references. A message from someone you travel with sends their first name and “Sent you a message” to your registered phones the same way. If Nellie finishes a reply after you leave the app, your registered phones get a notification titled “Nellie” with the first line of that reply (up to 140 characters), sent the same way so you can see it on your lock screen and open the chat; muting that chat stops these. Your phone’s settings control whether notification text shows on the lock screen. Signing out unregisters that phone; subscriptions are also removed on account deletion or after 90 days without registration renewal. Delivery records are retained for seven days to avoid repeated alerts. Device-local reminder settings and a short reminder history are saved on your phone and cleared on sign-out.

Security

We use encrypted connections, limit who can access personal information, and protect mobile sign-in credentials and cached booking details with device secure storage. Booking references may be displayed to authorised trip members. No service is perfectly secure; if you think your information has been put at risk, contact us.

Children

Nellie is for people aged 18 or older. We don’t knowingly collect information from anyone under 18; if you think a child has used Nellie, contact us and we’ll delete their information.

Changes

We’ll update this page when our practices change and change the date at the top. For significant changes we’ll make it clear in Nellie.

Contact

Oakwood Standard, LLC · support@tripwithnellie.com

See also the Terms of Service.