Legal
Privacy
Trip Pack is a route tool for cyclists. This page explains what happens to the data you give it. Short version: the free tool reads your GPX in your browser, the paid pack deletes your GPX within a day, and the site uses no advertising cookies.
Who is responsible
Trip Pack is operated by Peter Müller, Hauptstraße 21, 71272 Renningen, Germany, who is the controller for the data described on this page. For any privacy question or request, write to hello@ridetrippack.com. You can also reach the controller by post at the address above.
The free splitter
The free splitter runs in your browser. Your GPX file is read on your device and is not uploaded, stored or logged by us. Closing the page removes it from memory.
The paid pack
When you order a pack, your GPX file is uploaded to our server so the PDF and the day files can be built. The file stays on the server only while the pack is built and is deleted immediately afterwards, and in any case within 24 hours. The finished ZIP is stored for 14 days after payment so you can download it again, then deleted.
If you give an email address, we use it to send the download link and to answer your reply. We do not add it to a marketing list. The order record (email, amount, date, token, and the time you agreed to the terms) is kept for up to 24 months for accounting, then deleted. An unpaid order is deleted after 90 days.
Payments
Payments run through Stripe. Stripe receives your payment details, name, email address and billing country. We receive the payment status, the amount and the email address linked to the payment. We never see your card number. Stripe's own privacy notice applies to the payment data.
Transactional email is sent through Resend. Resend receives the recipient address and the content of the message.
Launch list
If you leave an email address on the launch list, we store the address, the page you came from, the time and a one-way hash of your IP address. We use it for one message when checkout opens. The record is deleted when you ask, and in any case after 24 months. You can ask for deletion at any time by writing to the address above.
Usage events
The splitter sends a few events to our server so we can see whether the tool works: that a GPX loaded, the number of days, the rounded route distance, the number of track points, and whether the pack button was clicked. Each event stores a one-way hash of your IP address and your browser user agent. We keep these events for 90 days, then delete them. They contain no file contents and no email address.
Analytics
Page views are counted with GoatCounter, which runs on our own server. It sets no cookies, does not fingerprint devices and does not store full IP addresses. The counts are aggregated. Your browser sends the page address and a normal request header.
Server logs
The web server records the request path, status code, time, user agent and IP address for security and fault finding. Logs are rotated and kept for up to 14 days. We do not use them to build profiles.
Legal bases
- Building and delivering a pack you ordered: performance of a contract.
- Sending the pack email and answering you: performance of a contract or our legitimate interest in support.
- Launch list: your consent, which you give by submitting the form.
- Server logs and rate limits: legitimate interest in keeping the service available and secure.
Your rights
You have the right to access, correct, delete or restrict the processing of your personal data, to object to processing based on legitimate interests, and to receive your data in a portable format. Write to hello@ridetrippack.com. You also have the right to complain to a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
Processors and transfers
We use Hetzner for hosting, Stripe for payments and Resend for email. These providers process data on our instructions. Some processing takes place outside the European Union, in particular at Stripe and Resend. Those transfers rely on the providers' standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
Changes
If this page changes in a way that affects you, the new version appears here with a new date.