Tripz Travel uses cookies and similar browser storage to keep the service secure, remember choices you make, support offline and sharing features, and support app features. Optional product analytics and embedded Mapbox maps are disabled in this web build. Apple Maps loads when you open map features, including trip maps, plan maps and planning results.
Effective date: 15 October 2026 · Version 3.5 · Questions: privacy@tripztravel.com
Cookies are small text files stored on your device. This policy also covers similar technologies, including localStorage, sessionStorage, IndexedDB, Cache Storage, pixels, and scripts that can store or read information on your device.
First-party storage is set by Tripz Travel. Third-party storage is set by other companies whose services you choose to use or whose sites you visit after leaving Tripz Travel.
Tripz Travel applies the higher UK/EEA opt-in standard across our launch area. We can use storage that is strictly necessary to provide a service you requested without separate cookie consent. We ask for consent before using analytics or other non-essential storage.
This storage is needed for security, authentication, consent records, or features and preferences you request. It cannot be disabled in Tripz Travel's cookie settings without breaking those flows, but you can clear it from your browser.
| Name | Set by | Purpose | Expiry | Type | Consent basis |
|---|---|---|---|---|---|
| __Host-packd-planning-browser | The Tripz Travel host you are using | Binds your recent planning conversation to this browser when you choose to sign in. The cookie contains a random value, not your chat or account credentials. The encrypted server copy can be restored after sign-in in another tab of the same browser. | Session cookie; each encrypted conversation copy expires after 30 minutes, without renewal. Cancellation removes an identified copy; interrupted requests expire automatically. Claimed copies are included in account-deletion cleanup. | First-party cookie; HttpOnly; Secure; SameSite=Lax | Requested sign-in continuation; not advertising or analytics |
| __Secure-authjs.session-token[.n] / authjs.session-token[.n] | tripztravel.com | Keeps you signed in. The cookie may be chunked with numeric suffixes if the session token is large. | 24 hours, rolling | First-party cookie; HttpOnly; Secure in production; SameSite=Lax | Strictly necessary |
| __Secure-authjs.callback-url / authjs.callback-url | tripztravel.com | Remembers the page to return you to during sign-in. | Session | First-party cookie; HttpOnly; Secure in production; SameSite=Lax | Strictly necessary |
| __Host-authjs.csrf-token / authjs.csrf-token | tripztravel.com | Protects sign-in and account flows against cross-site request forgery. | Session | First-party cookie; HttpOnly; Secure in production; SameSite=Lax | Strictly necessary |
| __Secure-authjs.pkce.code_verifier / authjs.pkce.code_verifier | tripztravel.com | Completes OAuth sign-in securely using PKCE. | 15 minutes | First-party cookie; HttpOnly; Secure in production; SameSite=Lax | Strictly necessary |
| __Secure-authjs.state / authjs.state | tripztravel.com | Validates OAuth sign-in state and prevents tampering. | 15 minutes | First-party cookie; HttpOnly; Secure in production; SameSite=Lax | Strictly necessary |
| __Secure-authjs.nonce / authjs.nonce | tripztravel.com | Validates OpenID Connect responses when a provider requires a nonce. | Session | First-party cookie; HttpOnly; Secure in production; SameSite=Lax | Strictly necessary |
| __Secure-authjs.challenge / authjs.challenge | tripztravel.com | Stores a short-lived challenge for supported authentication flows. | 15 minutes | First-party cookie; HttpOnly; Secure in production; SameSite=Lax | Strictly necessary |
| oauth_csrf_google_mail / oauth_csrf_google_cal / oauth_csrf_outlook_mail / oauth_csrf_outlook_cal | tripztravel.com | Protects connected-account OAuth flows for Gmail, Google Calendar, Outlook Mail, and Outlook Calendar. | 10 minutes or deleted after callback | First-party cookie; HttpOnly; Secure outside development; SameSite=Lax | Strictly necessary |
| oauth_pkce_google_mail / oauth_pkce_google_cal / oauth_pkce_outlook_mail / oauth_pkce_outlook_cal | tripztravel.com | Stores the short-lived PKCE verifier needed to finish connected-account OAuth flows. | 10 minutes or deleted after callback | First-party cookie; HttpOnly; Secure outside development; SameSite=Lax | Strictly necessary |
| settle-lang | tripztravel.com | Remembers the language you selected so pages render in that language. | 365 days | First-party cookie; SameSite=Lax | Requested preference |
| packd.consent | tripztravel.com | Remembers acknowledgement of the storage notice, including version and timestamp. Analytics remains false. | Until overwritten or browser storage is cleared; a new notice version prompts acknowledgement again | localStorage | Storage notice preference |
| packd-theme | tripztravel.com | Remembers the visual theme you selected and applies it on page load. | Until changed or browser storage is cleared | localStorage | Requested preference |
| packd-offline-device-id | tripztravel.com | Identifies a device you registered for the Offline Vault feature. | Until the offline device is revoked or browser storage is cleared | localStorage | Requested offline feature |
| packd-offline | tripztravel.com | Stores synced trip, memory, state, and record data for the Offline Vault feature you enable. | Until offline data is purged, the device is revoked, or browser storage is cleared | IndexedDB | Requested offline feature |
| packd-offline-{revision} / packd-share-media-v1 | tripztravel.com | Automatically caches the offline shell and eligible successful requests; also caches synced covers and shared media for offline/sharing features. | Until replaced by the service worker, consumed, evicted, or browser storage is cleared | Cache Storage | Service and requested sharing feature |
| packd:pending_invite | tripztravel.com | Remembers an invite you started so it can continue after sign-in or onboarding. | 24-hour validity checked on read; removed when consumed, cleared or read after expiry | localStorage | Requested invite flow |
| packd:whatsNew:lastSeen | tripztravel.com | Remembers the latest product update notice you have seen. | Until browser storage is cleared | localStorage | Service preference |
| packd:proactive-cards-dismissed-v1 | tripztravel.com | Remembers dismissed proactive prompt cards so they do not reappear immediately. | Seven-day display cooldown; removed during sign-out/account-deletion cleanup. Otherwise stored records can remain until replaced or browser storage is cleared | localStorage | Service preference |
| packd.ctxPanel.collapsed | tripztravel.com | Remembers whether the trip hub context panel is collapsed. | Until changed or browser storage is cleared | localStorage | Service preference |
| packd.copilotPanel.pinned | tripztravel.com | Remembers whether the trip assistant panel is pinned. | Until changed or browser storage is cleared | localStorage | Service preference |
| packd.visa.expanded.{tripId} | tripztravel.com | Remembers whether a trip's visa requirement card is expanded. | Until changed, sign-out/account-deletion cleanup or browser storage is cleared | localStorage | Service preference |
| packd:create-item-draft:{tripId} | tripztravel.com | Keeps an unfinished trip item draft so it is not lost while you work. | 24-hour validity checked on read; removed on save, clear, stale read or sign-out cleanup. Otherwise it can remain until browser storage is cleared | localStorage | Requested draft feature |
| packd.lastLoginProvider | tripztravel.com | Remembers your last completed sign-in provider to help you sign in again. | Until replaced or browser storage is cleared | localStorage | Sign-in preference |
| packd.magic-link-retry-at.v1 | tripztravel.com | Remembers the magic-link retry cooldown in this tab. | 30-second cooldown; removed when the reader sees expiry or the tab session ends | sessionStorage | Requested sign-in flow |
| packd.tripContinuity.v1.{tripId} / packd.tripContinuity.v1.recent / packd.planContinuity.v1.{planId} / packd.planContinuity.v1.recent | tripztravel.com | Automatically saves limited trip and plan summaries when those pages are viewed, including names, dates, destinations and selected timeline summaries, for the trip error-page fallback. | Until overwritten, sign-out cleanup or browser storage clearing; these local summaries have no automatic expiry | localStorage | Automatic continuity storage; separate from product analytics and the opt-in Offline Vault |
Analytics would help us understand how Tripz Travel is used so we can improve it. Tripz Travel currently has no active analytics provider, no Google Analytics 4 implementation, and no analytics script loading in the app. If we add analytics, it will stay off unless you consent and we update this policy where required.
If you sign in or connect an account through Google or Microsoft, those providers may set cookies on their own domains, such as accounts.google.com or login.microsoftonline.com. Their cookies are controlled by their own policies, not by Tripz Travel.
Tripz Travel uses outbound partner links, including TravelPayouts deeplinks, for referral attribution. For Trip affiliate suggestions, Tripz Travel stores a random per-viewer attribution mapping on the server for 90 days after the latest click. The outbound link includes the opaque tracking value and may include limited Trip-derived service-prefill details, such as a city, date or time, party and luggage counts, and pickup or drop-off details. It does not contain your Tripz Travel account name, email address, booking reference, passport details, or free-form itinerary notes. Tripz Travel does not load TravelPayouts JavaScript widgets. Once you leave Tripz Travel, the partner site's own cookie policy applies.
Public recommendation links work without signing in or enabling browser recognition. Each click has a new random partner tracking ID. Tripz Travel associates it with your signed-in account, or a separate visitor record when signed out, for 90 days. With recognition off, each unrecognised click receives a new visitor record. Public conversion accounting retains no account or visitor association after its click record expires or the associated account is deleted.
You can optionally enable session recognition in Cookie settings. This sets the first-party HttpOnly, Secure, SameSite=Lax cookie __Host-packd-affiliate-session on the Tripz Travel host you are using. It lets Tripz Travel associate repeat clicks with the same visitor during that browser session, with a server-enforced maximum of 24 hours. The cookie contains a random credential; Tripz Travel stores its hash and your consent version and time. It grants no account access and is never sent to partners. Session restoration by your browser may preserve the cookie, but cannot extend the 24-hour limit. Turning recognition off revokes that credential and deletes the cookie; existing click attribution keeps its 90-day retention period. Notice acknowledgment does not enable recognition, and a future session requires a new opt-in.
Apple Maps loads when you open map features, including trip maps, plan maps and planning results. Apple receives ordinary browser request information, including your IP address, and the map view; Tripz Travel displays the relevant place coordinates and labels without requesting your device location. Apple Maps analytics endpoints remain blocked. Embedded Mapbox maps are temporarily unavailable. Location lists and external directions links remain available. Opening a directions link takes you to Apple Maps or Google Maps, whose own privacy rules apply. Requested directions and route optimisation use Apple Maps server-side and send the relevant waypoint coordinates. Some avatar and cover images load directly from image providers, including Google, DiceBear and Pexels; other images pass through Tripz Travel's image proxy. Direct image requests expose your IP address and ordinary request information to the provider.
Tripz Travel may use server-side operational telemetry, such as Azure Application Insights and OpenTelemetry, to keep the service reliable and secure. This is separate from browser analytics cookies and does not set analytics cookies in your browser.
packd.consent.You can also manage cookies and storage directly in your browser. Blocking strictly necessary cookies will prevent Tripz Travel from working correctly, including sign-in.
Google Chrome · Mozilla Firefox · Apple Safari · Microsoft Edge
Swiss law has different consent mechanics for cookies, but Tripz Travel applies the stricter UK/EEA opt-in approach to everyone for consistency.
If we add analytics, a new cookie category, a new third-party vendor, or a new purpose for existing storage, we will update this policy and re-prompt you where required. Minor wording or formatting fixes may be made without re-prompting.
Questions about cookies or this policy: privacy@tripztravel.com.
You also have the right to complain to a supervisory authority:
Related policies
These documents together explain how Tripz Travel handles your data.