TERMS AND CONDITIONS

Last updated August 13, 2026

AGREEMENT TO OUR LEGAL TERMS

We are TripDeck ("Company," "we," "us," "our"), operating https://tripdeck.ryanmarch.me and related offerings (collectively, the "Services"). You can contact us at tripdeck@ryanmarch.me.

These Legal Terms constitute a legally binding agreement concerning your access to and use of the Services. By accessing the Services, you agree to be bound by all of these terms. IF YOU DO NOT AGREE, YOU ARE EXPRESSLY PROHIBITED FROM USING THE SERVICES AND MUST DISCONTINUE USE IMMEDIATELY.

We reserve the right to modify these terms at our sole discretion, and your continued use constitutes acceptance of any updated revisions. Finally, the Services are intended solely for users who are at least 18 years old.

TERMS AND CONDITIONS

OUR SERVICES & USER REGISTRATION
INTELLECTUAL PROPERTY & SOFTWARE
PROHIBITED ACTIVITIES
DATA, PRIVACY & ZERO-KNOWLEDGE ENCRYPTION
THIRD-PARTY DATA, SERVICES & ATTRIBUTIONS
DISCLAIMERS & LIMITATIONS OF LIABILITY
GENERAL LEGAL PROVISIONS
CONTACT US

1. OUR SERVICES & USER REGISTRATION

You must provide accurate information to register for an account and are entirely responsible for maintaining the confidentiality of your password. The Services are currently free for personal use, though we reserve the right to introduce paid features in the future. The Services are not tailored to comply with industry-specific regulations like HIPAA or GLBA.

2. INTELLECTUAL PROPERTY & SOFTWARE

We own or license all source code, databases, and designs in the Services (the "Content"). We grant you a revocable, non-transferable license to access the Services for personal, non-commercial use. Any feedback or suggestions ("Submissions") you provide become our property, which we may use without compensation to you. If you believe any material on the Services infringes upon your copyright, please notify us immediately.

3. PROHIBITED ACTIVITIES

You may not access or use the Services for any illegal or unauthorized purpose. Prohibited activities include, but are not limited to: systematic data scraping; circumventing security features; harassing other users; uploading viruses or malicious code; reverse-engineering the software; or using the Services for commercial endeavors without our explicit consent.

4. DATA, PRIVACY & ZERO-KNOWLEDGE ENCRYPTION

You retain full ownership of your itineraries, notes, and packing lists ("Itinerary Content"). By using the Services, you consent to our Privacy Policy and the processing of your data in the United States.

Zero-Knowledge Architecture: We employ client-side encryption. Your Itinerary Content is encrypted on your local device before transmission. We do not store your encryption keys or passwords in plaintext. Consequently, if you lose your password, we cannot recover or decrypt your data. You bear sole responsibility for your credentials, and data lost due to forgotten passwords cannot be restored.

Shared Links: If you use our sharing features, anyone with the link can view your itinerary. You are solely responsible for managing these links and ensuring you do not publicly share sensitive personal information.

5. THIRD-PARTY DATA, SERVICES & ATTRIBUTIONS

The Services integrate third-party APIs and open-source libraries to provide mapping, venue lookups, flight tracking, and weather forecasts ("Third-Party Data"). This data is for planning purposes only and is not guaranteed to be accurate or real-time. Travel schedules are subject to real-world disruptions. We act as an itinerary dashboard, not a travel agency, and hold no liability for missed flights, inaccurate coordinates, or travel disruptions resulting from reliance on the Services.

We gratefully acknowledge the following third-party services, data providers, and open-source software that power TripDeck:

Mapbox: Interactive map rendering, geocoding, and map styles (Mapbox Terms of Service). Map data © OpenStreetMap contributors.
Open-Meteo: Weather forecasts and air quality data (Open-Meteo Terms, licensed under CC BY 4.0).
Google Places API: Point-of-interest search, venue autocomplete, and address details.
HERE Technologies: Venue details, including opening hours, phone number, and website.
AeroDataBox: Flight status, schedules, and airport data (AeroDataBox Terms of Use).
AirLabs: Real-time flight tracking and route status data.
Transitland: Public transit stops, train station metadata, and route geometry data (Transitland Terms, licensed under CC BY 4.0).
Frankfurter: Currency conversion rates sourced from the European Central Bank, used for the optional Budget Panel's home-currency estimates.
QR Maker: Vector QR code rendering for printed Pocket Guide itineraries.

6. DISCLAIMERS & LIMITATIONS OF LIABILITY

THE SERVICES ARE PROVIDED "AS-IS" WITHOUT WARRANTIES OF ANY KIND. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT WILL OUR LIABILITY EXCEED $100.00 USD. You agree to defend, indemnify, and hold us harmless from any loss, damage, or claim (including attorneys' fees) made by a third party due to your use of the Services or your Itinerary Content.

7. GENERAL LEGAL PROVISIONS

Termination & Modification: We reserve the right to modify, suspend, or terminate the Services, or your access to them, at any time without notice or liability.

Governing Law & Disputes: These terms are governed by the laws of the State of Ohio. Any disputes not resolved through informal 30-day negotiations shall be prosecuted exclusively in the state and federal courts located in Franklin, Ohio. You waive the right to participate in class-action lawsuits regarding the Services.

Electronic Consent: You consent to receive electronic communications and agree that electronic agreements and signatures hold the same legal weight as physical documentation.

8. CONTACT US

For questions or to resolve complaints, please contact us at: tripdeck@ryanmarch.me.

PRIVACY POLICY

Last updated August 18, 2026

1. OVERVIEW & ZERO-KNOWLEDGE ARCHITECTURE

At TripDeck ("Company," "we," "us," "our"), we believe your travel plans and personal itineraries are your private business. We operate https://tripdeck.ryanmarch.me with a Zero-Knowledge, Local-First Architecture.

This means your itinerary data, notes, and packing lists are encrypted on your local device using industry-standard Web Cryptography (AES-GCM-256) before syncing to our servers. We do not possess your encryption keys, passwords, or recovery keys in plaintext, and we cannot read, decrypt, or access your stored travel itineraries.

2. INFORMATION WE COLLECT & HOW IT IS USED

Because TripDeck is designed around local-first privacy, we collect only the minimal data necessary to provide cloud sync and authentication services:

Authentication Data: When you register an account, we store public WebAuthn / Passkey credentials and cryptographic salt/verifier parameters. We do not store plaintext passwords.
Encrypted Vault Blobs: When you save or sync an itinerary to the cloud, our database stores an encrypted ciphertext blob and version metadata. The server cannot inspect the contents of these blobs.
Local Browser Storage: Your itinerary files, active edits, and display preferences are stored directly on your device via localStorage and the browser Cache Storage API for offline functionality.
Basic Infrastructure Logs: Our hosting provider (Cloudflare) collects standard HTTP request logs (such as IP addresses and user agents) strictly for server security, abuse prevention, and rate limiting. We do not sell, track, or profile this information.

3. THIRD-PARTY DATA PROVIDERS & PROXIES

To provide search, mapping, and travel features, TripDeck proxies search requests to third-party providers. Search queries (such as destination names, flight numbers, or coordinate lookups) are transmitted without linking them to your identity or encrypted account data:

Mapbox: Map tile rendering, geocoding, and map styles (Mapbox Privacy Policy).
Open-Meteo: Weather forecasts and historical weather lookups (Open-Meteo Privacy).
Google Places API: Point-of-interest search, venue autocomplete, and address details (Google Privacy Policy).
HERE Technologies: Venue details, including opening hours, phone number, and website (HERE Privacy Policy).
AeroDataBox: Flight schedule lookup, status, and airport data (AeroDataBox Privacy Policy).
AirLabs: Flight schedule lookup and real-time tracking data (AirLabs Privacy Policy).
Transitland: Public transit stops, train station search, and route geometry lookup (Transitland Terms & Privacy).
Frankfurter: Currency conversion rates for the Budget Panel — only a currency code ("USD", etc) is sent, never any cost amount, item name, or other trip content (Frankfurter).
QR Maker: Vector QR code generation for the optional Pocket Guide export — only the target share or trip URL is transmitted to generate the printable code image (QR Maker).

4. ZERO-KNOWLEDGE TRIP SHARING

When you create a share link for an itinerary, TripDeck generates a cryptographic key embedded exclusively in the URL hash fragment (#key). Hash fragments are never transmitted to our servers when the web page loads. If you share in "View-Only" mode, private fields (confirmation codes, seat numbers, gate details, and notes) are stripped client-side prior to encryption.

5. COOKIES & TRACKING

TripDeck does not use advertising cookies, marketing trackers, or third-party behavioral analytics scripts. Session cookies are used solely for authenticated passkey API communication with Cloudflare Pages Functions.

6. DATA RETENTION & DELETION

You have full control over your data:

Local Data: You can wipe your local itinerary data and caches at any time by clearing your browser site storage or using the in-app storage reset.
Cloud Data Deletion: If you delete an itinerary or your user account, the associated encrypted ciphertext blobs and authentication credentials are permanently deleted from our database.

7. CHILDREN'S PRIVACY

The Services are intended solely for users 18 years of age or older. We do not knowingly collect or solicit personal data from children under the age of 16.

8. CONTACT US

If you have any questions or concerns about this Privacy Policy, please contact us at: tripdeck@ryanmarch.me.