Privacy Policy

Effective date: [EFFECTIVE DATE] Last updated: [EFFECTIVE DATE]

This Privacy Policy explains how [LEGAL ENTITY], doing business as AutoOps ("Packworthy," "we," "us," or "our"), collects, uses, shares and protects personal information when you use the Packworthy website at packworthy.app (the "Site") and the Packworthy mobile apps for Android and iOS (the "App") (together, the "Services").

Quick links: What we collect · How we use it · Ads and "sharing" · Your choices · California · Other U.S. states · EU/UK · Children · Contact

Do Not Sell or Share My Personal Information · Limit the Use of My Sensitive Personal Information · Cookie settings

1. Who we are

The Services are provided by [LEGAL ENTITY] (dba AutoOps), [MAILING ADDRESS], USA. For EU and UK data protection law, we are the "controller" of your personal information. You can reach us at [CONTACT EMAIL].

2. Information we collect

2.1 Information you give us

• Account and sign-up information. Your email address when you sign up for a guide, join the waitlist, or create an account. If you choose "Sign in with Google," we receive your name, email address, profile picture and Google account ID from Google. We do not receive your Google password.
• Trip information. Destinations, travel dates, how you are traveling (for example, flying or driving, flight length, carry-on only), planned activities and events, and packing preferences.
• Traveler profiles. For each traveler you add: a name or nickname you choose, age or age range, and packing-related details such as clothing needs, temperature preferences, and, for young children, details like diaper or potty-training stage and feeding method (for example, breastfeeding, formula or bottles). See Section 9.
• Routine and item information. Answers about daily routines and the items you add (for example, glasses or contact lenses, toiletries, or that you take daily medication). We use this only to build your packing list. You do not need to enter medication names or health details, and we ask you not to.
• Shared lists. If you share a trip, the names or nicknames and email addresses of the people you invite, and who has packed what.
• Purchases. Which plan or trip purchase you bought, purchase dates, renewal status and a transaction identifier. Payments are processed by Apple or Google; we do not receive your full payment card number.
• Communications. Messages you send us, such as support requests and privacy requests.

2.2 Information collected automatically

• Device and usage information. IP address, device type, operating system, app version, browser type, language, pages or screens viewed, features used, referring pages, and timestamps.
• Advertising identifiers. On the free plan, the App may collect your device's advertising identifier (Google Advertising ID on Android; IDFA on iOS only if you allow tracking) and related ad-interaction data.
• Approximate location. We infer approximate location (such as country, region or city) from your IP address, for example to show the right consent options, currency and content. We do not collect precise GPS location. We look up weather for the destinations you enter, not your device's location.
• Cookies and similar technologies. See our Cookie Notice.
• Diagnostics. Crash logs and performance data, through [CRASH REPORTING PROVIDER].

2.3 Information from third parties

• Google, if you sign in with Google (see above).
• Apple and Google app stores, which tell us about your purchases and subscription status.
• Advertising and analytics partners, which may give us aggregated reports about ad performance and usage.
• Affiliate partners, which may tell us that a purchase was made through our link and our commission (generally without identifying you).

3. How we use information

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details and you can object (see Section 12).

We do not use your personal information to make decisions that have legal or similarly significant effects on you based solely on automated processing. Packing suggestions are generated automatically, but they do not have those effects.

4. How we share information

We share personal information only as described here:

• Service providers (processors) that work for us under contracts that limit how they use your information, including hosting and infrastructure ([HOSTING / SYNC PROVIDER]), email delivery ([EMAIL SERVICE PROVIDER]), crash reporting ([CRASH REPORTING PROVIDER]), purchase management ([SUBSCRIPTION SDK]), customer support tools, and weather data ([WEATHER API PROVIDER], which receives the destination coordinates and dates you look up and your device's IP address, but not your name or traveler profiles).
• Advertising partners ([AD NETWORK]), on the free plan, which receive advertising identifiers, IP address, device information and ad-interaction data. See Section 5.
• Analytics partners ([ANALYTICS PROVIDER]).
• Google and Apple, to provide sign-in, purchases, and app distribution.
• People you share with. If you share a trip, the people you invite can see that trip's lists and traveler profiles.
• Legal and safety. When required by law or legal process, or to protect the rights, safety and property of our users, us or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this Policy.
• With your consent or at your direction.

We never share traveler profiles, children's information, routine answers or trip details with advertising partners.

5. Advertising, "sale," and "sharing"

The free plan shows ads. Paid plans do not show ads. We do not sell names, email addresses, traveler profiles or trip details for money.

However, some U.S. state laws define "sale" and "sharing" broadly. When our advertising and analytics partners use device identifiers, IP addresses, cookies or similar data to show you personalized ads across different apps and websites (called "cross-context behavioral advertising" or "targeted advertising"), that is "sharing" under California law and may be a "sale" or "targeted advertising" under other states' laws, even if the data does not include your name. In the past 12 months [OR: Since launch], we have sold or shared the following categories, only with advertising and analytics partners, only for advertising and analytics: identifiers (advertising ID, IP address, cookie IDs), internet or other electronic network activity (ad and app interactions), and approximate location inferred from IP address.

You can opt out at any time:

• Website: click Do Not Sell or Share My Personal Information or turn off "Advertising" in Cookie settings.
• App: go to Settings > Privacy > Do Not Sell or Share in the App, or use your device settings (Android: Settings > Privacy > Ads > Delete advertising ID; iOS: Settings > Privacy & Security > Tracking).
• Global Privacy Control (GPC): we treat a GPC signal from your browser or device as a valid request to opt out of sale and sharing for that browser or device, and, if you are signed in, for your account. We do not ask you to confirm it, and we do not show a pop-up that undoes it. If GPC conflicts with an earlier setting you chose, we follow GPC, and we may show a notice that it has been applied.

EU, UK and Swiss users: we show personalized ads only if you consent through our consent tool. Otherwise, you may see non-personalized or limited ads. You can change your choice anytime in Cookie settings (Site) or Settings > Privacy > Ad choices (App).

We do not knowingly sell or share the personal information of consumers under 16.

6. Retention

We keep personal information only as long as we need it for the purposes described above:

7. Your choices

• Email: use the unsubscribe link in any marketing email, or email [CONTACT EMAIL]. We process unsubscribes within 10 business days.
• Cookies and ads: use Cookie settings, the App's Privacy settings, or your device settings.
• Delete your account: in the App at Settings > Account > Delete account, or on the web at [ACCOUNT DELETION URL], or by emailing [CONTACT EMAIL]. Deleting the App alone does not delete your account.
• Edit traveler profiles: you can edit or delete any traveler profile at any time in the App.

8. Security

We use reasonable administrative, technical and physical safeguards, including encryption in transit (HTTPS/TLS), access controls, and [encryption at rest]. No system is perfectly secure. If a security incident affects your personal information, we will notify you and regulators as required by law.

9. Children's information

The Services are intended for adults. You must be 18 or older (or the age of majority where you live) to create an account or make purchases. The Services are not directed to children, and we do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK, or the age set by local law).

Packworthy helps parents and guardians pack for family trips, so parents can add traveler profiles for their children, such as a child's name or nickname, age, and packing-related details like diaper size stage or feeding method. When you add this information:

• you confirm that you are the child's parent or legal guardian, or have their permission;
• we use it only to build and share your family's packing lists;
• we do not use it for advertising, we do not share it with advertising or analytics partners, and we do not sell it;
• we ask you to use a nickname or first name only and to enter only what you need; and
• you can edit or delete it at any time, or ask us to delete it at [CONTACT EMAIL].

Children should not create accounts, sign in, or use shared lists on their own devices. If we learn that we have collected personal information directly from a child under 13 (or the relevant age) without verifiable parental consent, we will delete it. If you believe this has happened, contact us at [CONTACT EMAIL].

10. California privacy rights

This section applies to California residents and supplements the rest of this Policy. It is our notice at collection and our privacy policy under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").

10.1 Categories we collect, sources, purposes and disclosures (past 12 months)

We do not collect precise geolocation, government ID numbers, financial account numbers or biometric data.

10.2 Sensitive personal information

We use sensitive personal information only for purposes permitted by CCPA regulations (Cal. Code Regs. tit. 11, § 7027(m)), such as providing the Services you request and keeping them secure. We do not use it to infer characteristics about you. Because of this, we do not offer a "Limit the Use of My Sensitive Personal Information" option beyond these limits; you may still contact us with questions.

10.3 Your rights

You have the right to:

• Know what personal information we have collected about you, its sources, purposes, and to whom we disclosed, sold or shared it;
• Access a copy of specific pieces of your personal information, in a portable format;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of sale and sharing of your personal information, including through GPC (see Section 5);
• Limit the use of sensitive personal information (see 10.2); and
• Not be discriminated or retaliated against for exercising these rights.

10.4 How to submit a request

• In the App: Settings > Privacy > Privacy requests
• Online: [PRIVACY REQUEST FORM URL]
• Email: [CONTACT EMAIL], with the subject line "California privacy request"

We will confirm receipt within 10 business days and respond within 45 calendar days (we may extend once by another 45 days with notice). To protect you, we verify requests to know, access, delete or correct by matching information you give us to information we have, for example by asking you to confirm from your account email or to sign in. Opt-out requests do not require verification.

Authorized agents. You may use an authorized agent. We may ask for your signed permission and ask you to verify your identity directly with us, unless the agent has a valid power of attorney.

10.5 Notice of financial incentive

We offer some guides free in exchange for your email address or Google sign-in, and we offer a free, ad-supported plan alongside ad-free paid plans. These may be considered "financial incentives" or "price or service differences" under the CCPA. For gated guides, the material terms are: you give us your email address (and, with Google sign-in, your name and profile picture); in return you get access to additional guides. You can opt in by signing up and withdraw at any time by unsubscribing or deleting your account; you will keep access to guides already available without sign-up. We estimate the value of your email address and the ad-supported data to us at [VALUE ESTIMATE, e.g., approximately $X per subscriber per year], based on [METHOD, e.g., our expected costs and revenue from email marketing and advertising].

10.6 Other California notices

• Shine the Light (Cal. Civ. Code § 1798.83): we do not share personal information with third parties for their own direct marketing purposes.
• Do Not Track: our Site does not respond to browser "Do Not Track" signals, because there is no common standard for them. We do honor Global Privacy Control as described above.
• Metrics: [If required, link to annual request metrics.]

11. Other U.S. state privacy rights

If you live in a U.S. state with a comprehensive privacy law (such as Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia), you may have rights to confirm whether we process your personal data, access, correct, delete, and obtain a portable copy of it, and opt out of targeted advertising, sale, and certain profiling. To exercise these rights, use the methods in Section 10.4. We honor GPC as an opt-out of targeted advertising and sale.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing [CONTACT EMAIL] with the subject line "Privacy appeal." We will respond within the time required by your state's law (generally 45–60 days). If you are not satisfied with our appeal decision, you may contact your state Attorney General.

Consumer health data. We do not intend to collect "consumer health data." Please do not enter medical details. Any routine answers (for example, "I take daily medication") are used only to add a reminder to your packing list, are not shared with advertisers, and can be deleted at any time. [If the attorney concludes Washington's My Health My Data Act or Nevada's SB 370 applies, add a separate Consumer Health Data Privacy Policy and link it here.]

12. EU, UK and Swiss users

12.1 Controller and representatives

The controller is [LEGAL ENTITY] (dba AutoOps), [MAILING ADDRESS], USA, [CONTACT EMAIL].

• EU representative (GDPR Art. 27): [EU REPRESENTATIVE NAME, ADDRESS, EMAIL]
• UK representative (UK GDPR Art. 27): [UK REPRESENTATIVE NAME, ADDRESS, EMAIL]
• Data Protection Officer: [DPO NAME AND EMAIL, or "We have not appointed a DPO because we are not required to; contact [CONTACT EMAIL] with any privacy questions."]

12.2 Lawful bases

Our lawful bases for each purpose are in the table in Section 3. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

12.3 Your rights

You have the right to access, rectify, erase, restrict, and port your personal data; to object to processing based on legitimate interests and to object at any time to direct marketing; to withdraw consent; and to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk). To exercise your rights, use the methods in Section 10.4. We will respond within one month (extendable by two months for complex requests).

12.4 International transfers

We are based in the United States, and we and our service providers process personal information in the United States and other countries. When we transfer personal data from the EEA, UK or Switzerland, we rely on [the EU-U.S. Data Privacy Framework, UK Extension and Swiss-U.S. DPF where our providers are certified, and] the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss equivalents), together with supplementary measures where needed. You can ask for a copy of the relevant safeguards at [CONTACT EMAIL].

12.5 Required or optional data

You need to give your email address to create an account or access gated guides, and trip and traveler information to get a packing list. Other information is optional.

13. Other countries

If you live in Canada, Australia, Brazil, or another country with privacy laws, you may have similar rights to access, correct, and delete your information and to withdraw consent. Contact us at [CONTACT EMAIL].

14. Third-party links

The Services contain links to third-party websites, including affiliate links. Their privacy practices are governed by their own policies.

15. Changes to this Policy

We may update this Policy. If we make material changes, we will notify you on the Site, in the App, or by email before they take effect, and we will update the "Last updated" date.

16. Contact us

[LEGAL ENTITY] (dba AutoOps) [MAILING ADDRESS] Email: [CONTACT EMAIL]

Cookie settings: Open cookie settings