TripLift uses TripIts API (Application Program Interface), the same single data endpoint integrated into TripIt's web and mobile applications. It works with the security token already stored by TripIt, using the access method TripIt designed for its application.

While TripLift is running, it makes additional requests to TripIt's API and presents the resulting information within the TripIt web app. TripList does not request information that identifies you, and the API does not expose your passwords, trip information or any other information.

TripLift requests only the data and access needed for its features. Its manifest requests no permissions beyond TripIt's application domain, and the extension has no background process. Your travel information remains within its intended boundaries: your browser and TripIt.