Your account. Your reports.

What is stored?

TravMetric stores your email address, account creation time, salted password hash, recovery-code hash and hashed session tokens with expiry times. It also records whether and when your email address was confirmed. Passwords, raw recovery codes and raw session tokens are not stored in the account database. An account does not prove hotel ownership.

Signed-in scans are saved privately to the account that created them, with URL, extracted evidence, score and recommendations. The owner may explicitly share a hotel profile and its linked reports with accepted viewers. Raw fetched HTML is not stored with the report, and reports are not sent to an AI service.

Guest scans are not stored in the account report database. Current guest results remain in this browser tab until replaced or refreshed. A website being scanned sees requests from TravMetricBot. Normal hosting, reverse-proxy and destination-site access logs may apply; this feature does not control those logs.

Retention and exports

The dashboard keeps up to 20 saved reports per account. When a new report is stored, older reports beyond that limit are removed from the active report database. You can delete an individual saved report or delete your account and all its active reports in account settings. A report that exceeds the saved-report size limit or cannot be stored produces a notice; you can still export the live result.

JSON export downloads the current report. “Print / Save PDF” opens your browser’s print dialog with a full report view; choose “Save as PDF” to keep a document. Exported files are under your control and may include the hotel URL and extracted website information. Deleting an account does not delete copies you already downloaded or shared.

Accounts and reports are stored on the TravMetric server in a separate SQLite database that survives application updates. Deployment backups may contain earlier copies of account data, including deleted reports. This beta does not promise immediate removal from existing backups; backup retention is managed by the site operator.

Sign-in and recovery

A successful sign-in uses an essential, HttpOnly session cookie, marked Secure in production and limited to this site with SameSite=Lax. Sessions last up to seven days, and at most five recent sessions are retained per account. Signing out revokes the current session; changing or recovering a password revokes all old sessions.

Your recovery code is shown once when you create an account or change or reset its password. Keep it private. Anyone with your email and this code can reset the password. A successful reset replaces the old code. Email reset links are also available for previously confirmed addresses when email delivery is enabled. Without either your current code or access to a confirmed mailbox with email recovery available, self-service recovery is not possible.

Password hashing and account forms have limits to reduce abuse. When trusted proxy handling is not configured, visitors share a conservative request bucket. These controls are not a claim of hotel verification or a guarantee of account security.

Email confirmation and recovery

When email delivery is enabled, TravMetric uses Resend to send account confirmation and password-reset messages. Resend receives the destination address and message, including the temporary link. Account confirmation and password-reset messages do not include hotel reports. Confirmation links last 24 hours; reset links last 30 minutes. Only hashes of link tokens are stored in the account database. Send-attempt records older than 24 hours are cleared when the next email request is processed. Email recovery requires a previously confirmed address. The recovery code remains available if email delivery is unavailable.

Weekly checks and notifications

Weekly checks are off until you enable them for a hotel. They follow the same public-page access rules as manual checks, and their reports count towards the account limit of 20. Change emails go only to your confirmed address and may include the hotel name, website, scores, changed checks and a private report link. Resend processes these messages. Turning off emails leaves weekly checks running; turning off weekly checks also cancels pending emails. Messages already handed to the email service cannot be recalled. Pending messages are retried for up to 23 hours. Their locally stored bodies are cleared after acceptance, cancellation or expiry when the worker runs. Delivery metadata is removed after seven days when the worker runs. Backups may retain earlier copies.

Hotel profiles

Hotel profiles belong to the creating account, with entered name, website, creation date and linked reports. Owners can invite viewers explicitly. A profile or invitation does not prove legal hotel ownership. You can keep ten owned profiles and twenty reports per account. Removing an owned profile keeps its reports privately but removes its viewer access and invitations. Deleting an owner account removes its profiles and active reports; earlier copies may remain in backups.

DNS website-access proof

Optional DNS proof stores the exact hostname, a hash of the generated TXT value, challenge and validity dates, check times, outcomes and rate-limit counters, linked to your private hotel profile. The raw value is returned only at generation and becomes public if you publish it in DNS. DNS providers and recursive resolvers process the query. Successful proofs expire after 30 days and are not continuously monitored. Expired records remain until replaced, locally removed or the profile/account is deleted. Local removal clears the proof and hash but retains anti-abuse counters until profile/account deletion. Backups may retain earlier copies. This proves a point-in-time ability to publish a DNS record, not legal hotel ownership or exclusive access, and never changes the readiness score.

Hotel team sharing

Owners may explicitly invite a confirmed-email account to read one hotel profile and its retained and future reports, including JSON/PDF exports. No other hotels, account settings, DNS proof, weekly configuration, feedback or private task marks are shared. We store invitation emails, dates and statuses, accepted viewer account references, and invite-rate counters. The invited recipient sees the owner account email and hotel name/URL before accepting. No invitation email is sent automatically. Pending invitations expire after seven days; inactive invitation history is removed after 30 days when team lists are opened. Active viewer grants remain until removed, left, or the profile/account is deleted. Confirmed recipient account deletion also removes invitations addressed to that mailbox; an unconfirmed account cannot remove invitations for an unproven address. Existing exports and backups may retain copies. New API reads check current permissions; the shared viewer page also rechecks on focus and every 30 seconds while open. Previously received or downloaded information cannot be recalled.

Report feedback

Feedback is optional and linked to your saved report. We store your rating, any selected check, comments and submission times. The TravMetric operator can review and export it to investigate results. You can edit or delete it on the report page. Deleting the report or account also removes its feedback from the active database. Existing exports and backups may retain earlier copies. Your guide visibility preference is saved to your account.

Service measurement and operator access

TravMetric records service events such as registration, sign-in, scan start and outcome, and saved-report views. Events may contain an account reference, a public scanned hostname, a scan error code, duration and time. Guest events have no account reference. We do not add visitor IP addresses, advertising identifiers, raw referrer URLs or automatic location estimates to this event database. Registration source is optional and self-reported. Events use a rolling 90-day window, a 10,000-event daily cap and best-effort collection; earlier traffic cannot be reconstructed. Expired events are removed when measurement, the admin statistics or the weekly worker runs.

The assigned operator can view account emails, aggregate service usage, optional hotel country and accommodation type, report feedback and recommendation marks in a protected dashboard. Hotel details are optional and can be cleared in profile settings. Recommendation marks record your own statement and time; they do not change the score or verify that work was completed. They are removed with the report, including retention-based removal. First-use milestone dates remain with the account. Deleting an account removes its linked events and milestones from the active database. Deleting an individual report does not remove separate service-event metadata. Earlier copies may remain in backups and operator exports. Admin unlocks are logged with account and time, cleaned after 90 days at the next unlock.

Persistent hotel tasks

Hotel task tracking stores your status, update time, check label and advice, and the source scan date/methodology. These states survive report deletion and retention, but are deleted with the hotel profile or account. They do not change scan scores or verify repairs. Report-specific checklist marks remain separate. Earlier copies may remain in backups.

Session changes between tabs

When your account changes in another tab, the private dashboard is cleared and must be reloaded. Open workspace requests are bound to that account. Cross-tab notifications contain no account details and are not stored. Previously downloaded copies are unaffected.

Language

Your language choice is remembered in a first-party cookie for one year. It contains only a language code and can be changed with the language selector.

Manage your account

Use your dashboard to review and delete saved reports, change your password, replace your recovery code, sign out or delete your account. Account deletion requires the current password and an explicit confirmation. The guest scanner continues to work without an account.