TripDeck Privacy Policy
Effective date: August 27, 2026 Last updated: October 12, 2026
TripDeck is operated as a sole proprietorship by Christopher S. Dye, based in Waverly, Illinois, United States ("TripDeck," "we," "us," or "our"). This Privacy Policy explains what data TripDeck collects, how we use it, and — most importantly — where your trip data actually lives.
The short version: TripDeck stores account information, business profiles, contacts, trip and engagement notes, extracted business-card data, and file metadata on its servers. Photos and finished Word and Excel files use Google Drive or on-device file storage. Both modes use server-side processing and third-party AI services; neither is a local-only application.
October 8 correction: Earlier wording incorrectly said that contact records, notes, extracted text, and company profiles were not stored on our servers. This update describes the current implementation; changing this wording does not move or delete existing data.
1. Who we are
- Operator: Christopher S. Dye, sole proprietor
- Location: Waverly, Illinois, United States
- Contact for privacy questions: [email protected]
- Website: https://gettripdeck.com
For questions, complaints, or requests about your data, email [email protected]. We handle requests within the deadlines required by applicable law.
2. What TripDeck does, in one paragraph
TripDeck turns conference and customer-engagement notes into reports and contact workbooks. It saves your business profile so company assessments can use your capabilities, priorities, and target customers as context. Saved contacts and notes support later review and report generation. You retain ownership of your content, but ownership does not mean it is stored only on your device or in Google Drive.
3. What you should not put into TripDeck
TripDeck is built for ordinary business contact information gathered at trade shows, industry events, and commercial site visits. It is not a controlled or accredited environment.
Please do not enter into TripDeck any information that is:
- Classified under any government's national security rules
- Controlled Unclassified Information (CUI) of any category (Defense, Export Controlled, Intelligence, Law Enforcement, Critical Infrastructure, and others)
- Technical data or software controlled by ITAR or the EAR
- Protected Health Information under HIPAA
- Payment card data (PCI DSS)
- Proprietary or trade-secret information belonging to a third party without their authorization
- Special categories of personal data under GDPR Article 9, or data about minors under 16
When you request AI-assisted processing, relevant profile information, notes, contact details, and images may be transmitted to AI services. Optional audio transcription, when enabled, also sends the submitted recording for processing. This applies in both file-storage modes. See Section 6.
TripDeck processes content automatically and does not certify that your submissions are suitable for the service. Check your organization's rules and obtain the permissions needed to submit other people's information. Section 4 of the Terms of Service explains these restrictions.
4. What data we collect and where it lives
The file-storage choice controls where photos and finished report files are saved. It does not change where TripDeck stores the application records described below.
4a. Server-stored application records
TripDeck's application database stores these categories in both modes:
| Data | Purpose | Storage detail |
|---|---|---|
| Email address, optional name, and account settings | Sign-in, service emails, personalization, and account administration | Saved in the application database; see Section 9 for retention and requests |
| Password hash (bcrypt) | Sign-in verification | The server processes your password during signup and login; the database stores a bcrypt hash rather than the plaintext password |
| Business profiles | Assess companies against your capabilities, target customers, priorities, differentiators, and pipeline context | Saved on the server, including profile text and preferences you enter |
| Trips, contacts, and notes | Capture meetings and support report generation and follow-up | Includes trip dates and locations, contact details, conference notes, engagement observations, and saved transcript text |
| Extracted business-card data and analysis records | Reuse successful card readings and support assessments | Includes a server-side cache of extracted card details and saved enrichment, scores, rationale, or follow-up fields where used; an image file and its extracted text are separate records |
| File metadata and storage connection records | Locate files, display photos, and access your connected Drive | Includes filenames, file IDs, captions, photo assignments, generation timestamps, storage preferences, and OAuth access and refresh tokens when Drive is connected |
| Subscription, access, and security records | Administer trials and subscriptions, password resets, and use restrictions | Includes Stripe customer and subscription IDs, plan status, trial dates, hashed password-reset tokens, and acknowledgement of content restrictions; not full payment card numbers |
Session information and operational or security logs are also processed to run and protect the service. When enabled, first-party funnel tracking counts page views, signup clicks, signups, completed profiles, and completed report responses. Account milestones use account-linked deduplication records; this is not a claim that all analytics-related records are anonymous. See our analytics explanation.
4b. Google Drive files
Google Drive is the currently supported connected file-storage provider. OneDrive and Dropbox are not supported. TripDeck uses a /TripDeck folder to save:
- Uploaded images: photos, including business-card images
- Generated files: Word reports and Excel contact and business-assessment workbooks
These files are separate from the server-stored application records in Section 4a. Saving a report in Drive does not move or delete its source notes, contacts, business profile, or extracted card cache from TripDeck. Disconnecting Drive removes the saved connection from TripDeck but does not delete your Drive files or your TripDeck records.
4c. On your device (on-device mode users)
On-device file storage means browser-held photos and downloaded reports, not local-only processing:
- Photos: image files are held in this browser's storage between uses. Metadata is saved on the server. Relevant images are uploaded for report generation and may be sent to AI services for card reading or other requested processing.
- Generated reports: the server creates Word and Excel files and sends them to your browser for download. The application does not save a permanent server copy of these generated files. Save the download yourself; it is not automatically archived in browser photo storage.
- Application records: business profiles, contacts, notes, extracted card data, and file metadata remain server-stored in this mode.
- Local removal: clearing browser-held photos does not delete server records, extracted card text, downloaded files, or Drive files.
Clearing site data or browser storage eviction can remove browser-held photos. Those photos are not automatically available in another browser or on another device. Keep your own copies of photos and downloaded reports you need to preserve.
Use the dashboard's “Delete browser photos” control, or clear site data for the app's address in your browser settings, to remove locally held photos. This action cannot be undone through TripDeck and is not an account-deletion request.
4d. What we access, briefly, in flight
Photo and report bytes pass through server memory during processing. The current application uses memory buffers rather than a permanent server file archive for those files. This does not mean derived text is discarded: successful business-card extractions are cached in the database, and saved notes and contact records remain there. Provider processing and retention are separate from TripDeck's file-storage behavior.
Database exports to users' personal Drive accounts are disabled. The file-storage choice is not a backup of all application records. See Section 9 for retention and deletion requests.
5. Google user data (Drive scope specifically)
TripDeck requests one Google OAuth scope: https://www.googleapis.com/auth/drive.file
This scope grants access only to files and folders that TripDeck creates in your Drive or that you explicitly open with TripDeck. TripDeck cannot see, read, or list any other file in your Google Drive. This is a hard technical limit enforced by Google, not a promise from us.
How TripDeck uses Google user data:
- Create the /TripDeck folder in your Drive on first connection
- Write Word reports, Excel workbooks, and uploaded images into that folder
- Read those same files back when you view them in the TripDeck app
How TripDeck does NOT use Google user data: - We process relevant Drive content through the infrastructure and AI services described in Section 6 to fulfill your requests - We do not use your Drive data to train AI models - We do not use your Drive data for advertising - We do not sell, rent, or trade your Drive data - Connecting Drive is not permission to use unrelated files for advertising or other unrelated purposes.
TripDeck's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Third-party services we use
TripDeck routes data through a small number of services strictly to deliver the product:
| Service | What it processes | Why |
|---|---|---|
| Google Drive (if connected) | Uploaded images, Word reports, and Excel workbooks | File storage under your Google account |
| Perplexity API and the models used through that service | Relevant business profiles, contact details, notes, card images, research queries, and generated analysis | Card reading, company research, profile assistance, and report analysis |
| OpenAI audio transcription (only when the optional feature is enabled and used) | Submitted voice recordings | Produce transcript text for review and saving into notes; this is separate from Perplexity report generation |
| Render | Application requests, server-stored records, and operational logs | Backend hosting and application database storage |
| Cloudflare | Website requests and network/security information, including IP addresses and request paths | Marketing-site hosting, DNS, traffic analytics, and security controls |
| Stripe | Checkout and billing information | Subscriptions and payments; TripDeck stores subscription references and status, not full payment card numbers |
| Resend (when email sending is configured) | Recipient addresses and service-email content, such as password-reset messages | Deliver service emails |
| Easy-Peasy.AI (optional public-website chat) | Messages you submit, connection information such as IP address and browser details, and provider conversation records | Answer general product questions; separate from the TripDeck application and its stored business records |
TripDeck does not use your content to train its own AI models. AI processing is governed by the providers' applicable API terms and configured services; this policy does not promise zero provider retention. Contact us before submitting information that requires specific contractual processing or retention protections.
We do not sell your content. Service providers process information needed for their functions; disclosures may also be necessary to meet legal obligations or handle security incidents. First-party funnel counters and hosting/security analytics are described separately from your stored business records.
Optional public-website chat
The public website offers an optional Easy-Peasy.AI chat for general product questions. Opening the notice does not load the chat provider. Choosing Start chat loads the third-party service, which receives network and browser information and processes messages you choose to send. Easy-Peasy.AI may use other AI providers to process and retain those messages under its privacy policy. Chat conversations may be available to TripDeck for support review. We do not promise zero retention or a fixed deletion period for provider records.
This integration does not send your TripDeck login, stored trips, company profiles, contacts, reports, or billing records to the bot. Anything you type into the chat is a separate disclosure: do not enter passwords, payment details, confidential business information, CUI, classified information, or export-controlled material. The embedded chat is not granted microphone, camera, or location permission. Closing it unloads the widget; it does not erase messages already processed by the provider.
You can use the website without starting chat. For support or questions about chat records and deletion, email [email protected]. AI responses may be inaccurate; they do not change TripDeck's published terms, pricing, or security commitments.
7. How we protect your data
- The public website and application use HTTPS
- Passwords are hashed with bcrypt before storage. We cannot recover your password if you forget it.
- Authentication and ownership checks restrict access to private application records
- Connected Drive files remain subject to your Google account's access and sharing settings
No service can guarantee absolute security. We do not describe TripDeck as end-to-end encrypted, a zero-storage service, or an accredited environment. If you spot a concern, email [email protected].
8. Your rights
Depending on where you live and the applicable law, you may have rights to access, correct, delete, or receive a copy of personal information, and to object to or restrict processing. You can contact us about:
- Access and export: request your server-stored account and business records. A downloaded report is not necessarily a complete export of those records.
- Correction: edit available fields in the app or ask us to correct inaccurate information.
- Deletion: request deletion of your account or specified server-stored records by email. The app does not currently provide a self-service “Delete Account” control.
- Revoke storage access: revoke TripDeck's permission in your Google account. Removing a connection does not itself delete server records or Drive files.
- Object to processing or restrict processing — email us
- File a complaint — with your local data protection authority if you're in the EEA
Email [email protected] for these requests. We may need to verify your identity and clarify which records you mean. We will explain any applicable legal limits or required retention rather than promise immediate deletion in every case.
9. Data retention and deletion
- Application records: saved profiles, contacts, notes, and related records remain in the database for ongoing use. Trial expiry, subscription cancellation, downloading a report, or changing file storage does not automatically delete them. There is not currently an automatic expiry schedule for these business records.
- Card-extraction cache: successful readings are retained for reuse. Deleting the corresponding photo record through the app removes its cache entry; clearing only the browser's photo files does not.
- Connection records: disconnecting Drive through TripDeck removes its stored Google connection tokens. You can also revoke permission in Google. Revocation does not erase other saved TripDeck data.
- Logs and provider records: retention depends on the hosting and service-provider configuration and applicable obligations. This policy does not promise a verified fixed deletion period for every log, provider record, or infrastructure backup.
- Files you control: downloaded files and Drive files are separate from server-side account records. Manage their deletion in your device or Google account.
To request account or content deletion, email [email protected]. We will confirm the scope, any required retention, and the outcome after handling the request. Do not assume that deleting local files, revoking Drive access, or canceling billing deletes all server-side information.
10. Children
TripDeck is a business tool. It is not directed at anyone under 16, and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, email us and we will delete it.
11. International transfers
TripDeck's operator is based in the United States. The current Render backend is deployed in Frankfurt, Germany, but that does not mean every copy or processing step stays in Germany or the EU. Cloudflare, Google, AI services, payment services, and email services may process information in other countries under their service arrangements. Selecting Google Drive or on-device files is not a data-residency guarantee. Contact us if your organization requires a data-processing agreement, specified processing locations, or transfer safeguards before using the service.
12. Changes to this policy
We'll update this policy when TripDeck's data practices change. Material changes will be announced by email to your account address at least 14 days before they take effect. The "Last updated" date at the top always reflects the current version.
13. Contact
- Email: [email protected]
- Postal: Christopher S. Dye, Waverly, Illinois, United States (mailing address available on request)
We aim to acknowledge requests within 5 business days and handle them within applicable legal deadlines. If identity verification, clarification, or a permitted extension is needed, we will explain it.