Last updated: 30 October 2026
This policy explains what personal information TripUtility ("we", "us") collects when you use triputility.com, why, who we share it with, how long we keep it, and the choices and rights you have. It applies to visitors worldwide, including the European Economic Area (EEA), the United Kingdom, Switzerland and the United States.
Summary
- You can use every tool without an account. Accounts are optional and only needed to keep dashboards across devices.
- We collect as little as we can: no location tracking, no payment details, and no sensitive data.
- We don't show ads and don't use advertising or tracking cookies.
- We don't sell your personal information.
- The site is hosted in the United States. If you visit from elsewhere, your information is protected as described in International transfers.
- You can download or delete your account data at any time from your account page.
Who is responsible
The data controller is the operator of TripUtility. For any privacy question or request, email info@triputility.com.
Information we collect
Without an account
- Stored only in your browser: your clocks, dashboards, colors, theme, temperature unit and a short-lived copy of exchange rates (local storage). We don't receive this.
- Technical data: when your browser requests a page, our hosting provider receives your IP address, browser type, the page requested and the time. This is needed to deliver and secure the site.
- Weather and data requests: to show weather, our server asks Open-Meteo for the coordinates of the cities on your dashboard. Your IP address is not passed on.
If you create an account
- your username and email address;
- your password, stored only as a one-way Argon2id hash (nobody can read it, including us);
- dashboards you choose to save to your account;
- for each signed-in device: when it signed in and was last used, its IP address and browser type;
- a security log of sign-ins, failed attempts, password changes and similar events, with IP address and browser type;
- a record of the account emails we sent and whether they arrived.
If you contact us
The contact form opens an email in your own email app. We receive only what you send, and use it to reply.
We don't use your device's location, and we don't collect payment details or special categories of data (such as health or religious beliefs).
How we use information and our legal bases
Under the GDPR and UK GDPR we must have a legal basis for each use:
- Providing the site and your account (showing tools, signing you in, saving dashboards, sending confirmation and password-reset emails): performance of our agreement with you.
- Security and abuse prevention (security log, rate limits, technical logs): our legitimate interest in keeping the service and your account safe.
- Legal obligations: when we must keep or disclose information by law.
We don't make decisions about you based solely on automated processing.
Cookies and similar technologies
We use only what the site needs to work: a sign-in cookie when you sign in, and browser storage for your settings. There are no advertising or tracking cookies. Details are in the Cookie Policy.
Advertising
We don't show ads at the moment. If we start, we will update this policy and the Cookie Policy first and, in the EEA, the UK and Switzerland, ask for your consent before any personalized ads.
Who we share information with
We don't sell personal information, and we don't share it for cross-context behavioral advertising. We share it only with service providers that process it on our behalf, under contract:
- Vercel Inc.: hosts the website and its servers (Washington, D.C., USA (us-east-1)) and keeps technical logs.
- Supabase: stores account data.
- Resend: sends account emails (confirmation, password reset, security notices).
- Cloudflare: manages our domain, forwards email sent to our addresses, and checks from outside that the site is online.
- Open-Meteo and Frankfurter (weather and exchange rates): receive only the locations or currencies requested, not your identity. If our own rate service is unavailable, your browser fetches rates from Frankfurter directly.
We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a transfer of the site to a new operator, who would be bound by this policy.
International transfers
Our servers are in the United States, so information about visitors from the EEA, the UK and Switzerland is transferred to and processed in the US, and providers may process it in other countries where they operate. We protect these transfers with the safeguards the GDPR and UK GDPR recognise: the European Commission's Standard Contractual Clauses (with the UK Addendum) in our providers' data processing terms, and, where a provider is certified, the EU–US Data Privacy Framework and its UK and Swiss extensions. You can ask us for details of these safeguards using the address above.
How long we keep information
- Browser storage: until you clear it.
- Account data and saved dashboards: until you delete your account.
- Signed-in devices: until you sign out, or 30 days after last use.
- Password-reset and confirmation links: deleted 7 days after use or expiry.
- Email delivery records and error logs: 90 days.
- Security log: 1 year.
- Database backups, if kept: deleted data disappears from them within about 35 days.
- Emails you send us: as long as needed to deal with your message.
How we protect information
All traffic is encrypted (HTTPS), including the connection to our database. Passwords are hashed with Argon2id; sign-in sessions and email links are random codes stored only as keyed hashes; links expire and work once. The website uses a database login that can't change the database structure or erase the security log. No method is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.
Your rights
Everyone
You can download your data and delete your account yourself on the account page. For anything else, email info@triputility.com. We may need to confirm it's really you, and we respond within one month (we may extend this where the law allows, and will tell you why).
EEA, UK and Switzerland
You have the right to access, correct, delete or export your information, to restrict or object to processing based on legitimate interests, and to withdraw consent at any time (without affecting earlier processing). You can also complain to your data protection authority: in the UK the Information Commissioner's Office; in the EEA, your national authority. We'd appreciate the chance to help first.
United States
Depending on your state (for example California, Colorado, Connecticut, Virginia or Texas), you may have the right to know what personal information we collect and how we use it, to access, correct and delete it, and to opt out of its sale or sharing for targeted advertising. We don't sell or share personal information in those ways, and we honor Global Privacy Control browser signals as an opt-out. We won't treat you differently for exercising your rights, and you may use an authorized agent. If we deny a request, you can appeal by replying to our answer.
Children
The site isn't directed at children. We don't knowingly collect personal information from, or create accounts for, anyone under 16. If you believe a child has given us information, contact us and we will delete it.
Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we will also tell account holders by email before it takes effect.
Contact
the operator of TripUtility. Email: info@triputility.com.