The plain-words version of this lives at How we treat your stuff. This page says the same things in the shape a privacy notice is expected to take.
We Pack Together is the service at wepacktogether.com. For anything about your data — questions, requests, complaints — email hello@wepacktogether.com and a human will answer.
Two kinds of things. Your account: the email address and name you sign up with (or that Google passes us if you sign in with Google — those same two things, nothing else). And what you type in: trips and events, dates, locations, lists, items, who's bringing what, meals, dietary notes, and the names of the people on them. People on a trip or event can be just a first name with no account — including children, whose names are entered by the adult organising it. We never ask children for anything, and accounts are for adults organising their own packing.
We hold your account details and trip or event content because that's the service — keeping shared packing lists for you and your group (in GDPR terms, performance of a contract). We hold operational records like sign-in sessions to keep accounts secure (legitimate interest). There is no basis to look for beyond those, because we don't do anything else with it: no profiling, no advertising, no sale of data, ever.
If you publish a list as a template and then take the further step of publishing it to the web, its item names, categories, quantities, and a few frozen facts about its shape become publicly readable and indexed by search engines, without a We Pack Together account. This only happens when you take that specific action — never automatically, and never for a list shared only with other signed-in users of the app.
Supabase hosts our database and handles sign-in — everything you type lives in a Postgres database they host, and nowhere else. Google is involved only if you choose “sign in with Google”, and only to tell us your name and email; we tell it nothing back. If you've added a postcode to a trip or event, we send it to two free weather services — postcodes.io and Open-Meteo — to show a forecast in the header; they receive the postcode alone, nothing else about the trip. There are no analytics providers, no advertising networks, and no tracking scripts on any page.
Only the ones that keep you signed in. No advertising cookies, no analytics cookies, no third-party cookies — which is why there's no cookie banner to click through.
A trip or event is visible only to its members — enforced in the database, not just the interface. An invite link shows its name, dates and members' first names to whoever holds it, so a friend can look before joining; treat it like a spare key, and reset it from the People page if it gets somewhere it shouldn't. Your email is never shown to anyone on your trip or event. The one further exception: if you mark an item on your gear list as shared, its name, category and photo become visible to people you've been on a trip with — including a past trip, not only your current one — until you turn sharing off for that item. Off by default, chosen per item, and never anything beyond the item itself.
While you use it. Deleting an item, a trip or event, or your whole account removes the data from the live database immediately — not archived, not soft-deleted. Our hosting provider keeps short-lived database backups for disaster recovery, which expire on their own schedule.
Under UK and EU data-protection law you can ask for a copy of your data, have it corrected, have it deleted, take it elsewhere, or object to how it's used. Most of that is built in: every trip and event has an Export link, and the account page has a real “delete my account”. For anything else, email us. If you think we've handled your data badly, you can complain to your data-protection authority — in the UK, the ICO.
If we ever add a third party, use email beyond signing in, or change anything else this page promises, this page and /trust change in the same release — the promises and the code travel together.
This notice is written in plain words on purpose and hasn't yet been through a legal review. If anything in it understates your legal rights, your rights win.