Privacy Policy

Mobile app, artwork and privacy choices

Artwork you choose to upload is sent to private Cloudflare R2 storage so it can be placed on your design and included in previews and exports. We store the image, filename, type, dimensions and its association with your account and design. Uploading does not publish your artwork to other users. We process it to provide the design features you request. An image referenced by saved export history can remain stored after you remove it from the current canvas, so that saved design continues to work.

The mobile app stores your sign-in token in the device's secure storage. Language, bookmarks, onboarding status and analytics choice are stored locally. The app may create temporary files for previews and exports. Files you download or share using your device are under your control; deleting your account does not remove copies you have saved or sent elsewhere.

Mobile usage analytics is optional and off until you consent. If enabled, Google Analytics for Firebase receives screen and app interaction measurements, an app-instance identifier, and device and app information such as operating system and app version. Google can derive approximate geographic information from the connection's IP address. We use this to understand usage and improve the app, not to serve advertising. Advertising ID collection and advertising personalization are disabled in the mobile app.

You can change the mobile analytics choice in the app's settings. Turning it off stops future analytics collection and resets the analytics data held locally by the SDK; it does not automatically erase measurements already sent to Google. The cookie-banner and Cookie settings instructions below apply to the website. Mobile analytics consent is controlled separately in the app. Analytics is based on your consent; account, artwork and export processing is needed to provide the features you request.

You can request account deletion from the app's account settings or by contacting the email address below. After ownership verification and confirmation, access is revoked and account data, private artwork and export history are removed through the deletion process. We show its completion deadline and any legally required retention before confirmation. Subscription cancellation and third-party sign-in cleanup are part of that process. Contact us using the address below for access, correction or deletion requests, including questions about analytics data.

The app does not require contacts or precise device location to design packaging. Images and files are accessed when you choose to add artwork, open a file or save an export. Google and Cloudflare may process data internationally; the service-provider and international-transfer disclosures below also apply to the mobile app. Packdroid is intended for people aged 16 and over.

Delete your Packdroid account

Permanently delete your Packdroid account and its associated data from the website. You do not need to install the app.

Deletion removes your account, saved artwork, export history and account access across your devices. Download anything you want to keep before continuing.

Active Packdroid subscriptions will be cancelled as part of deletion. Deletion does not automatically issue a refund.

Required billing and tax records may be retained for legal reasons. Before confirmation, we show the retention notice and completion deadline for your request.

Sign in with Apple, when selected in the mobile app, provides an Apple account identifier, an email address (which may be an Apple private relay address), and a name if Apple supplies it. Encrypted provider tokens support sign-in and revocation. Apple also relays account-status notifications and, when Hide My Email is used, account emails.

Account deletion uses a session-bound request and a verification code sent through Resend. Resend processes the recipient address and the code/completion messages. The server stores a keyed code verifier and a limited receipt record; encrypted cleanup jobs contain the information needed to cancel subscriptions, revoke Apple access and remove private data.

1. Who we are

Packdroid provides web and mobile software for packaging design. We are the data controller for the personal data described in this policy.

Packdroid is operated by INSOFTEN TEKNOLOJİ BİLİŞİM YAZILIM DANIŞMANLIK VE PAZARLAMA ANONİM ŞİRKETİ, a company registered in Türkiye. Our registered address is Başakşehir Mah. Nurettin Topçu Cad. Baytel Sitesi No: 23B İç Kapı No: 1 Başakşehir / İstanbul, and our MERSİS number is 0103145317700001.

You can reach us about anything in this document, including any request about your own data, at hello@packdroid.com or at the postal address above.

2. Data we collect

We collect only what the service needs to work. Specifically:

• Account details — your email address, an optional display name, and your password. Your password is never stored: we keep only an Argon2id hash of it, which cannot be reversed back into your password.
• Google sign-in (only if you choose it) — your Google account identifier, your email address, and your name, as supplied by Google. We request only the openid, email, and profile scopes. We never receive your Google password and have no access to your Gmail, Drive, Calendar, or contacts.
• Session data — a hashed session token, its expiry, your IP address, and your browser's user-agent string. The IP and user-agent let you see where your account is signed in and let you sign out a device you no longer recognise.
• Usage records — for each dieline you generate we record the template used, the dimensions and parameters you entered, and whether the render succeeded. This is what lets us reproduce and fix a problem you report.
• Problem reports — if you flag a template as producing wrong output, we store your description, the template, and the parameters that produced it.

3. Data we do not collect

• We do not store your password in a readable form, and nobody at Packdroid can see it.
• We do not collect or store payment card details. Subscriptions are sold by Paddle.com Market Ltd. as merchant of record, and it takes card details directly; they never reach our servers. We receive only the customer identifier, the plan bought, and its status.
• We do not sell your personal data, and we do not share it for advertising.
• We do not claim ownership of the dielines you design. See our Terms of Service.

4. Why we use it, and our legal basis

Each purpose below is followed by the legal basis we rely on for it, as the GDPR and KVKK require. Where the basis is your consent, you may withdraw it at any time, and withdrawing it does not affect what we did before you did so.

• To create and secure your account, and to keep you signed in — necessary to perform our contract with you.
• To send account emails: confirming your address, and resetting your password. These are transactional messages, not marketing — necessary to perform our contract with you.
• To generate, render, and deliver the dieline files you ask for — necessary to perform our contract with you.
• To investigate and fix incorrect template output that you or another customer reports — our legitimate interest in selling geometry that is correct, which we weigh against the little personal data a problem report contains.
• To protect the service against abuse — rate limiting sign-in attempts, for example, so nobody can guess their way into your account — our legitimate interest in keeping the service and your account secure.
• To measure which parts of the catalogue and studio are used, through Google Analytics — your consent, given on the cookie banner and withdrawable from “Cookie settings” at the foot of every page.
• To keep the sales, invoicing and tax records the law requires of us — a legal obligation.

5. Cookies

We use as few cookies as we can. The strictly necessary ones keep you signed in, secure that sign-in, remember your cookie choice, and let our payment provider take a payment; they cannot be turned off without breaking the service.

Everything else is opt-in. Google Analytics measures which parts of the catalogue and studio people use, and it does not load at all unless you allow it on the banner shown on your first visit. You can change or withdraw that at any time from the “Cookie settings” link at the bottom of every page — no analytics data is collected before you accept, or after you withdraw.

The Cookie Policy lists every cookie and browser storage key by name, with its purpose and how long it lasts.

6. Who we share it with

We use the external services below, and only for the purposes given. No count is stated here on purpose — a number is one more thing to go stale when a supplier changes.

• Hetzner Online GmbH — hosts our servers and the account and service records stored there. Uploaded artwork is stored separately with Cloudflare R2 as described above. Our servers are in Helsinki, Finland, inside the European Economic Area.
• Paddle.com Market Ltd. — sells every Packdroid subscription as merchant of record. It takes your payment details directly; card numbers never reach our servers and we never store them. Because Paddle is the seller rather than a supplier acting on our instructions, it decides on its own account what it does with the billing data, and its own privacy notice covers that.
• Resend — delivers our account emails (address confirmation and password reset). Resend receives your email address and the contents of those messages. Our sending region is the EU (Ireland).
• Cloudflare — sits in front of the site to serve it quickly and absorb attacks. Every request passes through it, so it processes your IP address in transit.
• Google — if, and only if, you choose to sign in with Google. Google tells us your account identifier, email, and name. Separately, Google Analytics receives usage measurements as described above.
• We may also disclose data where the law requires it, or to protect the rights and safety of our users.

7. How long we keep it

• Account data — for as long as your account exists.
• Sessions — 30 days, then they expire and are deleted automatically.
• Email confirmation links — 24 hours. Password reset links — 1 hour. Both are single-use and only the hash is stored, so a copy of our database would not let anyone reset your password.
• Usage records and problem reports — kept while they remain useful for fixing the templates they describe.

8. How we protect it

• Passwords are hashed with Argon2id, the algorithm currently recommended by OWASP for password storage.
• Session tokens and email links are stored only as SHA-256 hashes. Even a full database disclosure would not yield a working session or a usable reset link.
• All traffic between your browser and Packdroid is encrypted with TLS.
• Changing your password immediately signs out every other device, so a reset actually ends an intruder's access.

9. Your rights

Under the GDPR and, in Türkiye, under KVKK (Law No. 6698), you have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive a copy in a portable format.

To exercise any of these, email hello@packdroid.com. We will respond within 30 days. If you are unhappy with our response you may complain to your local data protection authority — in Türkiye, the KVKK Authority (KVKK Kurumu).

10. International transfers

Our email provider processes messages in the European Union. Google may process sign-in and analytics data outside your country under its own safeguards. Where data leaves the EEA or Türkiye, it does so under the legal transfer mechanisms those regimes require.

11. Children

Packdroid is a professional tool for packaging design and is not directed at children. We do not knowingly collect data from anyone under 16.

12. Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. For significant changes we will tell you by email.