Privacy Policy

1. Controller

The controller responsible for processing personal data in connection with Packbay is:

2. Data we process

• Account and household: name, email address, password hash, language, roles, household membership, invitations and sign-in data.
• Travel planning: trips, accommodation, activities, daily plans, checklists, notes and budget data, including amounts, categories, payers and splits.
• Premium and payments: plan, term, subscription status and transaction identifiers from Apple, Google Play or, for a web subscription, Stripe. We do not receive full payment details. For the Premium travel mailbox, we process incoming emails and attachments, which may also contain data about third parties.
• AI country reports: If you request a report, we process the destination and the generated report. Account, contact and other trip content is not sent to the AI provider for this purpose.
• In-app reports and moderation: If you report content or another household member, we store the link to your account and household, a server-validated resource reference, the reason, your optional comment, processing status, internal moderation note and action taken. The reported content is not copied into the report, and submitting a report does not trigger a push notification.
• Device, security and diagnostics: optional push token or Web Push endpoint with delivery keys, a Firebase installation ID on Android, random Packbay device identifier, language and display settings and, for access and security events, IP address, time, user agent, an approximate location derived locally and technical log or error data. Error reports may contain app version, device type, affected feature and pseudonymous technical identifiers.
• Support and contract notices: contact details, messages, attachments, history and processing status. Cancellation or withdrawal notices additionally include the notice type, contract description or identifier, receipt time and optional details. Pseudonymous technical verification values may be stored to prevent abuse.

The data comes from you, other household members, senders to a travel or support mailbox and, for purchases, Apple, Google Play or Stripe. Name, email address, password and fields marked as required for a feature are necessary to conclude or perform the contract; without them, the relevant feature cannot be provided. Other details and push notifications are optional.

If you enter data about other people or forward messages, please inform them where required. Where Article 14 GDPR requires us to provide information and no exemption applies, we will inform the data subject within the statutory period.

3. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): registration, account management, shared travel planning, Premium, payment status, travel mailbox, requested country reports and handling contract-related support, cancellations and withdrawals.
• Consent (Art. 6(1)(a) GDPR): push notifications. You can withdraw consent at any time in your device settings.
• Legal obligations (Art. 6(1)(c) GDPR): in particular tax and commercial-law retention duties and receipt and confirmation of contract notices required by law.
• Legitimate interests (Art. 6(1)(f) GDPR): protecting accounts and systems, preventing abuse, diagnosing errors, reliable operation, reviewing in-app reports, moderation, handling general enquiries and establishing, exercising or defending legal claims. Providing the reporting channel also serves performance of the contract under Art. 6(1)(b) GDPR. Our respective interest is a secure and reliable service with as little data processing as possible.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

4. Recipients and services

We disclose data only where necessary for the relevant purpose:

• Microsoft 365 / Microsoft Graph: travel and support mailboxes and delivery of account, security, export and contract emails; email addresses and message content are processed.
• Sentry (Functional Software, Inc.): minimised error, crash and performance data in the EU data region.
• Google Ireland Limited / Google LLC: search terms or destinations for Places searches, the exact coordinates of the accommodation planned for the trip, only when the trip map preview is requested, and approximate coordinates derived locally for maps in security emails; for voluntarily enabled Android notifications, a Firebase installation ID and technical event and navigation identifiers for Firebase Cloud Messaging. The Android message contains no free-form text or specific trip, mailbox, checklist, itinerary or financial content; Android creates a generic notice locally and reloads business data only while signed in. For an Android subscription, Google processes the purchase token, product, transaction and subscription status. Google Play independently processes the purchase and payment; we do not receive full payment details. Google Maps is subject to the Google Maps End User Additional Terms; further information is available in the Google Privacy Policy.
• Apple: push delivery and, for an iPhone subscription, independent purchase and payment processing. We receive transaction and subscription status data.
• Web Push provider of the selected browser: If browser notifications are voluntarily enabled, a technical push endpoint, delivery keys and a minimal event identifier are processed. The message contains no trip, email or financial content; Packbay reloads the business data after it is opened.
• Stripe Payments Europe, Ltd.: payment processing for a subscription offered through the web app. We receive customer, subscription and status identifiers, but no full payment details.
• Cloudflare, Inc.: delivery and protection of the website and interfaces and Turnstile abuse prevention; in particular, IP address, browser and interaction data are processed.
• Anthropic, PBC: The destination is sent only when you actively request a country report.
• Pushover, LLC: A fixed internal notice without case content may be triggered for a new support case or an open cancellation or withdrawal notice. Pushover processes technical request, account and device metadata for delivery. Further information: Pushover Privacy Policy.

5. International transfers

Microsoft, Sentry, Google, Apple, the respective Web Push provider, Stripe, Cloudflare, Anthropic and Pushover may process data in the United States or another country outside the European Economic Area. Depending on the recipient and transfer route, the transfer is based on an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, in particular the EU Standard Contractual Clauses. You can request information about the basis used for a specific processing activity and a copy of available safeguards at datenschutz@packbay.app.

6. Retention and deletion

• Account and trip content: generally until the account is deleted. After a deletion request, the account is blocked immediately and deleted or anonymised after 30 days. Shared content may remain available to other household members. Routine backups are overwritten within approximately three weeks.
• Premium and contracts: records and contract confirmations relevant under tax or commercial law are retained for the applicable periods, generally eight years. Other cancellation and withdrawal records are generally retained until the end of the third calendar year following receipt. Evidence of Terms acceptance remains stored while the account exists. After account deletion, the pseudonymous minimal record is deleted once the period calculated from acceptance has expired. An open case or legal claim may suspend deletion until it is resolved.
• Travel mailbox: After Premium ends, the mailbox is removed following the necessary transition and deprovisioning period.
• Push and device identifiers: Packbay removes the server-side push registration on sign-out, deactivation, device replacement or account deletion as soon as the relevant operation can be carried out technically. Providers may retain backups according to their own schedules. Google states that a Firebase installation ID deleted through its API is removed from live and backup systems within up to 180 days.
• Support: We store chats, emails and tickets until the request is completed and afterwards only for as long as necessary for follow-up questions, abuse prevention, legal obligations or claims. They are stored separately from the product account and are therefore not removed automatically when that account is deleted. You can request deletion at support@packbay.app.
• Security and diagnostic data: until the relevant analysis or protection purpose no longer applies; a specific security incident or legal duty may require longer retention.
• In-app reports: Open reports are retained until they are resolved. After resolution or dismissal, we retain the moderation record for another 180 days and then delete it automatically. If the reporting account is deleted, its link is removed; deleting the household removes the report.

Where no fixed period is stated, the purpose, necessity and possible statutory documentation or limitation periods determine the duration. We then delete or anonymise the data.

7. Cookies and local storage

The website and web app use only technically necessary session and language cookies. The session expires after no more than 30 days and the language choice after no more than one year. The theme setting and a random device identifier are stored locally; the device identifier supports the device-specific read status and is transmitted with app requests. Cloudflare Turnstile, our self-hosted chat and the support portal may also set necessary storage entries. The legal basis is § 25(2) no. 2 TDDDG.

8. Your rights

Subject to the GDPR, you have in particular the following rights:

• access (Art. 15),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing under Art. 6(1)(e) or (f) (Art. 21),
• withdrawal of consent with effect for the future, and
• complaint to a data protection supervisory authority.

Our competent authority is the Saxon Data Protection and Transparency Commissioner, Maternistraße 17, 01067 Dresden, Germany. To exercise your rights, email datenschutz@packbay.app.

Objection: If processing is based on legitimate interests, you may object on grounds relating to your particular situation. We will then stop processing unless compelling legitimate grounds or legal claims take precedence.