Privacy Policy

Stamp photos. When you upload a passport stamp photo, it is sent to our server for one-shot extraction: the server forwards the image to an AI vision provider (OpenRouter) to read the stamps, returns the readings to your browser, and immediately discards the image. Full photos are never written to server storage, never logged, and never used for anything other than answering that single request. A small source crop is saved with the draft in your browser so you can verify its row. We do not claim your files never leave your browser; stamp photos do, exactly once, for this purpose.

Your I-94 PDF and timeline. The I-94 travel-history PDF is parsed entirely in your browser and is never uploaded. Your draft timeline (trips, edits, confirmations, and small evidence crops) is saved only in your own browser's localStorage. Close the tab and clear site data, and nothing remains.

Account. If you sign in, we store your email address, hashed sign-in codes and sessions, paid unlock link, and free-photo quota count. Codes expire after 10 minutes and sessions use a random token whose hash, not the token itself, is stored in our database. Your timeline and documents are never added to the account.

Optional email request. If you use the separate timeline-copy request, we store the email address and optional note you submit. No document or trip row is included with that request.

One-time purchase. Paddle, our merchant of record, processes the checkout and your card details; we never see them. After Paddle confirms payment, we store the random checkout reference, the Paddle transaction id, paid status, purchase time, and the email you gave Paddle. We do not attach your timeline or documents to that record. You can still purchase without signing in and keep the signed unlock in this browser. If you are signed in during checkout, or choose to save the unlock to an email afterward, the license is linked to your account so it can be restored on another device.

Rate limiting. To keep the free extraction service available, we keep per-IP request counters and an account photo-reading count. These counters are not linked to trip rows or document content.

Product analytics. To improve the tool we record small first-party usage events: a whitelisted action name plus optional numeric counts and timings. On your first visit only, we also record the domain of the site that sent you (for example google.com, never the full address or what you searched for) and the page you arrived on. We do not send button text, browser error messages, file contents, file names, dates, countries, or trip rows. Events are grouped by a random anonymous id stored in your browser. No third-party analytics scripts, advertising networks, or fingerprinting.

Operational logs. The site runs on Cloudflare; standard infrastructure logs (IP address, request path, timing) exist for reliability and abuse prevention.

Questions: support@triprebuild.com