隱私權聲明
樂園行前小幫手 (ThemeParkHelper) 由武源國際有限公司 (WY Internet INC.) 經營。本聲明說明本應用程式如何處理資料；YourDisney 編輯網站有各自的隱私權聲明。
1. 蒐集者與聯絡方式
武源國際有限公司 (WY Internet INC.)，104626臺北市中山區民權西路20號2樓。隱私權聯絡方式：reply@themeparkhelper.app。
2. 在瀏覽器中規劃行程
選擇入園日期，就能查看時程並匯出行事曆，不需要帳號或電子郵件。你也可以選擇留下電子郵件並確認，將行程儲存在伺服器，使用私人行程連結與訂閱式行事曆。儲存時可選擇是否接收行前提醒；第7節說明儲存與郵件資料的用途及保存期間。
你輸入的入園日期、住宿安排與狀態、選填的同行人數與年齡區間 (整趟行程共用)，以及準備進度，用於在瀏覽器中計算與顯示時程。工具也會保存時區、隨機識別碼與行事曆匯出紀錄，以維持行程與事項的對應，並顯示匯出後的變更。匯出紀錄不代表你已匯入行事曆或收到提醒。
住宿區的「官方飯店」、「非官方飯店」與「還沒決定」共用一組選填的入住與退房日期。你按下儲存後，這組日期會隨本機行程保存，切換住宿選項時也會保留；你可以修改或清除。官方與非官方飯店可分別標記已訂房；切換住宿類別時，已訂房狀態會重設。
每個入園日都可以另外標記「已經買好了」，以隱藏該日的購買方式並顯示入園預約連結。這項確認只會在你主動選擇後隨本機行程保存；門票持有標記、門票類型與更改標記所需的本機紀錄不會上傳，儲存行程時只保存由此產生的一般事項準備進度。購買連結的點擊、既有事項進度與舊行程轉換都不會自動標記你已有門票。你可以更改標記；更換或移除該入園日時會清除對應標記。標記已有門票不代表已完成入園預約。
證件準備事項直接顯示確認指引，不再先詢問是否加入。你可以選擇「標記完成」、「不需要這個提醒」或「更改」；「已完成」只代表你自行確認，不代表我們查核或確認你符合入境資格。先前保存的加入或略過選擇會保留在既有行程中。瀏覽器允許時，這些選擇與準備進度會隨本機行程保存，不會加入使用分析。
我們不要求國籍、持有哪些證件、證件號碼、姓名、精確年齡或出生日期。同行人數按年齡區間記錄，整趟行程共用同一組資料，不建立個人名單。
選填資料可以留白；未提供不會被當成「否」，需要相關日期或資料的事項會保留尚未提供或未知的狀態。封鎖瀏覽器儲存時仍可計算與匯出，但重新整理或離開後可能無法保留輸入。
3. 本機保存與清除
瀏覽器允許時，行程保存在本應用程式的本機儲存空間 (themeparkhelper.local.v1)。未提交儲存申請的行程不會上傳成伺服器備份，也不會與 YourDisney 網站、其他瀏覽器或裝置同步。本機儲存不保存電子郵件或私人連結的存取憑證。
行程保留至最後一個已輸入日期加90天的整個UTC日期結束；這個日期包含已提供的入園、住宿入住與退房日期。工具會在期限過後的下次載入時刪除本機行程；瀏覽器未開啟時不會背景執行刪除。時區或另一筆行程不會延長期限。你也可以使用工具的清除功能或瀏覽器的清除網站資料功能。
工具會在裝置上記住你明確選擇的行程時區與當時的裝置時區 (themeparkhelper.zone-kept)，以減少重複詢問。這份紀錄自你明確選擇時起保留90天，再次瀏覽不會延長期限。到期後不再使用，並在下次使用工具時清除；瀏覽器未開啟時不會背景執行刪除。行程與裝置時區不同時，工具才可能再次詢問。
關閉儲存提示時，工具會記住當時已處理的事項數量 (tph_save_nudge)，只保留在目前的分頁工作階段。提示只會在你處理事項後出現，不會因載入頁面而出現。工具的清除功能會清除這兩份紀錄。它們不含電子郵件或私人連結，也不會隨行程上傳。
清除網站資料可能使原有本機行程無法取得。這不會刪除伺服器上的已儲存行程、已分享給他人或匯入其他行事曆服務的副本。已儲存行程可使用其私人連結刪除，詳見第7節。
4. 分享與行事曆
分享連結在網址的 # 後帶入入園日期；只有你主動勾選時，才附上整趟行程共用的同行人數與年齡區間。分享預覽讓你先確認內容。連結不包含住宿、證件選項、準備進度、門票持有標記、時區或原行程的識別碼。
收到完整分享連結的人可以讀取其中資料並建立自己的行程副本。這段網址不會隨一般頁面請求傳給網站伺服器，但頁面上的程式可以讀取；我們不另行保存分享內容。請只分享你願意提供的內容，並留意收件人可以保留或轉傳連結。清除你的行程不會撤回分享。
下載行事曆會在裝置上產生檔案。選擇加入 Google 行事曆或將檔案匯入其他服務時，該服務會收到相應的事件日期與內容，並依其隱私權政策處理。從已儲存行程頁面加入或下載的事件會附上私人行程連結；選擇「加入 Google 日曆」時，加入連結會把這個連結一併傳給 Google。
已儲存行程的私人連結和上述分享連結不同：持有私人行程連結的人可以查看、修改或刪除該行程，並在符合條件時開啟行前提醒。確認、取消訂閱及找回行程連結各有自己的用途。請妥善保管這些連結；私人行程連結不是需要登入的帳號。
訂閱式行事曆使用另一個私人連結，列出行程的行事曆事件。每個事件都附上私人行程連結，所以看得到這份訂閱行事曆的人，都可以開啟、修改或刪除行程；請只把訂閱行事曆分享給你願意提供行程連結的人。訂閱連結本身不能取得確認、取消訂閱或找回行程的存取權。行事曆服務會定期向我們取得事件內容；更新時間由該服務決定。刪除行程或期限屆滿後，該連結只會回傳沒有事件的空白行事曆，訂閱的事件通常會在行事曆服務下次更新時消失；已下載或匯入的副本仍由你或行事曆服務保管。
5. 使用分析與 Cookie
首頁與規劃頁使用樂園行前小幫手專用的 Google Analytics 統計使用情形，包含首次造訪、工作階段、互動及經過處理的操作事件，例如產生時程、匯出行事曆、在公開規劃頁開始儲存行程或點選飯店連結。開始儲存的事件只記錄操作，不包含電子郵件或儲存申請內容，也不代表已確認儲存。兩種語言都不顯示 Cookie 同意橫幅。位於歐盟、歐洲經濟區、英國、部分排除地區或無法判斷地區時，不載入 Google 分析程式，也不傳送分析事件。瀏覽器透過「全域隱私控制」 (GPC) 或「不追蹤」 (DNT) 拒絕記錄時，同樣不啟用。
瀏覽器會向本應用程式確認所在地區是否適用。回應只有「允許」或「不允許」，不包含國家資訊；這項檢查不設定 Cookie，國家資訊不會加入工具的使用分析事件。服務供應商的連線與安全處理仍可能涉及 IP 位址及地區。
操作事件包含事件名稱、隨機產生的事件與行程識別碼、樂園、語言，以及不含查詢字串或 # 之後內容的頁面網址。視操作而定，也可能包含來源類別、事項或操作類別、概略的住宿狀態、顯示或選擇的官方飯店、飯店連結選項，以及行程建立的類別與週別。週別是瀏覽器嘗試記錄行程建立事件時所屬的UTC週一日期，不是你輸入的旅遊日期。識別碼不由日期或個人資料推算。我們不將實際入園、搜尋或住宿日期、同行者資訊、證件選項或證件事項的準備進度、門票持有標記、電子郵件或輸入文字加入分析事件，也不自動收集表單內容或連結點擊內容。本隱私權聲明、服務條款、確認、私人行程、取消訂閱與找回行程頁面，以及儲存申請與行事曆訂閱請求均不載入分析程式，也不傳送分析事件。
若你儲存行程，伺服器上的行程紀錄也會保留分析事件使用的隨機行程識別碼 (attribution_id)，以及你提交的電子郵件與行程資料。因此，允許傳送的分析事件可透過這個識別碼與已儲存行程對應。
Google 可能設定 Cookie、使用識別碼及處理瀏覽器與連線資訊，包括城市層級的地區、瀏覽器版本、裝置品牌與型號、作業系統及螢幕解析度。我們已關閉此專用分析資源的廣告個人化與 Google 信號功能。從 YourDisney 前往本應用程式時，Google 的跨網站連結參數可在允許分析的情況下延續工作階段；行程分享內容不會因此加入分析。網址中的 UTM 行銷參數會在 Google 初始化前移除，不保存或回報其值。
工具在瀏覽器保存名為 tph.analytics.v1 的分析紀錄，以避免重複計算同一事件，內容包含隨機行程識別碼、重複計算標記、行程建立的週別與類別，以及到期時間。建立類別區分新行程、預先帶入日期的行程與分享副本。在同一瀏覽器有有效且持續保存的建立紀錄時，符合條件的首次操作可記錄一次行程用途事件 (trip_useful)，並使用原建立週別與類別；建立標記超過90天後不再記錄這項事件。每個標記在90天內到期；新增需要避免重複計算的事件時，行程紀錄的90天期限可能更新。過期紀錄會在下次允許使用瀏覽器儲存空間時清除。GPC／DNT 拒絕或撤回可用的統計同意時，也會清除這份紀錄。你也可以清除網站資料或在瀏覽器封鎖 Cookie。
Google Analytics 的使用者與事件資料保存期間設定為2個月，不因新活動重設；此設定不限制標準彙總報表的保存時間。Google Analytics 是瀏覽器使用分析的唯一接收服務；我們不另行建立第一方使用分析資料庫。即使不記錄使用分析，時程、行事曆匯出、列印及分享仍可使用。Google 的處理方式請見隱私權政策。
6. 合作購買與訂房連結
本應用程式可能顯示合作平台的購買或訂購連結，涵蓋飯店、樂園門票與尊享卡、餐券、機票及交通票券，平台包括 Klook、KKday 與 Trip.com；各語言介面顯示的平台可能不同。除下段所述的訂房連結外，這些連結只帶入樂園行前小幫手的公開合作帳號參數，不帶入行程識別碼、日期、同行者、證件選項、門票持有標記或準備進度。點選連結不代表已購買或訂購。
點選合作訂房連結時，連結會帶入用於佣金歸屬的隨機行程識別碼 (attribution_id)，以及你自行儲存的完整入住與退房日期 (如有)。這是第5節允許傳送的分析事件使用的同一個識別碼，可將同一行程的訂房連結與分析事件相互對應；它是假名識別碼，不是匿名資料。不會自動帶入入園日期，也不會帶入同行者、證件選項或準備進度。
Trip.com 連結直接使用其合作計畫；Agoda 與 Booking.com 訂房連結透過 Stay22，Booking.com 訂房連結只在英文介面顯示。Klook、KKday、Trip.com、Stay22 及最後訂購平台會接收連線所需資訊，並依其政策處理 Cookie、後續瀏覽與訂購。請見 Trip.com 隱私權政策、Stay22 隱私權政策，以及你前往的平台政策。
7. 已儲存行程、郵件、服務供應商與保存期間
你主動提交儲存申請時，我們會接收電子郵件與當次選擇的行程資料。保存內容包括入園日期、住宿安排與已提供的日期、選填的同行人數與年齡區間、語言與提醒時區、工具提供的選填準備選項、準備進度、隨機行程與行事曆識別碼、合作訂房歸屬識別碼，以及是否開啟行前提醒。確認時間、取消訂閱狀態、版本與修改紀錄用於保護存取、處理行程更改並避免重複寄信；不會以電子郵件建立帳號、跨行程偏好或研究資料。
儲存時，你可以選擇接收行前提醒，或只儲存行程。無論選哪一種，都需要透過確認信完成確認；確認後會收到一封附有私人行程連結的郵件。選擇只儲存行程時，行前提醒會保持關閉；你日後可以在私人行程頁主動開啟。確認後更改入園日期時，也可能收到列出新日期與私人行程連結的更新郵件，包括只儲存行程的情況。更新郵件處理的是你自己的日期更改，不是監測樂園、飯店或外部規則的變動。
你更改已確認行程的入園日期後，我們會使用你的電子郵件地址及入園日期，安排在最後一次更改約30分鐘後寄送日期更新郵件。只儲存行程、不接收行前提醒的行程也適用。每個行程最多有一封待寄的日期更新郵件，取消訂閱會取消待寄郵件。我們會暫時保留郵件所記載的樂園及入園日期，以處理重試及比對日期是否已還原；這些紀錄適用郵件紀錄的保存與刪除規則。
行前提醒依你選擇並確認的行程與已啟用事項寄送。郵件不含合作購買廣告。我們保留最少的寄送狀態、內容版本、寄送參考日期與事項內容，以處理重試並避免重複寄送；不在應用程式資料庫保存完整郵件本文或原始供應商回報。寄送內容可能包含入園日期與私人連結，會交由 Resend 寄送。驗證過的送達、退信與投訴回報，用來協助郵件正常寄送，並避免寄送不受歡迎的郵件；這些回報不代表你讀過郵件。
截至2026年10月9日，Resend 的開信與連結點擊追蹤都已關閉。先前在開信追蹤啟用時寄出的郵件可能仍含有與該封郵件對應的透明圖片；圖片載入時，Resend 可將載入紀錄與郵件及收件人對應。關閉追蹤不會刪除先前寄出郵件的追蹤資料。這類紀錄不能證明你讀過郵件。本應用程式資料庫不保存開信或點擊事件，也不以開信率決定提醒或評估工具用途。
確認連結的有效期限為本次確認申請建立後48小時，需要你在頁面按下確認。未確認的行程與電子郵件在期限後失效並由清理作業刪除。確認後的行程、電子郵件、住宿與準備資料保留至最後一個已提供的入園、住宿入住或退房日期加90天的整個UTC日期結束。更改同一行程會重新計算這個日期；建立另一筆行程或申請找回連結不會延長期限。期限過後即無法透過私人頁面、行事曆或找回功能取得，伺服器清理作業會刪除資料。
你可以使用取消訂閱連結，在頁面確認後停止該行程的所有郵件，包括行前提醒與日期更新郵件。取消後仍可使用已儲存行程與行事曆訂閱，但無法再為同一行程開啟行前提醒。尚未確認的行程沒有可取消的訂閱；未完成確認時，既有確認信的重試可能繼續至寄送期限，不會延長48小時的確認期限。已交給寄信供應商的郵件無法撤回。另行申請的找回行程郵件不會重新開啟行前提醒。
若遺失私人行程連結，可以輸入原本已確認的電子郵件，申請一封暫時查看行程的郵件。只有仍在保留期限內的已確認行程會列出，未確認、已刪除或過期的行程不會列出。找回連結有效30分鐘，期限內可以重複開啟，每次都重新確認行程是否仍可查看。這不會建立登入狀態、合併行程、更改收件地址，或上傳未儲存的本機行程，也不會訂閱行前提醒或行銷訊息。
保存期限決定資料何時到期。伺服器會分批清理到期資料，工作量大或服務故障時可能延後刪除。未確認或已到期的行程會在期限到達時停止提供存取，不會等到清理完成才失效。以下紀錄各有自己的用途與刪除期限：
- 儲存申請收據用於避免重複儲存並找回同一次申請結果，期限固定為第一次接受申請後48小時，重試不會延長。行程刪除、移除聯絡資料或失效時，會清除比對標記與所有行程、寄送及前次申請連結；只留下隨機申請識別碼、原期限與無法使用狀態，直到原期限刪除。這仍是假名紀錄。
- 防止確認信濫用的紀錄只包含以密鑰處理的地址比對值、密鑰版本與寄發時間，最多保留48小時；行程或聯絡資料刪除後也會保留至此期限，不用於行銷或使用分析。
- 寄信重試的內容參考資料包含日期更新郵件與確認後行程連結郵件的樂園及入園日期。這些內容參考資料與錯誤紀錄，在寄送工作結束7天後清除；刪除行程或移除聯絡資料時會提早清除。其中的入園日期用來判斷是否需要再次寄送日期更新。其餘最少寄送歷史隨行程刪除或到期而刪除。這些日期紀錄清除後，即使你將日期改回先前已通知的日期，也可能收到列出相同日期的更新郵件。
- 已驗證且與行程關聯的寄信供應商回報識別碼、事件種類與時間，保留最多90天；刪除行程或移除聯絡資料時會提早刪除。找回郵件不另存這類行程回報紀錄。
- 為避免繼續寄送永久退信或已投訴的地址，我們另外保存受限制的密鑰地址比對值、版本、原因與事件時間，至最後一次符合條件的永久退信或投訴後24個UTC日曆月。這份紀錄不包含原始電子郵件或行程與供應商識別碼，會在行程或聯絡資料刪除後繼續保留，不用於行銷、研究或使用分析。沒有新的有效確認，不會因這份紀錄到期而自動開啟郵件。
- 找回連結在申請後30分鐘失效，清理作業會清除這次申請的收件地址與寄信參考資料。其餘申請與寄送結果、密鑰地址比對值，以及防濫用的地址與IP比對紀錄，在申請後或計數產生後48小時內刪除。這些防濫用與寄送比對紀錄不會因刪除一筆行程而立即消失。
- 共用寄信額度的行程關聯隨行程或寄送工作刪除；只有時段與數字的總計在額度時段結束後24小時內刪除。為公平處理背景工作而暫存的行程識別碼，也在該行程刪除時清除。這些紀錄不會對外分享或用於使用分析。
- 寄送失敗的累計服務總數只保存固定郵件種類、固定原因與整數，沒有日期、地址、行程或供應商識別碼，沒有固定到期日。用途限於服務驗證與故障調查，不用於研究或建立行程到期後的個人紀錄。
你可以在私人行程頁查看該行程的保存內容並刪除行程。刪除需要你在頁面確認，會撤銷私人頁面與行事曆的存取、取消未完成寄送，並刪除行程、住宿、準備進度、電子郵件及行程關聯的寄送與供應商回報紀錄；上列短期儲存申請收據、防濫用計數與永久退信或投訴比對值依各自期限處理。刪除不會撤回供應商已接受的郵件、他人的分享副本或匯入的行事曆，也不代表供應商備份立即清除。
Cloudflare 提供網站傳遞、伺服器程式、行程資料庫、安全防護、Turnstile 防濫用檢查與聯絡信件轉寄。Turnstile 會處理IP位址、瀏覽器與連線訊號，用於辨識及阻擋機器流量，也依其政策改善偵測能力；詳見 Turnstile 隱私權附錄。Resend 處理收件地址、寄送所需的郵件內容及寄送紀錄；詳見 Resend 隱私權政策。Google 提供第5節的使用分析。Zoho 處理你主動寄來的聯絡或隱私權請求郵件；我們的政策是請求結案12個月後，從我們控制的信箱及副本中刪除相關郵件，供應商垃圾桶、資料還原或備份的保存時間另依其處理方式。
連線與安全處理可能涉及IP位址、瀏覽器資訊、請求時間與路徑。一般請求不帶入網址 # 後的分享內容；應用程式不記錄原始行程內容、電子郵件、存取憑證或私人連結。供應商的執行、安全、郵件與備份紀錄依其各項服務處理，可能在應用程式刪除後暫時保留。
Cloudflare Workers Paid 日誌保存7天。D1 Time Travel 可以將資料庫還原至過去30天內的時間點，包括當時仍存在但後來已刪除的資料。
我們控制的應用程式日誌與技術匯出副本最多保存30天；設定的較短期限仍照常適用。我們控制的備份最多保存30天，恢復服務前會重新套用待處理的刪除要求。聯絡與隱私權請求郵件及我們控制的副本，依上列結案後12個月的政策處理。供應商獨立保留的安全、資料還原與帳戶終止紀錄，有各自的期限與起算條件；我們匯出的副本仍依適用的受控制紀錄類別處理。
依 Resend 公布的 Free、Pro 與 Scale 方案政策，郵件與紀錄保存30天，備份保存7天；停止使用並終止帳戶後，剩餘客戶資料在90天內刪除。這些是寄信供應商的期限，與上列應用程式紀錄的期限不同。Cloudflare Workers Paid 的 Workers Logs 公布保存期間為7天；資料庫備份、安全防護、轉寄紀錄與匯出副本各有自己的處理方式，不能套用同一個期限。Zoho 公布的政策是在依收件日與信箱設定清除垃圾桶後，另保留30天供資料還原；封存信件與另設的備份或匯出副本不會因移入垃圾桶而一併刪除。
我們不出售行程資料，不以同行者或證件資料建立行銷輪廓，也不將已儲存行程改作研究或到期後的分析資料。資料以電子方式處理，地區包括臺灣，以及供應商處理資料所在的國家或地區，包括美國及其全球網路節點。依法令要求時，我們可能向主管機關提供必要資料。
8. 你的權利與本聲明更新
你可以要求查詢或閱覽、取得複本、補充或更正、停止蒐集處理或利用，以及刪除個人資料。請聯絡reply@themeparkhelper.app。我們會依適用規定處理，只要求辦理請求所需的身分確認資訊。裝置上的行程可以在工具中更改或清除；未儲存的行程無法從伺服器找回。已確認的行程可以透過私人連結更改、查看保存內容或刪除，也可以在保留期限內使用第7節的電子郵件找回功能。
我們無法刪除他人持有的分享連結、你已匯入的行事曆或你提供給獨立合作平台的資料。聲明更新時，會在本頁公布新版本與生效日期。重大服務變更或終止時，我們會在網站顯著公告；事前公告與行程取得、匯出或刪除的安排，請見服務條款第11節。
Privacy notice
ThemeParkHelper (樂園行前小幫手) is operated by WY Internet INC. (武源國際有限公司). This notice describes data handling in this application. The YourDisney editorial websites have their own privacy notices.
1. Operator and contact
WY Internet INC. (武源國際有限公司), 2 F., No. 20, Minquan W. Rd., Zhongshan Dist., Taipei City 104626, Taiwan (R.O.C.). Privacy contact: reply@themeparkhelper.app.
2. Planning in your browser
Choose your park dates to see a timeline and export calendar entries without an account or email address. You can also provide and confirm an email address to save a trip on our server and use a private trip link and calendar subscription. Saving lets you choose whether to receive trip reminders. Section 7 explains the purposes and retention of saved-trip and email data.
Park dates, accommodation arrangements and status, optional party counts by age band shared across the trip, and preparation progress are used to calculate and display your timeline in the browser. The tool also stores a time zone, random identifiers and calendar-export records to keep trips and items consistent and show changes after an export. An export record does not prove that you imported a calendar or received an alert.
The Resort hotel, Off-site hotel and Not decided yet options share one optional pair of check-in and check-out dates. Once you save them, the dates are kept with your local trip and retained when you switch accommodation options. You can edit or clear them. Resort and off-site hotels can each be marked as booked; switching accommodation categories resets the booked status.
For each park day, you can separately select “I've bought tickets” to hide that day's buying options and show its park-reservation link. This confirmation is saved with the local trip only after you choose it. Ticket-possession markers, ticket type and the local record used to undo a marker are not uploaded; saving keeps only the ordinary task progress produced by your answer. Following a purchase link, existing task progress and migration of an older trip do not mark tickets as held. You can change the marker; changing or removing that park day clears its marker. Having tickets does not mean you have completed a park reservation.
Document preparation shows the check guidance directly, without first asking whether to include it. You can choose "Mark done", "I don't need this reminder" or "Undo". "Completed" records your own check; it does not mean that we have verified your documents or confirmed your eligibility to enter. Previously saved include or skip choices are retained in existing trips. Where browser storage is permitted, these choices and preparation progress are saved with your local trip and are not added to analytics.
We do not ask for nationality, which documents you hold, document numbers, names, exact ages or dates of birth. One set of party counts by age band is shared across the trip, without a list of individuals.
Optional information can be left blank. Missing information is not treated as “no”; items needing it retain a missing-information or unknown state. If browser storage is blocked, calculation and export still work, but input may not survive a refresh or leaving the page.
3. Local retention and clearing data
Where permitted, your trip is kept in this application's browser storage (themeparkhelper.local.v1). A trip you have not submitted for saving is not uploaded as a server backup and does not synchronise with YourDisney websites, other browsers or devices. Local storage does not keep email addresses or private-link access credentials.
A trip is retained through the entire UTC date 90 days after its last entered date, including supplied park and stay check-in and check-out dates. The tool deletes the local trip on its next load after that cutoff; it cannot delete data in the background while your browser is closed. Your time zone and another trip do not extend this period. You can also use the tool's clear function or clear site data in your browser.
The tool remembers your explicit trip time-zone choice together with the device time zone at that point (themeparkhelper.zone-kept), to reduce repeated questions. The tool keeps this record for 90 days from your explicit choice; ordinary visits do not extend the deadline. After expiry, the tool stops using it and removes it on your next use. It cannot delete data in the background while your browser is closed. The question may return only when the trip and device time zones differ.
When you dismiss a save prompt, the tool remembers the number of tasks already handled (tph_save_nudge) for the current tab session only. The prompt appears only after you handle a task, never merely from loading the page. The tool's clear function removes both records. They contain no email address or private link and are not uploaded with the trip.
Clearing site data may make the original local trip unavailable. It does not delete a saved trip on our server, copies shared with others or entries imported into another calendar service. You can delete a saved trip through its private link, as described in Section 7.
4. Sharing and calendars
A share link carries park dates after # in the URL. Party counts and age bands shared across the trip are included only if you actively select that option. A preview lets you check the content first. The link excludes accommodation, document choices, preparation progress, ticket-possession markers, time zone and the original trip's identifiers.
Anyone receiving the complete link can read its data and create their own trip copy. This part of the URL is not sent with an ordinary page request to the website server, but scripts on the page can read it. We do not separately store share content. Share only information you intend others to receive; recipients can keep or forward the link. Clearing your trip does not revoke a share.
A calendar download creates a file on your device. If you add events to Google Calendar or import the file into another service, that service receives the relevant event dates and content and handles them under its privacy policy. Events added or downloaded from a saved trip's page include the link to the trip's private page; Add to Google Calendar sends that link to Google in the add link.
A saved trip's private link differs from the share link above: anyone holding the private trip link can view, edit or delete that trip and turn on trip reminders where eligible. Confirmation, unsubscribe and retrieval links each have their own purpose. Keep these links private; a private trip link does not create an account that requires login.
A calendar subscription uses a separate private link that lists the trip's calendar events. Each event links to the trip's private page, so anyone who can see the subscribed calendar can open, edit or delete the trip; share a subscribed calendar only with people you would give the trip link to. The subscription link itself does not grant confirmation, unsubscribe or retrieval access. The calendar service periodically fetches event content from us and determines when it refreshes. After deletion or expiry, the feed link returns an empty calendar, so the subscribed events normally disappear at the calendar service's next refresh; you or your calendar service still hold any downloaded or imported copies.
5. Usage measurement and cookies
The home and planning pages use a dedicated ThemeParkHelper Google Analytics property to measure use, including first visits, sessions, engagement and processed actions such as creating a timeline, exporting a calendar, starting a save from the public planning page or following a hotel link. A save-start event records only the action, without the email address or save-request content, and does not prove a confirmed save. Neither language shows a cookie consent banner. The Google measurement script is not loaded and no analytics events are sent in the EU, European Economic Area, United Kingdom, certain excluded territories, or when the region cannot be determined. Measurement also stays off when your browser refuses it through Global Privacy Control (GPC) or Do Not Track (DNT).
Your browser asks this application whether measurement applies in your region. The answer is only “allowed” or “not allowed”, without the country. The check sets no cookie and does not add the country to the tool's measurement events. Providers' connection and security processing may still involve your IP address and region.
Action events contain an event name, random event and trip identifiers, resort, language and page address without its query string or anything after #. Depending on the action, they may include an entry-source category, task or action category, broad accommodation status, the official hotel shown or selected, a hotel-link option, and trip creation kind and week. The week is the UTC Monday for when the browser attempts to record the trip-creation event, not a travel date you entered. Identifiers are not derived from dates or personal details. We do not add actual park, search or stay dates, party information, document choices or document-task progress, ticket-possession markers, email addresses or typed text to analytics events. We do not automatically collect form contents or link-click contents. This privacy notice, the terms, confirmation, private-trip, unsubscribe and retrieval pages, and save-request and calendar-feed requests load no analytics script and send no analytics events.
If you save a trip, its server record keeps the same random trip identifier (attribution_id) used in analytics events, alongside the email address and trip data you submit. Permitted analytics events can therefore be linked to that saved record.
Google may set cookies, use identifiers and process browser and connection information, including city-level location, browser version, device brand and model, operating system and screen resolution. Ad personalisation and Google signals are turned off for this dedicated property. When you come from YourDisney, Google's cross-domain link parameter can maintain session continuity where measurement is allowed; it does not add trip-share content to analytics. UTM marketing parameters are removed before Google initialises, without storing or reporting their values.
The tool keeps a browser measurement record named tph.analytics.v1 to avoid counting the same event twice. It contains random trip identifiers, duplicate-count markers, creation week and kind, and expiry times. Creation kind distinguishes new trips, trips with prefilled dates and share copies. While this browser holds a valid persisted creation record, the first qualifying action can record one trip-use milestone (trip_useful), using the original creation week and kind. This milestone is not recorded after the creation marker expires at 90 days. Each marker expires within 90 days; a new event needing duplicate-count protection can renew the trip record's 90-day period. Expired records are removed on the next permitted use of browser storage. GPC/DNT refusal, or withdrawal of available statistics consent, also clears this record. You can clear site data or block cookies in your browser.
Google Analytics user and event data retention is set to two months, without resetting on new activity. This does not limit retention of standard aggregated reports. Google Analytics is the only destination for browser measurement; we do not keep a separate first-party usage-measurement database. The timeline, calendar exports, printing and sharing work without measurement. See Google's Privacy Policy for its handling.
6. Partner purchase and booking links
The application may show partner links to buy or book hotels, park tickets and Premier Access, meal vouchers, flights and transport tickets, on platforms including Klook, KKday and Trip.com; the platforms shown may differ by interface language. Except for the hotel booking links described in the next paragraph, these links carry only ThemeParkHelper's public affiliate account parameters. They do not carry trip identifiers, dates, party information, document choices, ticket-possession markers or preparation progress. Following a link does not mean that you bought or booked anything.
When you follow a partner booking link, it carries a random trip identifier (attribution_id) for commission attribution and any complete check-in and check-out dates you explicitly saved in the accommodation section. This is the same identifier used in the permitted analytics events described in Section 5, so booking links and analytics events for the same trip can be connected. It is pseudonymous, not anonymous. The link does not automatically use park dates or include party information, document choices or preparation progress.
Trip.com links use its direct affiliate programme. Agoda and Booking.com hotel links go through Stay22; Booking.com hotel links appear only in the English interface. Klook, KKday, Trip.com, Stay22 and the platform where you book receive connection information and handle cookies, further browsing and bookings under their policies. See the Trip.com Privacy Policy, Stay22 Privacy Policy, and the policy of the platform you visit.
7. Saved trips, email, providers and retention
When you actively submit a save request, we receive your email address and the selected trip data. Saved data includes park dates, accommodation arrangements and supplied dates, optional party counts by age band, language and reminder time zone, optional preparation choices the tool supports, task progress, random trip and calendar identifiers, the hotel-attribution identifier, and your trip-reminder choice. Confirmation and unsubscribe state, versions and modification records protect access, support edits and prevent duplicate mail. We do not turn your email into an account, a cross-trip preference profile or research data.
When saving, you can choose trip reminders or saving only. Whichever you choose, you need to verify your email address. After confirmation, you receive one email with your private trip link. If you save without reminders, they stay off. You can turn them on later from the private trip page. Changing park dates after confirmation may also produce an update email with the new dates and private trip link, including for trips saved without reminders. This acknowledges your own date change; it does not monitor changes to parks, hotels or external rules.
After you change the park dates of a confirmed trip, we use your email address and park dates to schedule a trip-update email for about 30 minutes after your last change. This also applies to trips saved without trip reminders. Each trip can have at most one pending update email; unsubscribing cancels it. We temporarily retain the resort and park dates announced in the email to support retries and check whether dates were reverted. These records follow the email-record retention and deletion rules.
Trip reminders use your selected, confirmed trip and enabled tasks. Emails contain no affiliate purchase advertising. We retain minimal send state, content versions, reference dates and task details for retries and duplicate prevention, without storing full email bodies or raw provider reports in the application database. We use Resend to send mail that can contain park dates and private links. Verified delivery, bounce and complaint reports help us send reliably and prevent unwanted mail. They do not prove that you read a message.
As of 9 October 2026, Resend open and link-click tracking are both turned off. Emails sent while open tracking was enabled may still contain a transparent image linked to each message; when the image loads, Resend can associate that request with the message and recipient. Turning tracking off does not delete tracking data from previously sent emails. These records do not prove that you read the email. The application database does not retain open or click events, and open rates do not determine reminders or measure the tool's usefulness.
A confirmation link is valid for 48 hours from its current issuance and requires you to confirm on the page. Unconfirmed trips and email addresses become unavailable at expiry and are deleted by cleanup. A confirmed trip, email address, accommodation and preparation data are kept through the entire UTC date 90 days after the last supplied park, stay check-in or check-out date. Editing the same trip recalculates that date; another trip or a retrieval request does not extend it. After the cutoff, private-page, calendar and retrieval access is denied and server cleanup deletes the data.
You can follow the unsubscribe link and confirm on its page to stop all email for that trip, including trip reminders and date-update email. The saved trip and subscribed calendar remain available, but reminders cannot be turned on again for that trip. An unconfirmed trip has no subscription to cancel; while it remains unconfirmed, retries of its existing verification mail may continue until the sending cutoff without extending the original 48-hour confirmation window. A message already submitted to the mail provider cannot be recalled. A separately requested trip-retrieval email does not turn reminders back on.
If you lose your private trip link, enter the original confirmed email address to request temporary access to retained trips. Only confirmed trips still within retention are listed; unconfirmed, deleted and expired trips are excluded. The retrieval link is valid for 30 minutes and can be opened repeatedly within that period. Each time you open it, we check whether the trips are still available. It creates no login session, merges no trips, changes no recipient address and uploads no unsaved local trip. It does not subscribe you to trip reminders or marketing.
Retention periods determine when data expires. The server deletes expired data in batches. A backlog or service failure can delay deletion. Unconfirmed or expired trips lose access at their cutoff, independently of cleanup. These records have separate purposes and deletion periods:
- A save-request receipt prevents duplicate saving and recovers the result of the same request. Its fixed deadline is 48 hours after the first accepted request; retries do not extend it. Trip deletion, contact removal or expiry clears the comparison tag and all trip, send and predecessor-request links. Only a random request identifier, original deadline and unusable state remain until deletion at that deadline. This is still a pseudonymous record.
- Verification-mail abuse counters contain only a keyed address-comparison value, key version and issuance time. They are retained for at most 48 hours, including after trip or contact deletion, without marketing or analytics use.
- Retry content references include the resort and park dates for date-update and trip-link acknowledgement mail. These content references and error records are cleared seven days after a send ends, or sooner on trip deletion or contact removal. The retained park dates help determine whether another date update is needed. Remaining minimal send history is deleted with the trip or at expiry. After these date records are cleared, you may receive an update email listing the same dates even if you revert to previously announced dates.
- Verified trip-associated provider report identifiers, event types and timestamps are retained for at most 90 days and removed sooner on trip deletion or contact removal. Retrieval mail does not create these trip-associated report records.
- To avoid further mail to an address with a permanent delivery failure or complaint, we separately retain a restricted keyed address-comparison value, version, reason and event time for 24 UTC calendar months after the last qualifying hard bounce or complaint. This contains no raw email address or trip or provider identifiers, survives trip or contact deletion, and is not used for marketing, research or analytics. Expiry does not turn mail on without a new valid confirmation.
- A retrieval link expires 30 minutes after issuance, and cleanup clears its recipient address and mail-content references. Remaining request and send records, the keyed address-comparison value, and abuse-control address and IP comparison records are deleted within 48 hours of issuance or counter creation. Deleting one trip does not immediately remove these abuse-control and send-comparison records.
- Shared mail-budget trip associations are removed with the trip or send. Totals containing only window bounds and numbers are deleted within 24 hours of the budget window ending. A temporary trip identifier used for fair background processing is also cleared when that trip is deleted. These records are not shared or used for analytics.
- Cumulative service failure totals retain only a fixed mail type, fixed reason and integer, without dates, addresses or trip or provider identifiers and without a fixed expiry. They are used only for service validation and failure investigation, not research or records of individual trips after expiry.
Your private trip page lets you inspect stored trip data and explicitly confirm deletion. Deletion revokes private-page and calendar access, cancels unfinished mail and deletes the trip, stays, progress, email and trip-associated send and provider-report records. The short-lived save-receipt, abuse-counter and hard-bounce or complaint records above follow their separate periods. Deletion cannot recall mail already accepted by a provider, share copies held by others or imported calendars, and does not mean immediate erasure from provider backups.
Cloudflare provides application delivery, server execution, the trip database, security, Turnstile abuse checks and contact-email forwarding. Turnstile processes IP addresses and browser and connection signals to detect and block bots and, under its policy, improve detection. See the Turnstile Privacy Addendum. Resend handles recipient addresses, message content needed for sending and send records; see the Resend Privacy Policy. Google provides the measurement in Section 5. Zoho handles contact or privacy-request mail you choose to send us. Our policy is to delete it from mailboxes and copies we control 12 months after the request is closed; provider trash, recovery and backup copies follow their own handling.
Connection and security processing may involve IP addresses, browser information, request time and path. Ordinary requests do not contain share content after #; the application does not log raw trip contents, email addresses, access credentials or private links. Providers' execution, security, mail and backup records follow their respective services and may remain temporarily after application deletion.
Cloudflare Workers Paid logs are retained for seven days. D1 Time Travel can restore the database to a point within the past 30 days, including records that existed then but have since been deleted.
Application logs and technical exports we control are kept for at most 30 days; shorter configured periods still apply. Backups we control are kept for at most 30 days, and we reapply pending deletions before restoring service. Contact and privacy-request mail and its controlled copies follow the 12-month-after-closure policy above. Providers' independent security, recovery and account-termination records have their own periods and triggers; copies we export follow the applicable controlled-record rule.
Under Resend's published Free, Pro and Scale policies, email and logs are retained for 30 days and backups for seven days. After service and account termination, remaining customer data is deleted within 90 days. These provider periods differ from the application-record periods above. Cloudflare publishes seven-day Workers Logs retention for Workers Paid; database backups, security, forwarding records and exports each have their own handling. Zoho's published policy provides a further 30 days of server recovery after Trash is cleared according to the message's received date and mailbox settings. Archived mail and separate backups or exports are not deleted simply by moving a message to Trash.
We do not sell trip data, build marketing profiles from party or document information, or reuse saved trips for research or analytics after expiry. Data is processed electronically in Taiwan and the countries or regions where providers process it, including the United States and their global network locations. We may provide necessary information to authorities where required by law.
8. Your rights and updates to this notice
You may request access, copies, additions or corrections, cessation of collection, processing or use, and deletion of personal data. Contact reply@themeparkhelper.app. We handle requests under applicable requirements and ask only for identity-verification information needed to process them. You can edit or clear your device's trip in the tool. An unsaved trip cannot be recovered from our server. A confirmed trip can be edited, inspected or deleted through its private link, or recovered by email within its retention period as described in Section 7.
We cannot delete share links held by others, calendar entries you imported or data you gave independent partner platforms. Updates and their effective dates will be published here. We will prominently announce material service changes or closure on the website. See Section 11 of the terms of service for advance notice and arrangements to obtain, export or delete trips.