Privacy policy

As of October 2026

This is a courtesy translation. The German Datenschutzerklärung is the legally binding version.

Protecting your personal data matters to us. This policy explains which data we process: Part A covers this website at packtheday.tjaxlabs.de, Part B the PackTheDay iOS app. Our company site tjaxlabs.de has its own privacy policy.

1. Controller

We have not appointed a data protection officer: we do not, as a rule, have at least 20 people permanently engaged in the automated processing of personal data (section 38(1) BDSG), and we carry out no processing that would trigger an appointment under Art. 37(1) GDPR. For any data protection matter, use the address above.

Part A — This website

2. Principles

We process personal data only where necessary to provide this website, or where you have consented. This website has no form: there is nothing here through which you could send us data, and we ask for nothing. The legal basis is essentially Art. 6(1)(f) GDPR (legitimate interest in secure operation).

3. Hosting (Cloudflare Pages)

This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) via its "Pages" service. When you access the site, Cloudflare processes technically necessary access data (e.g. IP address, date and time, requested file, volume transferred, browser and operating-system identification) to deliver the page securely. The legal basis is our legitimate interest in secure, high-performance operation (Art. 6(1)(f) GDPR).

Requests to our former domain packsyapp.de are also received by Cloudflare, for example through NFC stickers, invitations and list copies created with an older version of the app, or through links in older versions of the app. Cloudflare forwards them to packtheday.tjaxlabs.de and in doing so processes the same access data as when you access this website. The legal basis is our legitimate interest in links that are already in circulation continuing to work (Art. 6(1)(f) GDPR).

A transfer to the USA may occur. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses are in place. A data processing agreement (Art. 28 GDPR) exists with Cloudflare. Cloudflare states that it additionally processes part of the access data under its own responsibility (section 7).

4. Reach measurement

We use no analytics script — neither our own nor a third party's. What we know about the use of this site comes solely from the access data that arises at our host anyway when the page is delivered (see section 3) and that Cloudflare shows us in aggregate, such as a count of page views and the referring pages. We see individual requests there only as a sample, to detect faults and attacks (section 7). Nothing runs in your browser for this: nothing is stored on your device, there are no cookies and no persistent identifiers, and no cross-device profiles are created.

The legal basis is our legitimate interest in privacy-friendly statistics (Art. 6(1)(f) GDPR).

5. Contact

If you write to us by email (e.g. to packtheday@tjaxlabs.de or to the address in section 1), we process your details to answer your request. Our mailboxes are hosted by IONOS SE (Montabaur, Germany; data centres in Germany), with which a data processing agreement is in place. The legal basis is our legitimate interest in handling it (Art. 6(1)(f) GDPR) or Art. 6(1)(b) GDPR where your request relates to a contract. We delete the data once it is no longer needed and no statutory retention obligation applies.

6. Cookies — and why we do not ask you about them

This website sets no cookies: none of our own and none from third parties, neither for advertising nor for statistics. It uses neither local storage nor session storage. And it loads not one third-party script — no advertising, analytics or font services, no spam protection, nothing. This is additionally secured by a Content Security Policy: it lets your browser connect only to this website itself and blocks every connection to any other host.

What our own scripts read from your browser, and why that is all of it. Listed in full, it is four things: your browser's language setting, so the homepage and the short links send you to the page in your language; your "reduce motion" system setting, so we switch off the homepage animations if you have asked for that; the height of the window and the scroll position, so the layout fits while you scroll; and the address of the page you opened, including the part after the "#", so the homepage can jump to the right section and the pages for invitations, list copies and NFC stickers can hand their link to the app through "Open in PackTheDay". Our scripts send these values nowhere, store them nowhere and join them into no profile; "Open in PackTheDay" only hands the link to the app on your device. Under § 25(2) no. 2 TDDDG that is permitted without consent, because it is strictly necessary to provide you with the page you asked for.

That is why no cookie banner appears here. Consent is required under § 25 TDDDG where information is stored on your device, or where it is accessed without that being strictly necessary for the service you requested. Nothing is stored by us, and the four reads above are exactly that: strictly necessary. So there is nothing we would have to ask you about, and therefore we do not ask.

7. Retention

Technical access data. It arises at our host when the page is delivered (section 3) and stays there, not with us. We download no log files and keep no access logs of our own. In Cloudflare's dashboard we can see, besides totals, a sample of individual requests (such as IP address, time and address requested) and the IP addresses sending the most requests, in each case going back no more than 30 days. We look at the individual requests and IP addresses only to detect faults and attacks, and we take nothing from them. Cloudflare processes the logs it makes available to us there as our processor. There is no fixed period for them: Cloudflare keeps them as long as they are needed to perform our contract, at the longest until it ends, and deletes them afterwards unless a legal obligation requires keeping them longer. Besides this, Cloudflare states that it also processes access data under its own responsibility, for example to operate its services and protect them against attacks. For that, including how long, Cloudflare's own privacy policy (cloudflare.com/privacypolicy) applies.

Emails from a contact request are deleted once the matter is settled and no statutory retention obligation applies.

8. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place — neither on this website nor in the app.

9. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and withdrawal of consent (Art. 7(3) GDPR). Use the address in section 1; we answer within the periods set by Art. 12.

Right to object. Where we base processing on our legitimate interest (Art. 6(1)(f) GDPR), you can object to it at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Write to the address in section 1.

10. Right to complain

You have the right to complain to a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin.

11. Changes

We update this policy when our processing changes. The current version published here applies.

Part B — The PackTheDay app

12. Scope and principle

This part describes what the PackTheDay iOS app processes, including its widgets and the Apple Watch app. The controller is the same as in section 1.

PackTheDay has no server of its own. We run no backend that receives your lists: they live on your device and — if you switch that on — in your own iCloud account. Wherever anything is transmitted at all, this policy says so: to Apple for syncing and notifications (section 14) and for purchases (section 16), and to PostHog for product analytics (section 15). PostHog receives data only with your consent; the one exception is a last message when you withdraw it (also section 15).

13. Lists, items and reminders

We process your lists, items, reminder times and settings in order to provide the app. They are stored on your device; widgets read them through a shared on-device container (App Group), and the Apple Watch app receives them from your iPhone over Apple's iPhone-to-Watch connection (WatchConnectivity). Reminders are triggered locally by your device; their text is generated on the device and transmitted nowhere. The NFC sticker ("NFC tag") likewise holds only a link to your own list. Nothing is transmitted when it is written; when your iPhone reads it, PackTheDay opens the list directly, again without transmitting anything. If the link opens in the browser instead, for example because PackTheDay is not installed or because the sticker was written with an older version of the app, it is requested from our web host like any web address (section 3). The legal basis is performance of the usage contract (Art. 6(1)(b) GDPR).

Sharing a list as a copy. Via "Send a Copy" PackTheDay builds a link that carries the list's content inside it — encoded, not encrypted, so readable by anyone who has the link — nothing is stored on a server of ours. If the person you send it to opens that link without PackTheDay installed, or if the link comes from an older version of the app, it is requested from our web host like any web address and can appear in that host's access data (section 3). The channels you send it through — messenger, email, clipboard — see it too. For particularly private lists, prefer the iCloud share (below) over "Send a Copy". The NFC sticker, by contrast, carries only a random list identifier, no content.

14. iCloud sync and shared lists

If you switch syncing on, PackTheDay stores your lists via Apple's CloudKit service in your own iCloud account. We do not operate that storage and have no access to it; Apple's iCloud terms apply. What is transferred is list and item content, the name you set in the app and, if you set one, your profile picture.

If you share a list, the people you invite gain access to its contents as well as to your name and profile picture. For syncing and for nudges ("Remind"), PackTheDay uses Apple's push service (APNs). Usually APNs carries only a trigger; PackTheDay then fetches the text of a notification through iCloud and shows it on your device. When someone you invited reminds you about a list you own, Apple instead delivers the notification ready-made through APNs. It contains that person's name, the list's name, how far it is packed (for example "almost done") and, where applicable, the number of open items, but not the items themselves.

Inviting by link. When you invite someone, PackTheDay creates a personal invitation link on packtheday.tjaxlabs.de. The iCloud share sits in the last part of that link (after the "#"). Browsers and messengers never transmit that part to a server, so it does not reach our web host either. Only the invitation page itself is requested: when a messenger loads it to build its link preview, and when the invited person opens the link without PackTheDay installed. Those requests can appear in our web host's access data (section 3). Invitation links from older versions of the app point to packsyapp.de; when someone opens such a link, Cloudflare forwards the request to packtheday.tjaxlabs.de (section 3). The part after the "#" does not reach our web host in that case either. You send the link, together with a short sentence containing the list's name, through the messenger of your choice, which sees both.

One important note about deletion: if you revoke someone's access, their future access ends. A copy already on that person's device cannot technically be recalled by us.

The legal basis is performance of the usage contract (Art. 6(1)(b) GDPR).

15. Product analytics and crash diagnostics (PostHog)

With your consent, PackTheDay uses PostHog (PostHog, Inc., San Francisco, USA) for pseudonymous product analytics, hosted in the European Union (PostHog Cloud EU, AWS Frankfurt).

Which events. First, our own: which features and screens are used, as a fixed, closed list of event names whose extra values are likewise drawn from fixed sets — free text cannot technically get in. Second, the events the PostHog component (SDK) raises by itself: installing, opening, updating and backgrounding the app, associating the analytics identifier (when it does, the SDK fetches its settings from PostHog once), and crash reports.

What every one of those events carries with it. The SDK attaches technical details about the device and the app without us requesting them individually: app name, app version, build number and bundle identifier; manufacturer ("Apple"), device model and device class; the name and version of the operating system; screen size, time zone, language and the type of network connection (Wi-Fi or cellular); plus flags such as "running as a TestFlight build" or "running in the simulator", and the SDK's own version.

Crash reports contain the error message and the technical call stack — that is, places in the program code. They are not meant to carry content; we cannot fully rule out, however, that an error message contains a piece of text from the app in an individual case.

Identifiers. There are several, all random values generated on your device. They contain no name, and we cannot determine a person from them on our own — but as long as the identifier is on your device, the data can be attributed to you through it. They are therefore pseudonymous, not anonymous: our own analytics identifier, the SDK's identifiers (a user, an anonymous and a per-installation device identifier), a session identifier and a separate identifier per event. Neither PackTheDay nor the SDK reads your iPhone's advertising identifier (IDFA) or its identifier for vendors (IDFV), and no tracking across devices or companies takes place.

Not transmitted: your lists, your items, your name and your profile picture. Your IP address is technically transmitted by the connection but is discarded by PostHog and not stored; no location is derived from it.

Before you consent, nothing is transmitted: events stay in a bounded in-memory buffer and are discarded if you decline. If you decline, nothing is sent — permanently, not until the next launch.

Withdrawal: you can withdraw your consent at any time in the app under Settings → Privacy & Data. Doing so deletes the identifiers from the device, any events not yet sent and the crash store. The app then sends one last message: that analytics was switched off, where in the app, and whether it is a test version. It carries none of your identifiers and creates no profile, only a one-time random identifier that the app does not keep. We do not link it to your earlier data. This tells us how often analytics is switched off. The legal basis for it is our legitimate interest (Art. 6(1)(f) GDPR). After that, nothing more is transmitted.

As PostHog is a US company, the processing relies on a data processing agreement including Standard Contractual Clauses. The legal basis is your consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG for storing the identifiers on your device).

16. Purchases (PackTheDay Plus)

You buy PackTheDay Plus through the App Store. The purchase contract is concluded between you and Apple; we neither receive nor see payment data. The app checks with Apple whether a valid entitlement exists. For that it processes on your device which plan you have, whether it comes from the 7-day free trial or an offer code, until when it runs, and whether Apple is currently retrying a failed payment. The legal basis for this is performance of the usage contract (Art. 6(1)(b) GDPR). If you have consented to product analytics, PostHog also learns how your purchases go (for example started, completed, cancelled or restored), whether Plus continues, which plan you use and whether it is the free trial, but never a price and no payment data. The legal basis for this is your consent (section 15).

17. Retention and deletion in the app

• Lists and items on the device: until you delete them or remove the app. Deleting the app removes its local data with it.
• Lists in iCloud: until you delete them. They live in your own iCloud account and can also be removed there from the iOS settings.
• Copies held by people you shared with: see the note in section 14.
• Profile picture: until you remove it; automatically when the iCloud account changes.
• Analytics and diagnostics data: after twelve months at the latest. The identifiers on your device are deleted when you withdraw consent; data already transmitted remains until the twelve months are up.

Requesting deletion. Because your content lives on your device and in your iCloud account, you delete it there yourself, directly and completely — we have no access to it. Deleting the app removes the local data; iCloud data is removed in the app or in the iOS settings. For anything beyond that, write to kontakt@tjaxlabs.de.

Analytics data: what is possible and what is not. Analytics data already transmitted is tied to the random identifiers described in section 15, which live on your device. While analytics is switched on they exist there — if you want a deletion, write to us before you withdraw consent, and we will work out with you how your data can be identified. Withdrawing deletes those identifiers from your device; after that it can no longer be determined which data came from you, and to that extent we are not in a position to identify you within the meaning of Art. 11(2) GDPR. Independently of this, the data is deleted after twelve months at the latest. You can stop the transmission at any time (section 15) — then nothing new is added.

18. Recipients

Nobody other than the parties named in this policy receives your data. We do not sell data, we run no advertising, and there is no disclosure to data brokers or ad networks.

The named recipients — Apple (iCloud/CloudKit, APNs, App Store), PostHog (product analytics), Cloudflare (hosting this website) and IONOS SE, Elgendorfer Straße 57, 56410 Montabaur (our email mailboxes, data centres in Germany) — are contractually bound to protect your data at a level matching the one described in this policy; for processors this is done through agreements under Art. 28 GDPR including Standard Contractual Clauses where processing outside the EU may occur. A copy of the Standard Contractual Clauses is available from us on request at kontakt@tjaxlabs.de.

19. Providing your data: what is required and what is voluntary

Under Art. 13(2)(e) GDPR we tell you which data you have to provide and what it means if you do not. There is no statutory obligation to give us data in any case.

• Access data for this website (section 3): technically unavoidable. You do not provide it actively — it arises on request, and without it the page cannot be delivered to you.
• Your email address and your message (section 5): voluntary. Not writing to us costs you nothing; without your details, however, we cannot reply.
• Lists, items and reminder times (section 13): required for the function you are using — a list with no items has nothing to tick off. What you enter is up to you, and you can delete it at any time.
• Name and profile picture (section 14): voluntary. PackTheDay works fully without either; in a shared list you then appear without a picture and under the name you chose yourself.
• iCloud syncing (section 14): voluntary. If you do not switch it on, your lists stay on the device and are not synced between your devices.
• Product analytics (section 15): voluntary. If you decline or withdraw, PackTheDay works exactly as before and in full. A refusal is permanent.
• Taking part in a beta test (section 20): voluntary. If you do not take part, none of the data named there arises.

20. Beta tests through TestFlight

Before launching on the App Store, we hand out test versions of PackTheDay through Apple's TestFlight service to people we invite personally. Apple is responsible for the TestFlight app itself.

Apple provides us with crash and usage data: device model, a device identifier, the versions of the operating system and of PackTheDay, and how often the test version was installed, opened and crashed. If you send us feedback through TestFlight, we also receive your comment, your screenshot and technical details such as carrier, time zone, connection type, screen resolution, battery level and free storage. If you join through our invitation link, Apple does not show us your name or email address.

We use this data only to find bugs and improve PackTheDay (Art. 6(1)(f) GDPR, our legitimate interest in an app that works) and pass it on to no one. Apple keeps feedback for one year and crash and usage data until the bugs are fixed. We view it in App Store Connect and Xcode and keep it no longer than we need it to fix bugs. The product analytics in section 15 work the same way in test versions: only with your consent. Taking part is voluntary; you can leave the test at any time in the TestFlight app.