Privacy policy

Vercel Web Analytics

We use Vercel Web Analytics to understand aggregate visits, referring websites, device/browser types and approximate regions, and improve Stowtrail (Article 6(1)(f) GDPR: our legitimate interest in improving the service). It uses no analytics cookies or persistent browser storage. Vercel derives a temporary visitor hash from request data and discards the visitor session after 24 hours. Our current dashboard shows 30 days of statistics. We replace private URL paths with general page names and remove queries and fragments before measurement. No packing-list contents, account details or share tokens are included in analytics events. Measurement is skipped when your browser sends Do Not Track or Global Privacy Control, or when a referring URL cannot be safely included. You can enable those browser signals to object to this measurement. Contact us for other privacy requests.

Privacy contact

For privacy requests, contact contact@stowtrail.app.

Visiting the website

Vercel hosts and delivers the website. Requests can include your IP address, browser and device information, requested URL, time and technical error information. This is used to deliver the site, diagnose faults and protect it from abuse (Article 6(1)(f) GDPR: our legitimate interest in reliable, secure operation). Fonts, illustrations and the tutorial video are served by Stowtrail. We use cookieless Vercel Web Analytics as explained below; no advertising scripts are included.

Account, gear and packing lists

Supabase provides authentication, the database and photo storage. The project database is located in Frankfurt, Germany. We process your email address, username, authentication data, optional profile photo, packing lists, gear, groups, notes, links, weights and uploaded images to provide the account and features you request (Article 6(1)(b) GDPR). An email address, username and password are needed to register. Profile photos and additional gear details are optional. Without an account you can use the demo and read shared lists.

Photos selected from files or the phone camera are resized and re-encoded in your browser before upload. Camera use starts only after you select Take photo; device permissions depend on your browser. Profile photos are private; gear photos can be visible through an enabled share link.

Account emails

Resend sends registration confirmation, password reset and email-change confirmation messages on behalf of Stowtrail. It processes the recipient’s email address, message content, delivery status and technical delivery information. These messages are needed to operate and secure your account (Article 6(1)(b) and (f) GDPR). The sender is noreply@stowtrail.app. This app does not send marketing newsletters.

Contact requests

When you email contact@stowtrail.app, ImprovMX forwards the message to the operator’s Gmail mailbox provided by Google. Your sender address, message, attachments and technical delivery information are processed to receive and respond to your request. The basis is Article 6(1)(b) GDPR for requests concerning the service or Article 6(1)(f) GDPR for our legitimate interest in handling other enquiries. Correspondence is kept as needed to handle the request and fulfil applicable retention obligations.

Sharing and external content

Anyone with a share link can view the selected packing lists, items, groups and their photos without signing in. Saved changes are reflected automatically. You can deactivate the link; copies or downloads already made by other people cannot be recalled. Your account profile and unselected lists are not included.

Item photos are added by file upload or camera and stored in private Supabase Storage. Authorized viewers, including visitors to a shared list, receive the photos through temporary signed URLs. The item editor does not accept external image URLs. Product links open the linked website only when selected; that provider’s privacy terms then apply.

Browser storage

The app uses local browser storage for sign-in, your chosen preferences, offline copies of account lists and the gear library, and pending packing checks. A service worker caches app files for offline use. These are functional features, not advertising profiles. Details and removal instructions are in Cookies & storage.

When you choose an offline download, the browser also stores account-specific copies of that list’s item and group photos. Remove download clears photos no longer needed by other downloads; signing out clears the account’s downloaded photos. Browser storage may be cleared or evicted and is not a backup.

Retention and deletion

Account data remains available while the account is in use. You can edit or delete packing lists and gear in the app. Deleting a library entry may retain it for existing list references; the delete dialog offers removal from all lists. Unreferenced photos older than 24 hours can be reviewed and removed with Clean unused photos. This is not an automatic 24-hour deletion rule.

Deleted lists, library entries and supported item or group placements are recoverable from Trash for 30 days. A library deletion does not change archived tour snapshots. Restoring data does not recreate deleted share links or reverse a duplicate merge. This recovery period is separate from a request to erase the account.

Account-wide erasure requests can be sent to contact@stowtrail.app. There is currently no account-deletion button. Deleted data may remain temporarily in backups or technical logs.

Service providers and international processing

Vercel, Supabase, Resend, ImprovMX, Google (Gmail) and their infrastructure providers participate in processing. An EU database location does not mean every processing operation is restricted to the EU. Support, delivery and infrastructure operations can involve other countries, including the United States. The provider documents below describe their terms.

Your rights

Under the GDPR, subject to the applicable conditions, you may request access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests and withdraw any consent for the future. You can complain to a data protection supervisory authority, particularly where you live, work or where a suspected infringement occurred. There is no automated decision-making with legal or similarly significant effects and no advertising profiling in this app. For these requests, contact contact@stowtrail.app.