隐私政策
生效日期：2026 年 10 月 3 日
Trip on Points（triponpoints.com，以下称“我们”）提供航空里程兑换机票（奖励票）的查询与提醒服务。本政策说明我们在你使用网站和服务时收集哪些信息、如何使用和保护这些信息，以及你享有的权利。
1. 我们收集的信息
- 账户信息：注册时填写的邮箱地址和密码。密码由 Google Firebase Authentication 以加密哈希形式保存，我们无法看到明文。我们还会记录邮箱是否已验证。
- Google 登录：使用 Google 账号登录时，Google 会向我们提供你的姓名、邮箱地址和头像链接。我们只用邮箱地址识别你的账户。
- 游客浏览：不登录直接浏览时，我们会创建一个不含任何个人信息的匿名标识，用来读取缓存结果。
- 使用数据：你发起的搜索（出发地、目的地、日期、里程计划）、设置的 Alert、credit 余额和使用记录，以及提供服务所需的查询记录。
- 技术数据：托管和云服务提供方在处理请求时自动记录的日志，例如 IP 地址、浏览器类型和访问时间。
- 通信内容：你发送到 support@triponpoints.com 的邮件。
服务目前免费，我们不收集任何支付信息。
2. 我们如何使用信息
- 创建和维护你的账户，提供搜索、Alert 和 credit 等功能；
- 验证邮箱、防止滥用（例如防止用多个账户重复领取免费 credit）、保障服务安全；
- 发送与服务直接相关的邮件，例如邮箱验证和密码重置；
- 排查问题、改进服务。
我们不投放广告，不出售你的个人信息，也不会用你的信息做广告画像。
3. 共享的搜索结果
为减少对航空公司网站的重复查询，奖励票查询结果（航班、舱位、所需里程、税费、余座等航空公司公开的信息）会被缓存，并展示给其他用户。这些结果不包含你的身份信息，其他用户无法知道是谁发起了查询。你的搜索记录、Alert 和 credit 记录只有你本人可以查看。
4. 我们如何共享信息
我们不出售你的个人信息。我们只在以下情况下共享信息：
- 服务提供方：代我们处理数据、并受合同或其服务条款约束的提供方，包括 Google（Firebase Hosting、Authentication、Firestore、Realtime Database、Cloud Functions、Cloud Run，数据中心位于美国）和 Cloudflare（域名解析，以及把发往我们客服邮箱的邮件转发给我们）。
- 查询航空公司网站：我们通过网络代理服务访问航空公司网站以获取公开的奖励票信息。发送出去的只有航线、日期等查询条件，从不包含你的个人信息。
- 法律要求：为遵守法律、法规、法律程序或政府要求，或为保护我们、用户或公众的权利、财产和安全。
- 业务变更：如发生合并、收购或资产转让，你的信息可能随之转移，并继续受本政策约束。
5. Cookie 与浏览器存储
我们不使用广告或分析类 Cookie。我们只在你的浏览器中保存登录状态（由 Firebase Authentication 管理）和你选择的浅色或深色主题。清除浏览器数据后，你需要重新登录。
6. 保存期限
账户存在期间，我们会保存提供服务所需的账户、搜索、Alert 和 credit 记录。你要求删除账户后，我们会在 30 天内删除或匿名化你的个人信息，法律要求保留或为安全、防滥用所必需的信息除外。不含个人信息的共享查询结果可能继续保留。服务提供方的日志按其各自的保存期限处理。
7. 你的权利
你可以要求查看、更正、删除或导出你的个人信息，也可以反对或限制某些处理。请用账户邮箱发信到 support@triponpoints.com，我们会在核实身份后 30 天内回复。
- 欧洲经济区和英国用户（GDPR）：我们处理信息的法律依据是履行与你的服务合同、我们在安全和改进服务方面的正当利益，以及在适用时你的同意。你有权向当地数据保护机构投诉。
- 加州居民（CCPA/CPRA）：你有权了解、删除和更正我们收集的个人信息。我们不出售你的个人信息，也不会为跨场景行为广告而“共享”它。你行使这些权利不会受到区别对待。
8. 数据安全
我们全程使用 HTTPS 加密传输，通过访问规则确保你的私人数据只有你本人可以读取，密码由 Firebase 以哈希形式保存。但任何在线服务都无法保证绝对安全。
9. 跨境传输
你的信息在美国处理和存储。使用本服务即表示你理解你的信息可能被传输到你所在国家或地区以外的地方。
10. 儿童隐私
本服务不面向 13 岁以下儿童，我们不会有意收集儿童的个人信息。如果你认为我们收集了儿童的信息，请联系我们删除。
11. Google 用户数据
使用 Google 登录时，我们只请求基本资料（邮箱和个人资料）用于登录。我们对通过 Google API 获得的信息的使用遵守 Google API 服务用户数据政策，包括其中的“有限使用”要求。
12. 第三方网站
本服务包含指向航空公司等第三方网站的链接。这些网站的隐私做法由其自行负责，请阅读它们的隐私政策。
13. 政策变更
我们可能会更新本政策，并在本页修改生效日期。重大变更会通过网站通知或邮件告知你。
14. 联系我们
如有任何隐私问题，请发邮件至 support@triponpoints.com。
本政策提供中文和英文版本，两者如有不一致，以英文版本为准。
Privacy Policy
Effective date: October 3, 2026
Trip on Points (triponpoints.com, “we”, “us”) helps travelers search for and monitor airline award (frequent-flyer) seat availability. This policy explains what information we collect when you use our website and services, how we use and protect it, and the rights you have.
1. Information we collect
- Account information: the email address and password you register with. Passwords are stored by Google Firebase Authentication as salted hashes; we never see them in plain text. We also record whether your email address is verified.
- Google sign-in: if you sign in with Google, Google provides your name, email address and profile picture URL. We use only your email address to identify your account.
- Guest browsing: if you browse without an account, we create an anonymous identifier with no personal information so you can read cached results.
- Usage data: the searches you run (origin, destination, dates, loyalty programs), the alerts you set, your credit balance and usage, and the request records needed to deliver the service.
- Technical data: logs that our hosting and cloud providers record automatically when handling requests, such as IP address, browser type and access time.
- Communications: emails you send to support@triponpoints.com.
The service is currently free, and we do not collect payment information.
2. How we use information
- to create and maintain your account and provide searches, alerts and credits;
- to verify email addresses, prevent abuse (for example, claiming free credits through multiple accounts) and keep the service secure;
- to send service emails such as email verification and password resets;
- to troubleshoot problems and improve the service.
We do not show ads, do not sell your personal information, and do not use it for advertising profiles.
3. Shared search results
To avoid repeating queries to airline websites, award search results (flights, cabins, miles, taxes and seats that airlines publish) are cached and shown to other users. These results contain no information about who you are, and other users cannot see who ran a search. Your search history, alerts and credit records are visible only to you.
4. How we share information
We do not sell your personal information. We share it only:
- with service providers that process data on our behalf under contract or their service terms, including Google (Firebase Hosting, Authentication, Firestore, Realtime Database, Cloud Functions and Cloud Run, in United States data centers) and Cloudflare (DNS, and forwarding email sent to our support address);
- when querying airline websites: we use network proxy services to fetch publicly available award availability. Only search criteria such as route and date are sent, never your personal information;
- for legal reasons: to comply with laws, regulations, legal process or government requests, or to protect the rights, property and safety of us, our users or the public;
- in a business transfer: if we are involved in a merger, acquisition or asset transfer, your information may be transferred and will remain subject to this policy.
5. Cookies and browser storage
We do not use advertising or analytics cookies. We store only your sign-in session (managed by Firebase Authentication) and your light or dark theme choice in your browser. Clearing your browser data signs you out.
6. Retention
While your account exists, we keep the account, search, alert and credit records needed to provide the service. When you ask us to delete your account, we delete or anonymize your personal information within 30 days, except information we must keep by law or need for security and abuse prevention. Shared search results that contain no personal information may be retained. Provider logs follow those providers’ retention periods.
7. Your rights
You may ask to access, correct, delete or export your personal information, or object to or restrict certain processing. Email support@triponpoints.com from your account email address; we will respond within 30 days after verifying your identity.
- EEA and UK users (GDPR): we process information to perform our contract with you, for our legitimate interests in security and improving the service, and, where applicable, with your consent. You may lodge a complaint with your local data protection authority.
- California residents (CCPA/CPRA): you have the right to know, delete and correct the personal information we collect. We do not sell your personal information or share it for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.
8. Security
We use HTTPS throughout, access rules that let only you read your private data, and password hashing by Firebase. No online service can guarantee absolute security.
9. International transfers
Your information is processed and stored in the United States. By using the service, you understand that your information may be transferred outside your country or region.
10. Children’s privacy
The service is not directed to children under 13, and we do not knowingly collect their personal information. If you believe we have, please contact us and we will delete it.
11. Google user data
When you sign in with Google, we request only basic profile scopes (email and profile) to sign you in. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
12. Third-party websites
The service links to third-party websites such as airlines. Their privacy practices are their own; please read their privacy policies.
13. Changes to this policy
We may update this policy and will change the effective date on this page. We will tell you about material changes through a notice on the website or by email.
14. Contact us
For any privacy question, email support@triponpoints.com.
This policy is provided in Chinese and English. If the two versions differ, the English version prevails.