Skip to main content
tripcost

Privacy policy

Last updated: 22 September 2026

We collect as little as possible. Here's exactly what, why, and what you can do about it.

What we collect

Anonymous analytics

We use Google Analytics 4 (GA4) to understand how people use the site: which routes are popular, which pages people visit, and how traffic changes over time. GA4 data is anonymised; we cannot identify individual visitors. GA4 sets cookies (see below).

Your account (optional)

The planner works without an account. If you sign in, you do it with your email address and a 6-digit code we email you (it expires after 5 minutes); there is no password. We store your email address and, for each signed-in session, the IP address and browser details (user agent) of the device you signed in from. Account data is kept in our database on Cloudflare (D1), in Cloudflare's Western Europe region. Sign-in codes are sent through ZeptoMail, Zoho's transactional email service.

Saved trips (signed-in accounts)

When you save a trip, we store it with your account on our servers: the start and end places, vehicle, fuel grade, region, passengers, round-trip choice, any fuel consumption you set, and your label for the trip. If you mark a trip completed, we also store the date and its cost figures at that day's prices (distance, drive time, litres, fuel, tolls, total and estimated CO₂). Your account settings hold your monthly travel budget, if you set one, and your fuel-price email choice. You can delete any saved trip on your account page, and download your completed trips as a CSV file, which is built in your browser.

Fuel-price emails (opt-in, off by default)

If you switch on "Email me when the fuel price changes" in your account, we email you after each monthly fuel-price change with what your active (not yet completed) saved trips cost at the new price. These emails go out through ZeptoMail. Every one carries a one-click unsubscribe link that works without signing in, and you can switch them off in your account at any time.

Recent trips (this browser only)

The planner remembers the last 5 routes you calculated (start and end place only) so you can rerun them with one tap. This happens automatically, and the list lives in your browser's localStorage under the key tripcost.recent. It never leaves your device and is not sent to our servers. Your theme choice (tripcost.theme) and cookie-banner choice (cookie-consent) are stored the same way. Clear them at any time by clearing this site's data in your browser settings.

Contact-form messages

When you use the contact form, we receive your email address, your name if you give it, the reason you picked, and your message. We forward it throughZeptoMail to our own inbox so we can reply; it is not saved in our site database. The message text is also sorted automatically, as described below.

Automated message sorting

When you send us a message through the contact form, the message text and the reason you picked are passed to an automated classification service (TypeSafe's Jev model, run through Cloudflare's network) that labels it as spam or genuine and assigns it a category. Today those labels are only recorded in a log so we can measure how accurate they are — they do not route, filter, prioritise, or otherwise act on your message. Your name and email address are not sent to that service, and the labels are not used to make any decision about you. Both TypeSafe's privacy policy and Cloudflare's Workers AI documentation say this input is not used to train AI models.

What we don't collect

  • Our routing and toll data providers do not receive any personally identifiable information (PII): route lookups run on our server and send them place coordinates only. The one exception is the route map, whose tiles your browser loads straight from OpenStreetMap's tile servers (and label fonts from demotiles.maplibre.org), so those servers see your IP address and the part of the map you view.
  • We do not sell, rent, or share your data with advertisers or data brokers.
  • We do not track you across other websites.
  • We do not collect payment information (we never process payments on this site).

Cookies

We use three categories of cookies, with different consent treatments:

  • Google Analytics 4, for anonymous usage measurement. Gated behind the cookie banner: GA4 loads in a denied-by-default state via Google Consent Mode v2 and only writes cookies after you click Accept. Cookies are named _ga and _ga_* and expire after 2 years.
  • Sign-in session, only if you sign in. A strictly necessary cookie named __Secure-better-auth.session_token keeps you signed in. It is not used for tracking, so it does not wait for the cookie banner. It lasts up to 7 days and is renewed while you use the site; signing out removes it.
  • Stay22, an accommodation-affiliate script (loaded from scripts.stay22.com) that routes clicks on accommodation links through Stay22 so we can earn a commission from Booking.com / Hotels.com / Expedia / Vrbo. Gated behind the cookie banner like GA4: it loads only after you click Accept, and only on pages with accommodation links. Once loaded, it stores a visitor ID and a session ID in your browser's localStorage (keys such as visitor_id_id22 and sid22) and contacts Stay22's servers. It does not change any page content, only where accommodation links go. If you book, the booking site sets its own cookies under its own privacy policy.

We do not use retargeting pixels or session-recording tools. We do not sell your personal information.

You can opt out of GA4 tracking by installing the Google Analytics Opt-out Browser Add-on or by using a browser with tracking protection enabled.

Advertising

We don't run ads on this site. The advertising signals in Google Consent Mode v2 (ad storage, ad user data and ad personalisation) are set to denied, and the cookie banner never changes them.

Affiliate links

Some links on this site (to accommodation or car rental) are affiliate links. If you click one and make a purchase or enquiry, we may earn a commission at no extra cost to you. Affiliate links are disclosed wherever they appear. They do not affect our editorial recommendations.

Active affiliate partners as of May 2026: DiscoverCars (car rental, deep-link with our affiliate ID), Stay22 (accommodation, click-time link rewriter to Booking.com / Hotels.com / Expedia / Vrbo). We do not load any third-party affiliate scripts that modify the content of the page you are reading; the only scripted affiliate integration is the Stay22 link rewriter described in the Cookies section, which acts only on accommodation links at click time.

Your rights under POPIA

The Protection of Personal Information Act (POPIA) gives South African residents the following rights with respect to their personal information:

  • Right to access: you can request a copy of the personal information we hold about you. If you have an account, your saved trips are on your account page, and you can download your completed trips as a CSV file there.
  • Right to correction: you can ask us to correct inaccurate information.
  • Right to deletion: you can ask us to delete your personal information, including your whole account. You can delete individual saved trips yourself on your account page; there is no self-serve button to delete the account itself, so ask us via the contact page. Deleting an account removes its saved trips, settings and sign-in sessions with it.
  • Right to object: you can object to the processing of your personal information at any time.

To exercise any of these rights, get in touch via the contact page with your request. We will respond within 30 days.

Cookie consent

When you visit tripcost.co.za for the first time, a banner at the bottom of the page asks whether you accept or decline cookies. Your choice controls two things:

  • GA4 loads in a denied-by-default state via Google Consent Mode v2 and only writes cookies or sends measurement events after you click Accept.
  • Stay22 (the accommodation-link script described above) loads only after you click Accept. If you decline, accommodation links still work but go straight to the booking site.

What we collect when you accept

  • Anonymous pageview events (page URL, referrer, country; IP address is not stored). On the planner and route pages the page URL includes the start and end places, e.g. /plan?from=…&to=…
  • Affiliate-link click events: which partner and placement, plus the trip's rounded total cost, vehicle type, distance and drive time; no personal information is included
  • On pages with accommodation links: Stay22's visitor and session IDs in localStorage, and the page's requests to Stay22's servers

What does not happen

  • No ad personalisation; GA4 is configured with IP anonymisation enabled
  • No cross-site tracking or remarketing audiences
  • No data is shared with Google Ads or any advertising network

How to opt out or change your mind

  • Clear your browser's localStorage for tripcost.co.za (the key is cookie-consent). The banner will reappear on your next visit and you can choose Decline.
  • Install the Google Analytics Opt-out Browser Add-on for a browser-wide opt-out regardless of stored consent.

Data retention

  • Your account, saved trips and settings are kept until you delete them or ask us to delete your account.
  • Sign-in codes expire after 5 minutes. A sign-in session lasts up to 7 days and is renewed while you use the site; signing out ends it. An expired session record (with the IP address and browser details it holds) is deleted the next time that browser presents it, or when your account is deleted. There is no scheduled clean-up, so a session from a browser that never comes back stays until then.
  • Contact-form messages are kept in our email inbox for up to 12 months after the conversation ends, then deleted. They are not stored in the site database.
  • To block abuse, we count requests to sign-in, the contact form and the planner per IP address (and sign-in code requests per email address too). These counters are held in Cloudflare KV and expire after at most 10 minutes.
  • Our server logs (Cloudflare Workers Logs) record errors and the contact-form sorting labels; when a contact-form send fails, they also record your IP address. Browser security reports (content-security-policy violations) are logged with the address of the page they came from, which on the planner includes the start and end places. Cloudflare keeps these logs for no longer than 7 days.
  • GA4 keeps event data for 2 months.
  • localStorage data exists only on your device and is under your control.

Our service providers store and process data outside South Africa: account data in Cloudflare's Western Europe region, server logs and abuse counters on Cloudflare's network, email through Zoho (ZeptoMail), analytics with Google, and accommodation-link tracking with Stay22.

Changes to this policy

If we make material changes to how we handle personal information, we'll update this page and change the "last updated" date at the top.

Contact

Responsible party: tripcost.co.za
Questions or requests? Use the contact page.