Privacy policy
Last updated 23 October 2026.
Demo: no real payments. During the demo, checkout is simulated: no card is collected, no money is charged, and the subscription it creates exists for testing only. The terms below describe how paid subscriptions work once real payments are switched on.
Who is responsible
the individual who operates this site, based in Georgia is responsible for the data described here. Contact: georgeotskheli@gmail.com.
This website
No analytics or advertising. Fonts and scripts are served from the site itself. Two things are stored in your browser: your light or dark theme choice (local storage, key tc-theme) and, after you sign in, a short-lived website session token (session storage, cleared when the tab closes and valid for 8 hours). Neither is sent anywhere except the token to the licensing service when you use your account. The hosting provider that serves the site may keep standard server logs, such as IP address and requested page; we do not use them for anything else.
The optional free check at /scan makes direct browser requests to api.github.com and raw.githubusercontent.com for public repository metadata and exact allowlisted public paths. GitHub receives your IP address and the requested public paths. The repository URL, downloaded file contents and findings are not sent to Tripcord. The check does not use analytics or persist scan data.
The program
Scanning runs on your machine and does not send your files, findings or repository names anywhere. Signing in (tripcord login or the editor extension) sends a device label (your computer's host name) and the country your request came from is recorded with the sign-in attempt; afterwards the program renews its session and re-checks your subscription with the licensing service about every six hours while you are online. It keeps its session in a file in your user configuration folder (owner-only permissions on Linux and macOS), or in VS Code's secret storage for the extension. Like any web request it reveals your IP address to the service and to Cloudflare, which runs it.
The licensing service
It stores your account (the sign-in provider identifier and your email address), your subscription (plan, dates, status and whether it was simulated), your authorized devices (label, creation and last-seen time), your CI tokens (stored only as hashes) and a log of sign-in and device events. Sign-in itself is handled by Google Firebase Authentication (Google, GitHub or email and password) under Google's privacy terms. It does not store card details: during the demo there is no payment at all. Records are kept while the account exists. Write to us to have an account deleted.
Payments
Payments are taken on a hosted checkout page of a third-party payment provider, which collects your billing details under its own privacy policy and may be the seller of record. We do not see or store full card numbers.
If you write to us we keep the conversation so we can answer you and support your license.
Your rights
You can ask us what we hold about you, ask us to correct or delete it, or object to how we use it. Write to georgeotskheli@gmail.com. You can also complain to the data protection authority of your country.