TERMS AND CONDITIONS

Last updated October 27, 2026

AGREEMENT TO OUR LEGAL TERMS

We are TripDeck ("Company," "we," "us," "our"), operating https://tripdeck.ryanmarch.me and related offerings (collectively, the "Services"). You can contact us at tripdeck@ryanmarch.me.

These Legal Terms constitute a legally binding agreement concerning your access to and use of the Services. By accessing the Services, you agree to be bound by all of these terms. IF YOU DO NOT AGREE, YOU ARE EXPRESSLY PROHIBITED FROM USING THE SERVICES AND MUST DISCONTINUE USE IMMEDIATELY.

We reserve the right to modify these terms at our sole discretion, and your continued use constitutes acceptance of any updated revisions. Finally, the Services are intended solely for users who are at least 18 years old.

TERMS AND CONDITIONS

OUR SERVICES & USER REGISTRATION
SUBSCRIPTIONS, BILLING & CANCELLATION
INTELLECTUAL PROPERTY & PROPRIETARY CODE
PROHIBITED ACTIVITIES
DATA, PRIVACY & ZERO-KNOWLEDGE ENCRYPTION
THIRD-PARTY DATA, SERVICES & ATTRIBUTIONS
DISCLAIMERS & LIMITATIONS OF LIABILITY
GENERAL LEGAL PROVISIONS
CONTACT US

1. OUR SERVICES & USER REGISTRATION

You must provide accurate information when registering for an account. TripDeck uses WebAuthn passkey authentication, and you are entirely responsible for maintaining the security of your authentication devices and account credentials. We provide free access tiers alongside paid subscription plans for personal and commercial itinerary management. The Services are not tailored to comply with industry-specific regulations such as HIPAA or GLBA.

2. SUBSCRIPTIONS, BILLING & CANCELLATION

Subscription Plans: TripDeck offers both free access tiers and paid subscription tiers ("Subscriptions") that unlock additional capabilities, expanded vault sync quotas, and specialized travel tools. Specific plan details, included features, and pricing are presented during account upgrade or checkout.

Billing and Renewals: Subscriptions are billed in advance on a recurring cycle (such as monthly or annually). By purchasing a subscription, you authorize our third-party payment processor to charge your designated payment method recurring fees at the then-current rate at the start of each billing period. Subscriptions automatically renew at the end of each billing cycle unless you cancel prior to the renewal date.

Payment Processing: Transactions are processed securely by third-party payment providers (such as Stripe). We do not store or process your complete payment card numbers or banking credentials on our servers. You agree to provide valid, up-to-date billing information and to promptly update your account if your payment details change.

Cancellation and Refunds: You may cancel your subscription at any time through your account settings or customer billing portal. Cancellation takes effect at the end of your current paid billing period, and you will retain access to paid subscription features until that period concludes. Except where required by applicable law, subscription payments are non-refundable, and we do not issue credits or prorated refunds for partial billing cycles or unused features.

Price and Feature Changes: We reserve the right to revise subscription fees or adjust features included in subscription tiers. Any price changes will be communicated in advance before taking effect on your subsequent billing renewal. Your continued use of the Services after a price change takes effect constitutes agreement to the updated amount.

3. INTELLECTUAL PROPERTY & PROPRIETARY CODE

Proprietary Software: All source code, application software, database architecture, serverless functions, visual builders, styling, algorithms, and interface designs powering TripDeck (collectively, the "Software") are proprietary and copyrighted property owned by Ryan March. All rights are reserved.

Public Showcase Repository: We may maintain a public GitHub repository (github.com/RyanMarch/tripDeck) strictly for documentation, public issue tracking, feature discussions, and project showcase overviews. The public showcase repository contains no operational application code. The underlying application repository (tripDeck-app), edge functions, deployment scripts, and private infrastructure remain strictly closed-source and confidential. Public availability of showcase documentation does not convey any license, ownership, or right to copy, inspect, fork, modify, host, distribute, or reverse-engineer any portion of the private application code or backend infrastructure.

License to Use: Subject to your compliance with these Legal Terms and your active subscription status, we grant you a limited, revocable, non-exclusive, non-transferable, non-sublicensable license to access and use the hosted Services via an authorized web browser. You may use the Services for personal itinerary planning or for internal travel planning within your organization. You may not sublicense, resell, rent, white-label, or redistribute access to the Services without our prior written consent.

Submissions & Feedback: Any ideas, suggestions, bug reports, or feature recommendations ("Submissions") that you provide through GitHub issues, email, or other channels become our property. We may use, modify, and implement Submissions without restriction or compensation to you. If you believe any material on the Services infringes upon your copyright, please notify us immediately.

4. PROHIBITED ACTIVITIES

You may not access or use the Services for any unlawful, abusive, or unauthorized purpose. Prohibited activities include, but are not limited to:

Systematic data scraping, crawling, or automated harvesting of data from the Services or third-party API proxies.
Circumventing security controls, passkey authentication, subscription feature gates, or account limits.
Attempting to access, decompile, disassemble, or reverse-engineer the private application code or backend functions.
Reselling, sublicensing, leasing, or operating a commercial service bureau using the Services without explicit written permission.
Uploading or transmitting viruses, malicious code, or excessively large payloads designed to disrupt the platform.
Harassing, threatening, or abusing other users or service maintainers.
Using the Services in violation of applicable laws, regulations, or third-party provider terms.

5. DATA, PRIVACY & ZERO-KNOWLEDGE ENCRYPTION

You retain full ownership of your itineraries, notes, and packing lists ("Itinerary Content"). By using the Services, you consent to our Privacy Policy and the processing of your data in the United States.

Zero-Knowledge Architecture: We employ client-side encryption. Your Itinerary Content is encrypted on your local device before transmission. We do not store your encryption keys or passkey recovery keys in plaintext. Consequently, if you lose your authentication credentials and recovery keys, we cannot recover or decrypt your data. You bear sole responsibility for your credentials, and data lost due to forgotten credentials cannot be restored.

Shared Links: If you use our sharing features, anyone with the link can view your itinerary. You are solely responsible for managing these links and ensuring you do not publicly share sensitive personal information.

6. THIRD-PARTY DATA, SERVICES & ATTRIBUTIONS

The Services integrate third-party APIs and open-source libraries to provide mapping, venue lookups, flight tracking, weather forecasts, and payment processing ("Third-Party Data"). This data is for planning purposes only and is not guaranteed to be accurate or real-time. Travel schedules are subject to real-world disruptions. We act as an itinerary dashboard, not a travel agency, and hold no liability for missed flights, inaccurate coordinates, or travel disruptions resulting from reliance on the Services.

We gratefully acknowledge the following third-party services, data providers, and open-source software that power TripDeck:

Mapbox: Interactive map rendering, geocoding, and map styles (Mapbox Terms of Service). Map data © OpenStreetMap contributors.
Open-Meteo: Weather forecasts and air quality data (Open-Meteo Terms, licensed under CC BY 4.0).
Google Places API: Point-of-interest search, venue autocomplete, and address details.
HERE Technologies: Venue details, including opening hours, phone number, and website.
AeroDataBox: Flight status, schedules, and airport data (AeroDataBox Terms of Use).
AirLabs: Real-time flight tracking and route status data.
Transitland: Public transit stops, train station metadata, and route geometry data (Transitland Terms, licensed under CC BY 4.0).
Frankfurter: Currency conversion rates sourced from the European Central Bank, used for the optional Budget Panel's home-currency estimates.
QR Maker: Vector QR code rendering for printed Pocket Guide itineraries.
Stripe: Secure payment processing, customer subscription billing, and tax calculation (Stripe Terms of Service).

7. DISCLAIMERS & LIMITATIONS OF LIABILITY

THE SERVICES ARE PROVIDED "AS-IS" AND "AS-AVAILABLE" WITHOUT WARRANTIES OF ANY KIND. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. IN NO EVENT WILL RYAN MARCH OR TRIPDECK BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM YOUR USE OF OR INABILITY TO USE THE SERVICES. OUR TOTAL AGGREGATE LIABILITY FOR ANY CLAIMS ARISING UNDER THESE TERMS SHALL BE LIMITED TO THE TOTAL AMOUNT PAID BY YOU FOR THE SERVICES IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR ZERO DOLLARS ($0.00 USD) IF YOU HAVE USED ONLY FREE FEATURES. You agree to defend, indemnify, and hold us harmless from any loss, damage, or claim (including attorneys' fees) made by a third party due to your use of the Services or your Itinerary Content.

8. GENERAL LEGAL PROVISIONS

Termination & Modification: We reserve the right to modify, suspend, or terminate the Services, or your access to them, at any time without notice or liability.

Governing Law & Disputes: These terms are governed by the laws of the State of Ohio. Any disputes not resolved through informal 30-day negotiations shall be prosecuted exclusively in the state and federal courts located in Franklin, Ohio. You waive the right to participate in class-action lawsuits regarding the Services.

Electronic Consent: You consent to receive electronic communications and agree that electronic agreements and signatures hold the same legal weight as physical documentation.

9. CONTACT US

For questions or to resolve complaints, please contact us at: tripdeck@ryanmarch.me.

PRIVACY POLICY

Last updated October 27, 2026

1. OVERVIEW & ZERO-KNOWLEDGE ARCHITECTURE

At TripDeck ("Company," "we," "us," "our"), we believe your travel plans and personal itineraries are your private business. We operate https://tripdeck.ryanmarch.me with a Zero-Knowledge, Local-First Architecture.

This means your itinerary data, notes, and packing lists are encrypted on your local device using industry-standard Web Cryptography (AES-GCM-256) before syncing to our servers. We do not possess your encryption keys, passwords, or recovery keys in plaintext, and we cannot read, decrypt, or access your stored travel itineraries.

2. INFORMATION WE COLLECT & HOW IT IS USED

Because TripDeck is designed around local-first privacy, we collect only the minimal data necessary to provide cloud sync, subscription management, and authentication services:

Authentication Data: When you register an account, we store public WebAuthn / Passkey credentials and cryptographic salt/verifier parameters. We do not store plaintext passwords.
Encrypted Vault Blobs: When you save or sync an itinerary to the cloud, our database stores an encrypted ciphertext blob and version metadata. The server cannot inspect the contents of these blobs.
Billing and Subscription Metadata: If you purchase a paid subscription, payment transactions are processed directly by our third-party payment processor (such as Stripe). We do not store or process your complete credit card number, security code, or banking details on our servers. Our database stores only non-sensitive subscription identifiers (such as subscription status, plan tier, and billing period dates) needed to manage your access. This payment metadata is maintained separately from your encrypted vaults and cannot decrypt or reveal your trip contents.
Local Browser Storage: Your itinerary files, active edits, and display preferences are stored directly on your device via localStorage and the browser Cache Storage API for offline functionality.
Privacy-Preserving Product Telemetry: To monitor system health, evaluate documentation coverage, and prevent third-party API quota exhaustion, we collect aggregate, non-identifying telemetry. This includes anonymous Help Center search queries and result counts, external API call response codes, and coarse activity intervals (such as aggregate daily active user counts and trip count totals). Telemetry records do not log IP addresses, are never linked to personal profiles, and never inspect, store, or decrypt vault contents.
Basic Infrastructure Logs: Our hosting provider (Cloudflare) collects standard HTTP request logs (such as IP addresses and user agents) strictly for server security, abuse prevention, and rate limiting. We do not sell, track, or profile this information.

3. THIRD-PARTY DATA PROVIDERS & PROXIES

To provide search, mapping, travel, and billing features, TripDeck proxies requests to third-party providers. Search queries (such as destination names, flight numbers, or coordinate lookups) are transmitted without linking them to your identity or encrypted account data:

Mapbox: Map tile rendering, geocoding, and map styles (Mapbox Privacy Policy).
Open-Meteo: Weather forecasts and historical weather lookups (Open-Meteo Privacy).
Google Places API: Point-of-interest search, venue autocomplete, and address details (Google Privacy Policy).
HERE Technologies: Venue details, including opening hours, phone number, and website (HERE Privacy Policy).
AeroDataBox: Flight schedule lookup, status, and airport data (AeroDataBox Privacy Policy).
AirLabs: Flight schedule lookup and real-time tracking data (AirLabs Privacy Policy).
Transitland: Public transit stops, train station search, and route geometry lookup (Transitland Terms & Privacy).
Frankfurter: Currency conversion rates for the Budget Panel (only a currency code like "USD" is sent, never any cost amount, item name, or other trip content) (Frankfurter).
QR Maker: Vector QR code generation for the optional Pocket Guide export (only the target share or trip URL is transmitted to generate the printable code image) (QR Maker).
Stripe: Payment card processing, customer billing portals, and recurring subscription management (Stripe Privacy Policy). Payment details are submitted directly to Stripe without traversing our servers.

4. ZERO-KNOWLEDGE TRIP SHARING

When you create a share link for an itinerary, TripDeck generates a cryptographic key embedded exclusively in the URL hash fragment (#key). Hash fragments are never transmitted to our servers when the web page loads. If you share in "View-Only" mode, private fields (confirmation codes, seat numbers, gate details, and notes) are stripped client-side prior to encryption.

5. COOKIES, TRACKING & TELEMETRY

TripDeck does not use advertising cookies, third-party marketing trackers, or cross-site behavioral analytics networks. Session cookies are used strictly for authenticated passkey API communication with Cloudflare Pages Functions. Product telemetry is handled entirely on our first-party infrastructure using aggregated, privacy-safe metrics.

6. DATA RETENTION & DELETION

You have full control over your data:

Local Data: You can wipe your local itinerary data and caches at any time by clearing your browser site storage or using the in-app storage reset.
Cloud Data Deletion: If you delete an itinerary or your user account, the associated encrypted ciphertext blobs and authentication credentials are permanently deleted from our database.

7. CHILDREN'S PRIVACY

The Services are intended solely for users 18 years of age or older. We do not knowingly collect or solicit personal data from children under the age of 16.

8. CONTACT US

If you have any questions or concerns about this Privacy Policy, please contact us at: tripdeck@ryanmarch.me.