Who we are
Tribuo is a grant operating platform for smaller public agencies. The site is operated on Hostinger hosting at https://tribuo.net. Tribuo is independent software, not a government website.
Account information
When you create an organization account, Tribuo stores the organization name, organization type, contact name, work email address, a password hash (not the password itself), account status, email verification time, and membership role. Invitations store the invited email address and the role being offered. Workspace records that you and your colleagues enter, such as grant work items, proposals, evidence, budgets, and awards, stay in your organization account.
Tribuo sends transactional email through Hostinger mail from noreply@tribuo.net. That includes address verification, password reset, and organization invitations. We use your email address to deliver those messages and to identify your account when you sign in.
Cookies and sessions
When you sign in, Tribuo sets a session cookie named tribuo_session. The cookie is HttpOnly, uses the Secure flag on HTTPS, and is SameSite=Lax. It identifies your signed-in session, is limited to the tribuo.net path, and lasts for the browser session or until you sign out. The session also ends after 30 minutes of inactivity. A CSRF token is stored in that session to protect form submissions. Signing out clears the session. Public marketing pages do not require this session cookie.
Google Analytics also sets cookies on Tribuo pages, including public marketing pages, to collect usage data as described below.
Security and abuse prevention
To limit abusive sign-in and registration attempts, Tribuo stores a one-way request fingerprint and whether the attempt succeeded, not the raw IP address, in a login-attempt log.
Analytics
Tribuo uses Google Analytics (GA4, measurement ID G-H14HQ54W28) on every page. Google Analytics uses cookies and collects usage data, including the pages you visit, the referring site, and approximate location and device information. Google processes that data under its terms.
Tribuo also records a first-party page-view log for public pages and for a small set of account-entry pages. Each record stores the time, the page path, and the referring site host when the browser sent a referrer. The first-party log does not set an analytics cookie and does not store IP addresses or user-agent strings. The first-party summary is available only to designated Tribuo operators.
Payments
Paid plans, when billing is configured, are processed by Stripe. Tribuo stores the billing identifiers needed to manage a subscription. Card numbers are handled by Stripe and are not stored in Tribuo.
Files
When file uploads are enabled for a deployment, documents you upload are stored for use in your agency workspace.
How the information is used
Account and workspace data are used to operate the product for your organization: authentication, authorization, grant work, transactional mail, billing when it is configured, and service reliability. The first-party page-view log is used to understand which public pages are visited. Google Analytics is used to understand how people use the site. Tribuo does not sell personal information.
Retention and access
Account, membership, and workspace records are kept while the organization account is active. Session data lasts for the session rules above. First-party page-view records are kept for operator review of public-site use. Google Analytics usage data is stored by Google according to the property settings. You can review and update account profile details while signed in. To correct account information or to request deletion of an organization account, For privacy questions, email demo@tribuo.net or use the Request a demo page.
Changes
When these practices change, this page will be updated with the new date and description.
Contact
For privacy questions, email demo@tribuo.net or use the Request a demo page.