Privacy Policy
packdev.app · Effective date: 2026-09-26 · Version 0.2 (beta)
1. Who we are
packdev ("packdev", "we", "us") is a web application for packaging engineers: palletization, box compression (BCT) and load calculations.
During the beta, the controller of your personal data is:
Konstantin Avramenko, Serbia
Email: privacy@packdev.app
We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection.
2. What data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, name, profile identifier from Google or Microsoft if you sign in with them | You / your sign-in provider |
| Sign-in attempts | The email address entered in the sign-in form and a hashed one-time code — recorded for any address entered, including addresses that are not invited to the beta | The person who fills in the form |
| Workspace data | Workspace name, members and their roles, invitations | You and your teammates |
| Work data | Box, pallet and load parameters, projects, calculation inputs and results, issued report revisions (PDF) | You |
| Plan data | Active plan, promo codes you redeemed, their validity | Us |
| Security and technical data | IP address, browser type, timestamps of sign-ins and key actions (audit log), server logs, bot-protection signals | Your device, Cloudflare |
| Communications | Emails you send us, feedback. A feedback message may include a screenshot you attach; it is stored on our server | You |
| Analytics | Aggregated page views without cookies or cross-site tracking (Cloudflare Web Analytics); product analytics events recorded on our server (which feature was used, when, the page path, and the main dimensions of a calculation — for example, box size — but not the contents of your projects) | Your device / your use of the Service |
We don't need, and ask you not to enter, special categories of personal data (health, religion, etc.). Work data is normally technical, not personal.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Create and run your account and workspaces, perform calculations, generate reports | Contract (b) |
| Sign-in, including sending one-time codes by email | Contract (b) |
| Limiting one-time code requests and sign-in attempts for any address entered in the sign-in form | Legitimate interest (f) — protecting the sign-in form and other people's mailboxes from abuse |
| Promo codes and plan management | Contract (b) |
| Security: preventing abuse, bots and unauthorised access; audit log | Legitimate interest (f) — keeping the service and your data safe |
| Service emails (security notices, important changes) | Contract (b) |
| Analytics to improve the product | Legitimate interest (f) — understanding which features are used |
| Answering your requests | Contract (b) |
| Complying with legal obligations | Legal obligation (c) |
Do you have to give us this data? Your email address is required to create an account and to sign in — without it we cannot provide the Service. Everything else is optional: you choose what box, pallet and load parameters to enter, and you can use the Service without giving us a name. Security and technical data (IP address, timestamps) is generated automatically when you use the Service and cannot be switched off while you use it.
Objecting. Where we rely on legitimate interest, you can object at any time by writing to privacy@packdev.app, and we will stop unless we have compelling grounds that override your interests.
We do not sell your data, show ads, or use your work data to train machine-learning models. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. Where your data is stored
The application and its database run on a server we operate in Serbia. Encrypted backups are stored with Cloudflare R2; they are encrypted on our server before upload, and Cloudflare cannot read them. The website and web app are delivered through Cloudflare's global network.
5. Who we share it with, and where it goes
Service providers acting for us (processors). Cloudflare, Inc. (network, delivery of the website and app, bot protection, analytics, encrypted backups) and Resend (delivery of transactional email). They act only on our instructions, under a data processing agreement.
Independent providers you choose. If you sign in with Google or Microsoft, that sign-in happens at Google or Microsoft. They are separate controllers of the data they process for that sign-in, under their own privacy policies; we receive only your email address and a stable account identifier.
Where the data goes. Our server and database are in Serbia. Serbia is not covered by a European Commission adequacy decision; where we are subject to the GDPR, transfers between the EU and Serbia therefore rely on the safeguards described below.
Cloudflare, Resend, Google and Microsoft are established in the United States. Transfers to them rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can obtain a copy of the safeguards we rely on for any given provider by writing to privacy@packdev.app. Under Serbian law, transfers outside Serbia rely on the list of countries adopted by the Government, on the standard contractual clauses issued by the Commissioner, or on the statutory exception for transfers necessary to perform the contract we have with you.
The current list of providers is at packdev.app/legal/subprocessors. We will update it before adding a new provider.
Members of a workspace can see the data in that workspace. We may disclose data if required by law or to protect rights and safety.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and workspace data | While your account exists |
| After you delete your account | Removed from the live system immediately; removed from encrypted backups within 90 days as they rotate |
| Data in a shared workspace | Stays with the workspace until the workspace owner deletes it |
| Server logs | 30 days |
| Audit log | 12 months |
| Product analytics events | 12 months; anonymised immediately when you delete your account |
| Feedback screenshots | 30 days |
| One-time sign-in codes | Usable for 10 minutes. A record of each request (the email address entered and a hashed code) is created for any address entered in the sign-in form, although a code is emailed only to invited beta users; the record is kept for 1 hour and removed by the next daily clean-up |
| Inactive accounts | After 24 months without sign-in we'll email you; if you don't sign in within 30 days, the account is deleted |
7. Your rights
You have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interest. You can:
- Export your data from account settings (JSON).
- Delete your account from account settings.
- Email privacy@packdev.app for anything else. We answer within one month.
You may also lodge a complaint with a data protection authority: in the EU, the authority in your country of residence or work; in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik).
8. Cookies and local storage
We use only what is strictly necessary to run the Service:
| Cookie | Purpose | Lifetime |
|---|---|---|
session | Keeps you signed in | 30 days |
oauth_state | Protects the sign-in redirect against forgery | 10 minutes |
oauth_return_to | Remembers the page you were on before you signed in | 10 minutes |
| Cloudflare cookies, including those set by the Turnstile anti-bot check | Security and bot protection | Set by Cloudflare under its own policy |
We also store a small amount of data in your browser (local storage) to remember interface preferences such as language and theme. The same rules apply to it as to cookies.
None of this is used to track you across other websites, and our page analytics are cookieless. We therefore don't show a cookie banner. If we ever add anything that is not strictly necessary, we will ask for your consent first.
9. Security
Traffic is encrypted (TLS). Our server is isolated from other networks, has no open inbound ports and is administered only through private, key-based access. Backups are encrypted client-side. Access to production data is limited to the operator. If a personal-data breach is likely to put your rights at risk, we will notify the competent authority within 72 hours and inform affected users without undue delay.
10. Children
packdev is a professional tool and is not intended for anyone under 16.
11. Changes
We will post changes here and update the effective date. For material changes we will notify registered users by email before they take effect.
12. Contact
privacy@packdev.app