Privacy and Cookies Statement
Effective 4 October 2026. This statement describes the current TripCritics service. For privacy questions, access, corrections, withdrawal of consent or deletion requests, email support@tripcritics.com. We verify your identity before releasing or changing account data.
What we collect and why
We store account names, usernames, email addresses, password hashes, roles and account status to provide sign-in and support. We store profiles, posts, reviews, ratings, travel context, uploaded media, reports, follows, account-linked saved places, contributor XP and moderation decisions to operate the community. Booking evidence is used to evaluate review authenticity, not for public display. Customer-care requests, replies, invitations and security audit records support account management and abuse investigations. Security controls use request network information for rate limits; the application stores hashed rate-limit keys. Hosting providers may also process operational logs.
What is public
Your display name, public profile, approved posts and photos, review context, scores and contributor activity can be visible to visitors. Password hashes, email sign-in records, private evidence, support tickets and administrative audit records are not part of public profiles. Authorised staff receive access according to their assigned role.
Social identity and permission
If enabled and chosen, Google or Facebook sign-in requests basic identity information and email. We store the provider’s account identifier and display name to recognise that identity on TripCritics. Sign-in access tokens are used to verify identity during that flow and are not retained for posting. We do not automatically merge existing accounts solely because their emails match. Your separately saved social preferences do not activate sharing or importing. Future connectors will explain their data, permissions and account eligibility before you authorise them.
Service providers and travel partners
The site uses hosting, database and media storage services to deliver the platform; processing may occur outside your country. The site currently requests fonts from Google, which receives the network request. Clicking a travel link or social sign-in takes you to a separate service governed by its own privacy practices. Private review evidence is not sent to booking partners through an affiliate link. Google Analytics 4 is used on public pages only after you grant analytics consent. It measures visits, page views, engagement, successful email registrations, review starts and submissions, and affiliate-link activations; Google receives technical device and network information for this measurement. We do not send account identifiers, form contents, private evidence or URL query parameters as analytics fields. Advertising features and Google signals are disabled. Analytics can be rejected without preventing use of the site.
Cookies and local storage
Necessary secure cookies maintain sign-in and bind a provider authorisation request to your browser. Customer sessions expire after seven days and admin sessions after eight hours. The temporary provider sign-in cookie expires after ten minutes. Your saved places are stored privately with your account. Browser storage remembers local preview preferences and cookie choices on this device. Password reset links expire after thirty minutes and staff invitations after forty-eight hours.
Optional analytics and marketing choices start off. You can accept, reject or revisit them using Cookie consent. Google Analytics is not loaded before you grant analytics consent. You can withdraw permission through Cookie choices; this stops further measurement and removes this site’s analytics cookies. Marketing scripts are not enabled. These choices are specific to this browser. Necessary sign-in and security storage remains available.
Retention, security and your choices
We keep account and community records as needed to operate your account, investigate reports and handle legitimate support or business obligations. We do not yet provide automatic account export or deletion. Request these through customer care; we will explain any lawful retention or practical restrictions. Removing a public post cannot recall copies already made by others. Passwords are hashed, sessions and reset tokens are stored as hashes, and private evidence access is restricted. No online system can guarantee complete security.
Children and updates
Registration is restricted to adults aged 18 or older. Tell us if a child has submitted personal data. We date policy changes and explain material new data uses before seeking any required consent.