Privacy Policy

1. Controller

The controller responsible for processing personal data in connection with Packbay is:

2. Data we process

• Account and household: name, email address, password hash, language, roles, household membership, invitations and sign-in data.
• Sign in with Apple or Google: the selected provider, its immutable account identifier and issuer, the intended client identifier, linking and revocation status and, where supplied during the first authorisation, name, email address, verification status and whether Apple uses a private relay address. We store an Apple refresh token needed for validation and revocation only in encrypted form. Provider ID and access tokens and authorisation codes are discarded after verification and are never used as a Packbay session.
• Travel planning: trips, accommodation, activities, daily plans, checklists, notes and budget data, including amounts, categories, payers and splits.
• Premium and payments: plan, term, subscription status and transaction identifiers from Apple, Google Play or, for a web subscription, Stripe. We do not receive full payment details. For the Premium travel mailbox, we process incoming emails and attachments, which may also contain data about third parties.
• AI country reports: If you request a report, we process the destination and the generated report. Account, contact and other trip content is not sent to the AI provider for this purpose.
• In-app reports and moderation: If you report content or another household member, we store the link to your account and household, a server-validated resource reference, the reason, your optional comment, processing status, internal moderation note and action taken. The reported content is not copied into the report, and submitting a report does not trigger a push notification.
• Device, security and diagnostics: optional push token or Web Push endpoint with delivery keys, a Firebase installation ID on Android, random Packbay device identifier, language and display settings and, for access and security events, IP address, time, user agent, an approximate location derived locally and technical log or error data. Error reports may contain app version, device type, affected feature and pseudonymous technical identifiers.
• Support and contract notices: contact details, messages, attachments, history and processing status. Cancellation or withdrawal notices additionally include the notice type, contract description or identifier, receipt time and optional details. Pseudonymous technical verification values may be stored to prevent abuse.

The data comes from you, other household members, senders to a travel or support mailbox and, for purchases, Apple, Google Play or Stripe. Name, email address, password and fields marked as required for a feature are necessary to conclude or perform the contract; without them, the relevant feature cannot be provided. Other details and push notifications are optional.

If you enter data about other people or forward messages, please inform them where required. Where Article 14 GDPR requires us to provide information and no exemption applies, we will inform the data subject within the statutory period.

3. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): registration, sign-in, voluntary linking or unlinking of an Apple or Google account, account management, shared travel planning, Premium, payment status, travel mailbox, requested country reports and handling contract-related support, cancellations and withdrawals. Provider sign-in is optional; sign-in and recovery by email and password remain available as an alternative.
• Consent (Art. 6(1)(a) GDPR): push notifications. You can withdraw consent at any time in your device settings.
• Legal obligations (Art. 6(1)(c) GDPR): in particular tax and commercial-law retention duties and receipt and confirmation of contract notices required by law.
• Legitimate interests (Art. 6(1)(f) GDPR): protecting accounts and systems, preventing abuse, diagnosing errors, reliable operation, reviewing in-app reports, moderation, handling general enquiries and establishing, exercising or defending legal claims. Providing the reporting channel also serves performance of the contract under Art. 6(1)(b) GDPR. Our respective interest is a secure and reliable service with as little data processing as possible.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

4. Recipients and services

We disclose data only where necessary for the relevant purpose:

• Microsoft 365 / Microsoft Graph: travel and support mailboxes and delivery of account, security, export and contract emails; email addresses and message content are processed. Security emails may also contain the request IP address, device and time details and an approximate location derived from them locally as text; no coordinates or map image are sent to Google for this purpose.
• Sentry (Functional Software, Inc.): minimised error, crash and performance data in the EU data region.
• Google Sign-In (Google Ireland Limited and, where applicable, Google LLC): Only when you choose Google for sign-in or account linking does Google process the client identifier, the calling app or web origin and random security values. Packbay receives a stable Google account identifier and, depending on your approval, email address, verification status, name and language. We do not store Google access or refresh tokens for sign-in. Further information is available in the Google Privacy Policy.
• Sign in with Apple: Only when you choose Apple for sign-in or account linking does Apple process the client identifier, return URL, state and nonce. Packbay receives a stable Apple account identifier and, on the first authorisation where provided, name, email address and relay status. We use the encrypted Apple refresh token solely for the required periodic grant validation and revocation when unlinking or deleting the account. Further information is available in the Apple Privacy Policy.
• Google Maps Platform / Places (Google Ireland Limited and, where applicable, Google LLC): search terms or destinations for Places searches, the exact coordinates of the accommodation planned for the trip, only when the trip map preview is requested. For this Maps processing, Google and we each act as independent controllers under the Google Controller-Controller Data Protection Terms. Google Maps is also subject to the Google Maps End User Additional Terms; further information is available in the Google Privacy Policy.
• Firebase Cloud Messaging and Google Cloud Pub/Sub (Google Ireland Limited and Google LLC): If Android notifications are voluntarily enabled, a Firebase installation ID and technical event and navigation identifiers are processed. The Android message contains no free-form text or specific trip, mailbox, checklist, itinerary or financial content; Android creates a generic notice locally and reloads business data only while signed in. Pub/Sub transfers technical purchase and subscription events to our backend. Google processes these data for us as a processor under the Firebase Data Processing and Security Terms or the Google Cloud Data Processing Addendum, respectively.
• Google Play Billing: Google Play collects and processes purchase and payment data directly under its own terms. For providing and verifying the Android subscription, we receive only the purchase token, product, transaction and subscription status, but no full payment details.
• Apple: push delivery and, for an iPhone subscription, independent purchase and payment processing. We receive transaction and subscription status data.
• Web Push provider of the selected browser: If browser notifications are voluntarily enabled, a technical push endpoint, delivery keys and a minimal event identifier are processed. The message contains no trip, email or financial content; Packbay reloads the business data after it is opened.
• Stripe Payments Europe, Ltd.: payment processing for a subscription offered through the web app. We receive customer, subscription and status identifiers, but no full payment details.
• Cloudflare, Inc.: delivery and protection of the website and interfaces and Turnstile abuse prevention; in particular, IP address, browser and interaction data are processed.
• Anthropic, PBC: The destination is sent only when you actively request a country report.
• Pushover, LLC: A fixed internal notice without case content may be triggered for a new support case or an open cancellation or withdrawal notice. Pushover processes technical request, account and device metadata for delivery. Further information: Pushover Privacy Policy.

5. International transfers

Microsoft, Sentry, Google, Apple, the respective Web Push provider, Stripe, Cloudflare, Anthropic and Pushover may process data in the United States or another country outside the European Economic Area. Depending on the recipient and transfer route, the transfer is based on an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, in particular the EU Standard Contractual Clauses. You can request information about the basis used for a specific processing activity and a copy of available safeguards at datenschutz@packbay.app.

6. Retention and deletion

• Account and trip content: generally until the account is deleted. After a deletion request, the account is blocked immediately and deleted or anonymised after 30 days. Shared content may remain available to other household members. Routine backups are overwritten within approximately three weeks.
• External sign-in identities: We retain linking data while the respective sign-in method remains connected to the account. On unlinking, the identity is immediately blocked for new sign-ins; the encrypted Apple grant is destroyed after successful revocation or after the limited retry window ends. Minimised security and audit evidence remains only for its applicable retention period. When an account is deleted, all provider grants are revoked before final deletion or moved into the documented time-limited revocation process.
• Premium and contracts: records and contract confirmations relevant under tax or commercial law are retained for the applicable periods, generally eight years. Other cancellation and withdrawal records are generally retained until the end of the third calendar year following receipt. Evidence of Terms acceptance remains stored while the account exists. After account deletion, the pseudonymous minimal record is deleted once the period calculated from acceptance has expired. An open case or legal claim may suspend deletion until it is resolved.
• Travel mailbox: After Premium ends, the mailbox is removed following the necessary transition and deprovisioning period.
• Push and device identifiers: Packbay removes the server-side push registration on sign-out, deactivation, device replacement or account deletion as soon as the relevant operation can be carried out technically. Providers may retain backups according to their own schedules. Google states that a Firebase installation ID deleted through its API is removed from live and backup systems within up to 180 days.
• Support: We store chats, emails and tickets until the request is completed and afterwards only for as long as necessary for follow-up questions, abuse prevention, legal obligations or claims. They are stored separately from the product account and are therefore not removed automatically when that account is deleted. You can request deletion at support@packbay.app.
• Security and diagnostic data: until the relevant analysis or protection purpose no longer applies; a specific security incident or legal duty may require longer retention.
• In-app reports: Open reports are retained until they are resolved. After resolution or dismissal, we retain the moderation record for another 180 days and then delete it automatically. If the reporting account is deleted, its link is removed; deleting the household removes the report.

Where no fixed period is stated, the purpose, necessity and possible statutory documentation or limitation periods determine the duration. We then delete or anonymise the data.

7. Cookies and local storage

The website and web app use only technically necessary session and language cookies. The session expires after no more than 30 days and the language choice after no more than one year. The theme setting and a random device identifier are stored locally; the device identifier supports the device-specific read status and is transmitted with app requests. Cloudflare Turnstile, our self-hosted chat and the support portal may also set necessary storage entries. The legal basis is § 25(2) no. 2 TDDDG.

8. Your rights

Subject to the GDPR, you have in particular the following rights:

• access (Art. 15),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing under Art. 6(1)(e) or (f) (Art. 21),
• withdrawal of consent with effect for the future, and
• complaint to a data protection supervisory authority.

Our competent authority is the Saxon Data Protection and Transparency Commissioner, Maternistraße 17, 01067 Dresden, Germany. To exercise your rights, email datenschutz@packbay.app.

Objection: If processing is based on legitimate interests, you may object on grounds relating to your particular situation. We will then stop processing unless compelling legitimate grounds or legal claims take precedence.