Privacy policy

This translation is provided for convenience; in case of dispute the Estonian text prevails.

Effective from 27.09.2026

This policy describes what personal data Pack with Pals (packwithpals.com) processes, why and for how long, with whom it is shared, and what your rights are.

1. Controller

Tarkvõrk OÜ (registry code 12404406), Estonia. For data protection matters, write to: support@gridea.io.

2. What data we process

• Account: name, e-mail address or a username you choose, PIN (only as a cryptographic hash — we do not know the PIN itself), and a security question and answer (the answer also as a hash) — required for an account with a username, otherwise optional.
• Your content: lists and their shared and private items, your essentials, links and comments, the list’s dates, who brings what and what has been packed.
• Sharing: who is a member of a list, requests to join and to recover a PIN.
• Technical data: the sign-in cookie (see Cookies); IP address and e-mail or username in hashed form for limiting excessive attempts (deleted within 24 hours); ordinary server request logs; a log of e-mails sent (recipient, time, outcome — the content of the message is not kept).
• Language: your account’s language, so that we can write e-mails to you in it.
• Telegram (if you connect it): your Telegram chat ID, which account it is linked to, when it was linked and which list you last chose. Telegram update IDs are kept for about a day so that no message is processed twice. The text of messages is not stored.

3. Health data

You may also add health data to your private items, for example medicines. This is entirely your choice: only you can see it, and we process it only to show it to you in your list. By creating an account you give your explicit consent to this. You can withdraw your consent at any time by deleting those items or your whole account.

4. Purposes and legal bases

• Providing the service (account, lists, sharing, sign-in and PIN recovery e-mails) — contract with you (GDPR Art. 6(1)(b)).
• Security and abuse prevention (limiting attempts, logs) — our legitimate interest (Art. 6(1)(f)).
• Health data, if you add it — your explicit consent (Art. 9(2)(a)).
• Reminders: if a list has dates and the reminder is on, every member gets one reminder e-mail a few days before departure. The list’s creator can turn the reminder off in the list settings — contract with you (Art. 6(1)(b)).

We do not use your data for advertising or profiling, and we do not sell it to anyone.

5. Who sees your data

• 🔒 Private items — only you.
• 👥 Shared items, links, comments and dates — all members of that list. The list’s creator also sees requests to join and to recover a PIN, and decides who joins the list.
• Service providers that process data on our behalf and according to our instructions:

Use of AI: when you create a list or use quick add, the list’s name and description or the sentence you wrote, together with the list members’ first names, are sent to Anthropic. The contents of your lists and your e-mail address are not sent.

Transfers of data outside the European Economic Area (US companies) take place on the basis of the EU–US Data Privacy Framework and/or the European Commission’s standard contractual clauses.

Telegram: if you connect Telegram, the text of your message is used only to add items: it is sent to Anthropic in the same way as quick add, together with the list members’ first names, and it is not stored. Replies go through Telegram (Telegram Messenger Inc.), which processes messages under its own privacy policy. You can disconnect at any time on the account page.

6. How long we keep data

• Account and content — until the account is deleted. You can delete your account yourself: menu → My PIN and account → Delete account.
• When an account is deleted, the account data, private items, essentials and the Telegram link are deleted. Lists you created are handed over to the next member (if there are no other members, the list is deleted). Shared items, links and comments you added remain on the list without your name.
• Sign-in links are valid for 15 minutes and invitations for 14 days; attempt-limiting data is deleted within 24 hours; the sign-in cookie is valid for up to 180 days.
• The Telegram link — until you disconnect it on the account page or delete your account; Telegram update IDs are deleted within about a day.

7. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to object, to receive your data in a machine-readable format, and to withdraw your consent. Write to support@gridea.io — we will reply within one month at the latest. If you believe we are infringing your rights, you may contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or a court.

8. Security

The connection is encrypted (HTTPS), PINs and security answers are stored only as hashes, every request checks whether you are entitled to see the data, and private items are never shown to anyone else.

9. Changes

If we materially change this policy, we will announce it in the app. The current version is always on this page.

See also: Privacy policy · Cookies · Terms of use