Cookie Policy

1. What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to remember information about your visit — such as your preferred language or login state — making your next visit easier and more useful.

We also use localStorage, a browser-based storage mechanism that works similarly to cookies but is never automatically sent to our servers. It is used exclusively to preserve your trip-planning progress within your browser.

2. Types of Cookies We Use

2.1 Strictly Necessary Cookies

• next-auth.session-token — Manages your authenticated session after sign-in. Expires when you sign out or after 30 days. Set by NextAuth.js.
• next-auth.csrf-token — Protects against Cross-Site Request Forgery (CSRF) attacks. Session-scoped.
• next-auth.callback-url — Remembers the page you were on before signing in to redirect you back. Session-scoped.

2.2 Functional Cookies & Local Storage

• tripzync_onboarding (localStorage) — Stores your in-progress trip plan (destination, cities, places, dates, hotel preferences) locally in your browser. This data never leaves your device unless you create an account. Persists until you clear browser storage or create an account.
• tripzync_theme (localStorage) — Stores your colour theme preference (e.g. default, ember, forest). Session-persistent.

2.3 Analytics Cookies (Optional)

TripZync currently uses only privacy-friendly, server-side analytics without third-party tracking scripts. If third-party analytics (e.g. Google Analytics) are introduced in future, this policy will be updated and your consent will be re-requested before activation.

2.4 Marketing Cookies (Not Used)

TripZync does not currently use any marketing, retargeting, or advertising cookies. We do not share your browsing behaviour with any advertising networks.

3. Third-Party Technologies

The following third-party services may set their own cookies or access data when you use TripZync:

• Google Sign-In (accounts.google.com) — When you sign in with Google, Google may set cookies on its own domain to manage the OAuth flow. These are governed by Google's Privacy Policy.
• Google Fonts (fonts.googleapis.com)— Loads typefaces used in the app. Google may log the request. No personal data from TripZync is shared. See Google's policy for details.
• open-meteo.com — Receives your destination city name (not your personal identity) to return weather data. No cookies are set by this service on your device.
• Nominatim / OpenStreetMap — Receives a place name to return geographic coordinates for weather display. No cookies are set. Governed by the OSM Privacy Policy.
• Vercel (hosting) — May set performance and security cookies as part of infrastructure operation. These are strictly necessary and governed by Vercel's Privacy Policy.

4. Your Consent and Rights

Under Thailand PDPA, you have the right to consent to or refuse non-essential cookies and to withdraw that consent at any time without affecting the lawfulness of prior processing.

When you first visit TripZync, a cookie notice will inform you of the cookies in use. Strictly necessary cookies are activated without consent; optional categories require your opt-in.

5. How to Manage or Delete Cookies

5.1 Browser Settings

You can control cookies directly through your browser settings. Most browsers allow you to:

• View all cookies currently stored
• Delete specific cookies or all cookies
• Block third-party cookies
• Set cookies to expire when you close the browser

Refer to your browser's help documentation for instructions:

• Chrome: Settings → Privacy and Security → Cookies and other site data
• Safari: Preferences → Privacy → Manage Website Data
• Firefox: Options → Privacy & Security → Cookies and Site Data
• Edge: Settings → Cookies and site permissions

5.2 Clearing localStorage

To remove TripZync's local storage data (your offline trip plan), open browser Developer Tools (F12), go to Application → Local Storage → [tripzync domain], and delete the tripzync_onboarding key, or clear all site data.

5.3 Effect of Blocking Cookies

Blocking strictly necessary cookies will prevent you from signing in and using personalised features. Optional cookies can be blocked without affecting core functionality.

6. Cookie Retention Periods

• next-auth.session-token: 30 days (or until sign-out)
• next-auth.csrf-token: Session
• next-auth.callback-url: Session
• tripzync_onboarding (localStorage): Until cleared by user or account creation
• tripzync_theme (localStorage): Indefinite (user preference)

7. Changes to This Cookie Policy

We will update this Cookie Policy whenever we add, change, or remove cookies. Material changes will be communicated via a notice on our website and, where applicable, via email. The effective date at the top of this page will always reflect the latest version.

8. Contact Us