TripSplit

No more "I'll pay you later." An AI trip treasurer that plans group trips, collects everyone's share through PayPal before booking, and only marks people paid when PayPal confirms it.

Comment

What's next for TripSplit## For judges: try it in 2 minutes

Live demo: https://tripsplit-cwoa.onrender.com (free hosting: the first load can take up to a minute) Code: https://github.com/chayochica22/tripsplit

  1. Sign in with organizer PIN: 2468
  2. Optional: describe a trip and click Plan with AI. Paste a flight or hotel with its price and AI uses your exact price.
  3. Under Invite links, open a friend's link and tap I'm in on a few items.
  4. Click PayPal and log in with this sandbox buyer account (fake money):
  5. Repeat for each friend (the same login works for all), then click Collect everyone & book.
  6. Click Cancel trip to see refunds, then check the Money trail.

Inspiration

Every group trip has one person who books the Airbnb, pays for the tours, and then chases friends for weeks: "I'll pay you later." "I already sent it." A single TikTok about friends not paying their share of a trip drew 6,000+ likes and hundreds of comments from people with the same story. PayPal's own group collection feature, Money Pools, shut down in 2021. I wanted to bring group payments back, smarter, with AI doing the planning and the chasing.

What it does

TripSplit protects the organizer from friends who don't pay, and friends from an organizer who doesn't book.

  • AI trip planner: describe the trip and Claude suggests shared costs, flights, places to eat, and activities with a price per person. Prices you found are kept exactly and tagged "Your price"; AI guesses are tagged "AI estimate."
  • No surprises: friends tap I'm in or Skip, and only pay for what they join. If a price changes, they must re-approve it.
  • Refund policies: every item is labeled refundable or non-refundable. Friends confirm before joining anything non-refundable, and tick a box before paying.
  • PayPal holds the money: paying places a hold, not a charge. The organizer collects everyone at once only when the pot is full.
  • Proof, not promises: a friend counts as paid only when PayPal confirms it, with the PayPal ID shown. Every dollar in and out is in the money trail.
  • Protection both ways: cancel before booking and holds are released; cancel after and everyone is refunded through PayPal, minus only the non-refundable part they agreed to.
  • Deadlines and AI reminders: late friends are flagged, and Claude writes a friendly reminder for each friend who hasn't paid.

Each friend's share:

$$s_i = \frac{C}{n} + \sum_{a \in A_i} p_a$$

where $C$ is the shared costs, $n$ the number of friends, $A_i$ the items friend $i$ joined, and $p_a$ the price per person of item $a$.

How I built it

  • PayPal (sandbox): Orders API v2 with AUTHORIZE to place holds; Payments API to capture, void, and refund (full or partial); PayPal JavaScript SDK for checkout buttons; OAuth 2.0 on the server.
  • AI: Claude (Anthropic Messages API) for trip planning, refund-policy labels, and payment reminders.
  • App: Node.js and Express, with a plain HTML, CSS, and JavaScript front end.
  • Hosting: Render (sponsor tool) for the live demo.

Security

I'm a cybersecurity student, so I reviewed TripSplit like an attacker:

  • Amounts are set on the server, never trusted from the browser.
  • I found that a fake $1 order could be used to mark a friend paid, and fixed it: holds are checked against the exact amount, friend, and currency, and each order can be used once.
  • Private invite links per friend; organizer PIN checked in constant time, with a lockout after 10 wrong tries.
  • Text from people and AI is escaped (prevents XSS); links must be https.
  • AI output is treated as untrusted and never moves money; AI requests are capped per hour.
  • Secrets stay in environment variables; an exposed sandbox key was rotated during development.
  • npm audit found a high-severity denial-of-service issue in a library, which I patched before launch.

Challenges

  • Getting the PayPal hold, capture, void, and refund flow right, including partial refunds for non-refundable items.
  • Keeping AI estimates honest: labeling guesses, and never letting AI decide money.
  • Learning Git, GitHub, and deployment for the first time, while working full-time as a nurse and studying cybersecurity.

What I learned

How payment flows really work (authorize, capture, void, refund), why payment logic belongs on the server, how to use AI as a helper inside an app rather than a chatbot, and how to threat-model my own code.

What's next

  • Receipt scanning and PayPal Payouts to pay back whoever fronted a cost during the trip
  • A database, real logins, and a marketplace payment setup for a real launch
  • Trips are just the start: the same engine works for rent, family bills, events, and group gifts

Built With

Share this project:

Updates

Submission history