Privacy Policy

TripBalls ("we", "us", "our") is a sports fan travel planning tool. This policy explains what information we collect when you use tripballs.now, how we use it, who else sees it, and your rights. By using TripBalls, you agree to this policy. Our concert side, TripBalls Gigs, has its own policy.

1. Information We Collect

No account, no profile

TripBalls has no sign-up and no accounts. The teams you follow, your home airport, party size, saved games, map and date-window settings and other preferences are stored in your browser's local storage. They are sent to our servers only as the parameters of the request they describe — for example, your home airport code when a game's booking panel asks for a flight price — and are not stored there as a profile of you.

Request data

Like every website, our servers see your IP address and browser user-agent on each request. We use them to serve the page, for rate limiting and abuse prevention, and to tell automated traffic from fans; that check happens in memory as the request is handled. Cloudflare, our CDN, tells us your approximate country and, for some requests, approximate coordinates; we use the country to show the cookie consent prompt where the law requires one and to pick the right regional booking partner, and the coordinates only to suggest a nearby home airport (see below). We do not store the raw IP address.

What our analytics records keep depends on where you are and what you chose:

• Outside the EU, UK, EEA and Switzerland, or there with your consent — a truncated form of your IP address (the first three octets, which identify a network and not a device), a one-way hash of the full address (the first 16 characters of a SHA-256 digest), your browser's user-agent and its viewport size.
• In the EU, UK, EEA and Switzerland, until you accept the cookie prompt (or after you decline it) — none of those. Each record keeps only what happened (the page, the event, the traffic source) and your approximate country, so we can still count visits; it cannot be linked to your device, your network or your other visits.

Home airport suggestions

To save you typing, when you have not chosen a home airport we suggest one from your approximate location. In the app and on our guide pages this happens when the page loads: the nearest airport (in North America, within about 250 miles of you) is saved in your browser, marked as our suggestion, shown on the page, and used for flight links and prices until you change or clear it. Some sign-up forms pre-fill a nearby major airport, also from your approximate location; the suggestion is shown to you before anything is submitted, and when we store an airport with an email address we record whether it was our guess or your choice. When you open a booking link in one of our emails we may infer your approximate location from your IP address and remember the nearest airport so later emails can quote flight prices — only when you have not already chosen one yourself, and never the airport of the city the game is in. You can change it any time from the link in the footer of any of our emails. Visitors from the EU, UK, EEA and Switzerland are never sent their approximate location and never get a suggested or remembered airport; they choose their airport themselves.

Email sign-ups

When you sign up for emails — an NFL or college football team's game-week emails, a schedule notice, a trip email from a game's booking panel, or a game reminder — we collect your email address, the team or game you chose and, optionally, your home airport. For a sign-up that arrived from an ad or a shared link we also record how you got here (the utm_ campaign parameters, the landing page and the game you were looking at) so we can tell which campaigns fans actually use. We record whether you opted in to marketing. For every email we send we keep a record of the address, the game, the email type and whether it was delivered.

Usage and analytics

We record how the site is used so we can improve it:

• Page views — the URL, the page type (map, guide, schedule, and so on), sport, team, traffic source (organic, paid, social, direct) and approximate country; with the user-agent and truncated IP address only where described under "Request data" above.
• Events — opening a game, clicking a booking link, saving, sharing. For a booking click we record the sport, the booking type (tickets, flights, hotels, parking, rental car), the partner, the page it came from, the referring page and, for a click arriving from an ad, the ad identifiers described under "Advertising" below. In the EU, UK, EEA and Switzerland without your consent, a booking click keeps the referring site's name only (not the full address) and no ad identifiers, user-agent or IP-derived value.
• Traffic source — we capture utm_ parameters and ad click identifiers (fbclid, gclid) from marketing links when you arrive. The campaign parameters of your first visit are kept in your browser for 30 days, and the rest for the browser session, so a booking you make later can be attributed to the channel that brought you. In the EU, UK, EEA and Switzerland they are written to your browser only after you accept the cookie prompt; until then the page holds them in memory and forgets them when you leave it, and booking links carry no fbclid.
• Session stitching — to connect the events of one visit we derive a fingerprint from the hashed IP address, the user-agent (truncated to 320 characters), the approximate country and the browser viewport size. Records made in the EU, UK, EEA or Switzerland without your consent carry no fingerprint beyond the country and are not linked to an email you signed up with, and your browser does not send its viewport size with them. (Price and booking requests from our pages carry the viewport size everywhere, so we can tell automated traffic from fans; it is checked as the request arrives and never stored.) The fingerprint is used only for analytics within TripBalls, never for cross-site tracking, and these events are deleted after 90 days.

Flight prices

When you open a game's booking panel we ask KAYAK for a flight price from your home airport. KAYAK requires the visitor's IP address and user-agent with each query, so we forward both. The fare itself is cached on our servers for a few days without any visitor information, so the next fan asking the same route reads the cached price. Flight prices are fetched only when a person asks; automated visitors never trigger one.

2. Cookies and Local Storage

We use the following cookies and browser storage. Nothing listed here identifies you by name.

You can clear everything we store in your browser from the preferences panel ("Clear all data") or through your browser's settings. Doing so resets your preferences and nothing else.

3. Third-Party Services

Analytics

• Google Analytics 4 — page views and events, as described above. Governed by Google's Privacy Policy. For visitors in the EU, UK, EEA and Switzerland it loads only after you accept the cookie prompt. We do not send Google your email address.

Advertising

We advertise TripBalls on Google, Facebook and Instagram. Google ads are measured by the same Google tag that runs Google Analytics, which also tells our Google Ads account about your visit when you arrived from one of its ads; in consent regions it loads only after you accept the cookie prompt. Facebook and Instagram ads are measured two ways:

• Meta Pixel — a script in the page that reports page views and booking clicks to Meta. Governed by Meta's Privacy Policy; in consent regions it loads only after you accept the cookie prompt.
• Meta Conversions API — our server also reports three kinds of event directly to Meta: a booking click, sent with your IP address, user-agent and the Meta click and browser identifiers (fbc, fbp) when present; a ticket purchase our affiliate network attributes to that click, sent with the identifiers and user-agent stored with the click; and an email sign-up, sent with a SHA-256 hash of the email address so Meta can match it to an ad you saw. We never send Meta the address itself, and we never log the hash. In the EU, UK, EEA and Switzerland none of these reports is sent unless you have accepted the cookie prompt.

Affiliate networks

• Impact — the affiliate network behind our Ticketmaster and Vivid Seats links. Its publisher tag may load in the page to record that you saw a link (in consent regions only after you accept the cookie prompt), and when you click a ticket link Impact records the click to attribute any commission. When a purchase is attributed to us, Impact sends us the order amount, our commission and the campaign and page identifiers we attached to the link — never the buyer's name or address.
• KAYAK — hotel listings and flight prices come from KAYAK's affiliate API (see "Flight prices" above). Governed by KAYAK's Privacy Policy.

Booking partners

When you click a booking link you leave our site for one of these partners, each with its own privacy practices:

• Vivid Seats — tickets and parking passes
• Ticketmaster — tickets
• SeatGeek — tickets
• KAYAK — flights, hotels and rental cars
• Expedia — hotels, where KAYAK has no listing
• SpotHero — parking, where no parking pass is sold (a plain link; we have no affiliate relationship with SpotHero)

We earn an affiliate commission when you buy through these links, at no cost to you. Links carry contextual parameters to pre-fill the search — the game, the dates, the airports and the party size — plus attribution identifiers that tell the partner the click came from TripBalls and which of our pages or emails it came from. Nothing in a link identifies you by name or email.

Content and images

• OpenStreetMap — the map loads its tiles from OpenStreetMap's servers, which see your IP address and the area you are looking at, under the OSM Foundation's Privacy Policy.
• Google Fonts — some pages load their typefaces from Google's font servers, which see your IP address.
• Unsplash — the image shown when a page is shared on social media is loaded from Unsplash's CDN by the platform's preview fetcher, and occasionally by your browser.

Infrastructure

• Cloudflare — CDN and DDoS protection. Every request passes through Cloudflare's network, which forwards your IP address, approximate country and approximate coordinates to us.
• Railway — hosting for our application and database, in the United States.
• Resend — email delivery. Your address is passed to Resend to send the emails you asked for. Resend records whether an email was delivered, opened and which links were clicked, and we read those records to see which emails are useful. Open tracking is a tiny image in the email; many mail apps block or preload it, so we treat it as rough.
• Anthropic — we use Claude to draft editorial content and summarise our own analytics. No visitor email address or identifier is sent to it.

4. How We Use Information

• To show your team's games and build booking links around your home airport and party size
• To quote ticket, hotel and flight prices for a trip
• To send you the emails you asked for, and marketing emails only if you opted in
• To measure which features and pages are used and improve the site
• To attribute affiliate commissions and ad spend to the traffic source that earned them
• To tell automated traffic from fans, and to detect and prevent abuse

We do not sell personal information.

5. Data Retention

• Your preferences — in your browser, until you clear them
• Email sign-ups and the emails we sent you — until you unsubscribe or ask us to delete them; an unsubscribed address is kept only to honour the unsubscribe
• Game reminders — until the game has passed
• Session events (with the hashed fingerprint where one is recorded) — deleted after 90 days
• Page views (with the truncated IP and user-agent where they are recorded, and the country) — deleted after 90 days
• Booking clicks (the partner, campaign and page identifiers, and where recorded the truncated IP, hashed IP, user-agent, referring page and ad identifiers) — deleted after 90 days. A commission our affiliate network reports later keeps its own amount and campaign identifiers
• Flight fares — priced by route and date only, no visitor data, pruned after 7 days
• Raw IP addresses — not stored; forwarded to KAYAK and Meta only as described above

6. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you rights over your personal information. TripBalls does not sell personal information. Reporting a booking click or a hashed email sign-up to Meta for ad measurement may count as "sharing" for cross-context behavioural advertising under the CPRA; you can prevent it by declining the cookie prompt where it appears, by blocking the Meta Pixel with a browser extension, or by emailing us. Your rights include:

• Right to know — the categories and specific pieces of personal information we have collected, the sources, the purpose and the third parties we share it with
• Right to delete — deletion of the personal information we hold, subject to legal exceptions
• Right to opt out of sale or sharing — as described above
• Non-discrimination — we will not treat you differently for exercising these rights

To exercise these rights, email [email protected]. We will respond within 45 days.

7. Your Rights and Choices

• Access and portability — you can request a copy of the data we hold about your email address
• Deletion — you can request deletion of any data we hold about you at any time
• Email opt-out — every email includes an unsubscribe link, and you can also email us
• Cookie and analytics opt-out — in the EU, UK, EEA and Switzerland, decline the cookie prompt or use "Cookie Settings" at the bottom of the page to withdraw consent. Anywhere, clearing your browser storage removes everything we keep there, and a browser extension such as uBlock Origin blocks Google Analytics and the Meta Pixel. We do not currently act on the browser's Do Not Track or Global Privacy Control signals.

To exercise any of these rights, email [email protected].

8. Data Security

• All traffic is encrypted over HTTPS
• IP addresses are truncated or hashed before storage; the raw address is never persisted
• Database access is restricted to our application servers; administrative endpoints require a secret

No system is perfectly secure. If you believe your data has been compromised, contact us immediately.

9. Children's Privacy

TripBalls is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe we have, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time and will change the effective date at the top of this page when we do. Continued use of the site after a change constitutes acceptance of the updated policy.

11. Contact

Questions or requests about your privacy: [email protected].

See also: Terms of Service