Privacy Policy

Last updated: March 22, 2026

1. Who We Are (Controller)

PackLite is operated by Brian Patrick Douglas, Hügelistrasse 5, 9535 Wilen bei Wil, Switzerland, reachable through our contact form. This person / entity is the data controller within the meaning of the Swiss Federal Act on Data Protection (nDSG) and the EU General Data Protection Regulation (GDPR) where applicable.

2. What Personal Data We Collect

  • Account data: your name, email address, and hashed password when you register.
  • Usage data: hiking trips, gear items, and preferences you enter into the app.
  • Billing data: payment information is processed exclusively by Stripe, Inc. We store only your Stripe customer/subscription ID – we never see your full card number.
  • Technical data: server access logs (IP address, browser, timestamp) retained for up to 30 days for security and debugging purposes.
  • Usage statistics: we count visits and page views on our own server, without cookies, with the last part of your IP address removed before it is stored and without any location lookup. These statistics are not shared with anyone and are not linked to advertising.
  • Travel tickets and bookings: when you import tickets or accommodation booking confirmations into a trip, the files and text you upload are read once to fill in your travel legs and the stays in your itinerary, and are not stored. The trip keeps what you confirm, including seat numbers, booking references and the property's phone number, e-mail address and website; PINs, access codes and check-in links in a confirmation are never taken.
  • Push notifications (Android app): if you switch on trip notifications, we store the push token that addresses the PackLite app on your phone, and a record of each notification sent so that none is sent twice. The token is deleted when you sign out of the app, when you delete your account, or when Google reports that it no longer works.
  • Contact form messages: the name, email address and message you submit through our contact form, together with the IP address and browser user agent of the submission, which are kept solely to identify automated spam.
  • Cookies: strictly necessary first-party cookies for signing in, and – only on the free plan and only with your consent – advertising cookies set by Google. Every cookie is listed by name in section 7 (Cookie Policy).
  • Advertising data: when you consent to advertising cookies, Google receives the page you are viewing, your IP address, browser information and the identifiers stored in its cookies in order to select, serve and measure ads. We do not pass your name, email address or any of your gear or trip data to Google for advertising.

3. Legal Basis for Processing

  • Contract performance (Art. 6(1)(b) GDPR / Art. 31(2)(a) nDSG): account and usage data are processed to provide the service you signed up for.
  • Legitimate interests (Art. 6(1)(f) GDPR / Art. 31(2)(b) nDSG): server logs and cookie-free usage statistics are kept to detect abuse, ensure security and understand how the service is used.
  • Consent (Art. 6(1)(a) GDPR / Art. 31(1) nDSG): advertising cookies and the personalised advertising they enable are set only after you have consented in the cookie banner. You can withdraw that consent at any time through Cookie settings in the footer of every page, with effect for the future.
  • Legal obligation: we may retain data as required by applicable Swiss law (e.g. commercial records under OR Art. 958).

4. Data Sharing & Third Parties

  • Stripe, Inc. – payment processing. Stripe is GDPR-compliant and processes data under its own privacy policy. Data may be transferred to the United States under the EU–US Data Privacy Framework.
  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – advertising (Google AdSense) and the cookie consent banner (Google Privacy & Messaging). Google is an independent controller for the advertising data it collects and processes it under its own privacy policy and partner-sites notice. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU–US Data Privacy Framework, which the Swiss Federal Council recognises as providing adequate protection (Swiss–US Data Privacy Framework). Advertising data is only shared once you have consented; the consent banner itself is loaded from Google and stores your choice in a cookie.
  • OpenAI, L.L.C. (United States) – our AI provider. When you use the ticket and booking import or the photo import, the files, photos and text you upload are sent to OpenAI's API so that the travel legs, stays or gear details can be read from them; nothing else about you or your account is sent. OpenAI processes this data under its own privacy policy. Data is transferred to the United States.
  • Microsoft Corporation (United States) – only if you connect Microsoft To Do (Pro). Each task you sync is sent to Microsoft Graph with its title, notes, status, importance, due date and reminder time, so it appears in your To Do list; nothing else about you or your account is sent. Microsoft processes this data under its own privacy statement. Data is transferred to the United States. You can disconnect at any time on the Tasks page.
  • Google Ireland Limited – Firebase Cloud Messaging, only if you switch on trip notifications in the Android app. Each notification is sent with your phone’s push token to Firebase Cloud Messaging, which delivers it to your phone: its text, such as the trip’s name, tomorrow’s train with its time and seat, or tomorrow’s stage and stay, and the page it opens. Nothing else about you or your account is sent. Google processes this data on our behalf under the Firebase data processing terms. Data may be transferred to Google LLC in the United States under the Swiss–US and EU–US Data Privacy Framework. You can switch each kind of notification off on your profile at any time.
  • Hosting provider – servers are hosted on Fly.io. Only infrastructure access (backups, monitoring) applies; they have no access to your personal data beyond what is technically necessary.
  • We do not sell, rent, or share your personal data with any other third parties.

5. Data Retention

Your account data is stored for as long as your account is active. After account deletion, all personal data is purged within 30 days, except where a longer retention period is required by Swiss law (e.g. 10-year retention of financial records under OR Art. 958f).

Messages sent through the contact form are kept only for as long as they are needed to answer your enquiry and are deleted at the latest 12 months after the exchange ends.

Cookie lifetimes are listed in section 7. Data Google collects through advertising cookies is retained according to Google's own policies.

6. Your Rights

Under the nDSG (and GDPR where applicable) you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Erase your data ("right to be forgotten")
  • Restrict or object to processing
  • Data portability
  • Withdraw consent at any time – for advertising cookies via Cookie settings in the page footer
  • Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC – www.edoeb.admin.ch) or your local EU supervisory authority

You can download a copy of everything your account holds, in a machine-readable JSON file, at any time under Account → Download my data. To exercise any of the other rights, please use our contact form.

7. Cookie Policy

This section lists every cookie PackLite sets or allows a third party to set, with its name, purpose, who sets it and how long it lasts. Cookies fall into two groups: strictly necessary cookies, which need no consent and cannot be switched off, and advertising cookies, which are set only after you accept them in the cookie banner. There is no analytics category: our usage statistics are counted on our own server without cookies (see section 2).

7.1 Advertising and the free plan

PackLite is free to use with advertising, or ad-free on the Pro plan. Advertising is shown only to accounts on the free plan and to visitors who are not signed in when reading the public blog. Pro accounts see no advertising and no advertising script is loaded for them. No advertising is shown inside the PackLite mobile app. Ads are served by Google AdSense and are always labelled "Advertisement".

When advertising is switched on, a consent banner from Google Privacy & Messaging asks for your choice before any advertising cookie is set. You can accept, reject, or manage your choice, and you can change it at any time via Cookie settings in the footer. If you do not consent, no advertising cookie is set and Google shows at most limited, non-personalised ads that do not rely on cookies. Consent-based advertising follows the IAB Transparency & Consent Framework (TCF v2.2), and your choice is passed to Google as a TCF consent string.

7.2 Strictly necessary cookies (first party, no consent required)

  • _pack_lite_session – keeps you signed in, remembers your language choice and carries the CSRF token that protects forms against forged requests. Set by PackLite. Expires when you close your browser or sign out.
  • gear_view – remembers whether you last viewed your gear list as a grid or a table. Set by PackLite. Expires when you close your browser.

PackLite also stores your chosen colour design in your browser's local storage (packlite-design). This is not a cookie, is never sent to our server and stays until you clear your browser data.

7.3 Consent banner cookies (first party, set by Google's consent tool)

These cookies exist only where advertising is switched on. They record your consent choice so the banner does not reappear on every visit, and are therefore strictly necessary for honouring that choice.

  • FCCDCF – stores your consent choice for the Google Privacy & Messaging banner. Set on our domain by Google. Lasts 13 months.
  • FCNEC – stores the state of the consent banner and its messages. Set on our domain by Google. Lasts 365 days.

7.4 Advertising cookies (only with your consent)

All advertising cookies are set by Google (Google Ireland Limited; data may be transferred to Google LLC, USA – see section 4) and are used to serve ads, limit how often you see the same ad, measure ad performance and detect fraud and abuse. Where consent is given, they may also be used to personalise ads based on your activity on this and other sites. Lifetimes below are Google's published values; the shorter figure applies in the EEA, UK and Switzerland where Google states one.

Set on our domain (packlite.ch):

  • __gads – ad serving and frequency capping, security. Lasts 13 months.
  • __gpi – ad serving and measurement, security. Lasts 13 months.
  • __gpi_optout – records an opt-out from personalised advertising. Lasts 13 months.
  • __eoi – fraud and abuse detection. Lasts 6 months.
  • __gsas – ad serving, security. Lasts 3 months.
  • FPGCLDC – ad measurement and security. Lasts 90 days.

Set on Google's domains (doubleclick.net, google.com):

  • IDE (doubleclick.net) – identifies your browser to serve and measure ads across websites. Lasts 13 months in the EEA, UK and Switzerland (24 months elsewhere).
  • test_cookie (doubleclick.net) – checks whether your browser accepts cookies. Lasts 15 minutes.
  • DSID (doubleclick.net) – links ad activity to a signed-in Google account, where you have one. Lasts 2 weeks.
  • FLC (doubleclick.net) – short-lived ad-serving cookie. Lasts 10 seconds.
  • RUL (doubleclick.net) – measures whether ads were displayed correctly. Lasts 12 months.
  • receive-cookie-deprecation (doubleclick.net) – browser compatibility signal for ad serving and security. Lasts 6 months.
  • NID (google.com) – remembers Google preferences and is used for security, ad selection and ad measurement. Lasts 6 months.

The list of Google's advertising cookies is maintained by Google at business.safety.google/adscookies; we update this section when it changes. You can also opt out of personalised advertising by Google directly at adssettings.google.com, and delete any cookie at any time through your browser settings.

8. Security

Passwords are stored as bcrypt hashes and are never readable in plaintext. All data is transmitted over HTTPS (TLS 1.2+). Access to production data is restricted to the operator.

9. Emails We Send

We send three categories of email:

  • Newsletter (marketing): news, tips, and product updates. You choose this at sign-up (the option is pre-selected and can be declined) and can opt out at any time via the unsubscribe link included in every newsletter or in your account settings (legal basis: consent, Art. 6(1)(a) GDPR / Art. 31(1) nDSG).
  • Product reminders & tips: emails related to your own content and account activity — for example a reminder to review a completed trip, or getting-started tips for new accounts (such as creating your first trip or pack). These are enabled by default (legal basis: legitimate interest, Art. 6(1)(f) GDPR / Art. 31(1) nDSG); you can turn them off at any time in your account settings or via the unsubscribe link included in every such email.
  • Service emails: essential messages about your account — for example email verification, password resets, a welcome message when you register, important service updates, or changes to these legal documents. They are part of operating the service (legal basis: contract performance) and are sent to all account holders; they cannot be opted out of while you have an account.

10. Changes to This Policy

We will notify registered users by email of any material changes at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

11. Contact

Brian Patrick Douglas
Hügelistrasse 5
9535 Wilen bei Wil, Switzerland

Questions about this policy? Please use our contact form.