1. Who we are
This Privacy Policy describes how [LEGAL ENTITY NAME — developer review] (“PackProof,” “we,” “us”) handles information in connection with the PackProof service, including the PackProof API, the first-party web application, the mobile client, and the Windows and macOS desktop applications.
PackProof is evidence infrastructure. It records, timestamps, hashes, stores, and retrieves transaction-bound records (“Proofs”). PackProof does not adjudicate disputes, determine liability, or independently verify that marketplace-supplied transaction claims, packing statements, or carrier events are true in the real world.
Questions about this policy: admin@thepackproof.com. Mailing address: [MAILING ADDRESS — developer review].
2. Scope
This policy covers personal information and related operational data processed when you create a PackProof account, authenticate, connect an external identity or marketplace, import transaction metadata, capture or upload evidence, attest, finalize a Proof, or otherwise use the service.
It also covers information we receive from third-party providers you authorize (for example, eBay or Shopify when you connect a seller or shop account, or Google and Meta/Facebook when you link those identities) and from infrastructure providers that host PackProof.
This policy does not govern the privacy practices of marketplaces, carriers, identity providers, or other third parties. Those services have their own policies.
3. PackProof account and profile information
When you use PackProof we create a PackProof user identifier. Depending on how you set up your account, we may store:
- PackProof user id
- username and display name
- account status (for example, active or disabled) and account timestamps
- profile fields you submit so other PackProof users can find and invite you
4. Authentication information
PackProof maps a verified sign-in identity to your PackProof user. We store the identity provider name and the provider’s subject identifier. We do not treat email address as a key that merges separate accounts.
In production deployments, account sign-in is handled by Amazon Cognito. PackProof receives tokens needed to authenticate API requests. The web application keeps the current tab’s session in the browser’s sessionStorage. The password you type into PackProof’s hosted sign-in form is sent to Cognito, not stored by the PackProof API as your account password.
The desktop application also sends sign-in credentials to Cognito. It keeps authentication tokens and profile information in encrypted local application storage protected by the operating system so you can resume your session. It does not save the password you enter. Signing out removes the saved desktop session; it does not erase previously staged recordings, cached records, or server-side Proofs.
Development environments may use a separate development sign-in adapter. That adapter is not the production authentication system.
5. Connected external identities
If you link an external identity to your PackProof user, we may store the provider, provider subject, optional handle or display name, optional avatar URL, linkage timestamps, and flags that describe whether that identity can authenticate or appear on a profile.
PackProof does not merge two PackProof users because they share an email address or a similar name. Connecting an identity associates that provider subject with the PackProof user who completed the connection.
Supported identity-provider records in the current architecture include Amazon Cognito and development identities. Additional social providers may be added later; if you connect one, the same category of linkage data applies.
6. Marketplace integrations, including eBay
If you connect a marketplace such as eBay, PackProof stores a connection record for your PackProof user. That record may include the provider, adapter, environment (sandbox or production), connection status, and a provider account reference such as an eBay user id or username.
Connecting eBay uses OAuth. PackProof requests access needed to complete seller authorization, read seller fulfillment orders, and read limited commerce identity information used to establish the connection. PackProof treats eBay as a connected marketplace, not as a PackProof sign-in identity.
If you connect a Shopify shop, PackProof stores the shop identity and requests official Admin API access to read orders and fulfillments used to create PackProofs. One PackProof user may connect more than one shop.
If you connect Google or Meta/Facebook from Account, PackProof stores only the official identity the provider returns (such as a subject, name, or public profile). Those connections are not Amazon Cognito sign-in and do not replace PackProof authentication. PackProof does not import Facebook Marketplace listings or transactions because Facebook does not offer an official public Marketplace API for that purpose.
You can disconnect a marketplace connection from PackProof. Disconnecting deletes stored OAuth credentials for that connection and disables the connection. It does not delete Proofs or evidence already created from imported orders.
7. Transaction and order metadata imported from connected marketplaces
When you import an order, PackProof stores transaction metadata supplied by the provider or entered by you. That may include order identifiers, line-item identifiers, listing or item titles, quantities, prices and currency when provided, buyer identifiers or display names when provided, marketplace identifiers, and timestamps.
PackProof does not invent missing marketplace fields. If a provider omits a buyer name, price, tracking number, or similar value, PackProof leaves that field empty rather than filling it in.
Imported marketplace data is classified as external data. PackProof does not independently verify that an imported order, item description, price, or counterparty identity is accurate.
8. Shipping and carrier information
You or a connected integration may supply carrier names, tracking numbers, shipping addresses or service descriptions, and shipment event observations. Staging environments may also receive tracking observations from a trusted carrier adapter (including EasyPost Tracker where that adapter is configured).
Shipment observations are recorded as supplied. A PackProof shipment-integrity digest reflects the integrity of PackProof’s stored record. It is not a determination that a carrier’s real-world statement is true.
9. Evidence you upload or capture
Participants may capture or upload files associated with a Proof, such as packing photos or video. PackProof stores the object bytes in an object store, together with content type, size, submitter, evidence type, and a SHA-256 digest computed for the stored object.
Evidence is append-only after commit. PackProof does not edit committed evidence in place or replace a file while keeping the same evidence id. Clients may show capture or upload progress; that interface state is not Proof state.
10. Attestations
Participants may record bounded statements on a Proof (for example, that they packed the described item). PackProof stores who attested, the statement, related evidence identifiers, and timestamps.
An attestation is a participant claim that PackProof recorded. PackProof does not independently verify that the statement is true.
11. Timestamps, hashes, provenance, audit events, and technical metadata
For each Proof, PackProof stores technical and integrity metadata needed to retrieve and evaluate the record, including:
- Proof, transaction, participant, invitation, evidence, and event identifiers
- lifecycle status and server-side transition timestamps
- SHA-256 digests for committed evidence and, after finalization, a canonical manifest digest
- provenance describing whether a value came from PackProof infrastructure, a participant attestation, or an external source such as a marketplace
- append-only audit events for committed actions
- invitation and participation records used to authorize access
12. OAuth authorization and refresh credentials
When you authorize a marketplace, PackProof receives authorization and refresh credentials from that provider. Those marketplace credentials are stored only on the server. They are not returned to the web, mobile, or desktop client, embedded in client configuration, or written onto Proof records. They are separate from the PackProof sign-in tokens a client uses to authenticate to our API.
Connection records store a credential reference, not the token values themselves.
13. Secure server-side credential storage
In AWS deployments, PackProof stores marketplace OAuth credentials in AWS Secrets Manager under application-managed secret names. Memory may be used as a cache. Local development may keep credentials in process memory or environment configuration instead of Secrets Manager.
Application credentials for PackProof itself (for example, database passwords and provider client secrets) are injected as server environment or secret references. They are not shipped in the public web bundle.
14. AWS infrastructure
When PackProof is operated on AWS, information is processed using Amazon Web Services in the configured region. Typical components include:
- Amazon Cognito for account authentication
- PostgreSQL on Amazon RDS or Aurora PostgreSQL for canonical domain state
- Amazon S3 for evidence object bytes
- Amazon ECS / Fargate for the PackProof API
- Amazon S3 and Amazon CloudFront for the web application
- AWS Secrets Manager for integration credentials
- Amazon CloudWatch for service and security logs
15. Data minimization
PackProof is designed to store what the product needs to authenticate you, authorize access, import the orders you select, record evidence and attestations, and preserve a retrievable integrity record.
Marketplace import stores provider identifiers and fields the provider actually returned. PackProof does not synthesize buyer, price, or tracking values. Marketplace OAuth tokens are not copied into Proof manifests or client storage. Proof tables do not store Firebase, Cognito, Google, or Apple identifiers as Proof identity; those subjects map through separate identity records.
16. Service and security logging
PackProof and its infrastructure providers may log operational data such as request paths, timestamps, identifiers, error codes, and diagnostic messages in order to operate, secure, and troubleshoot the service.
PackProof is designed not to return secret values in API error messages or to store OAuth tokens on Proof records. Logs may still contain user ids, Proof ids, and similar identifiers.
18. Desktop applications on Windows and macOS
Camera, microphone, and labels. Opening the Packing Station requests access to the camera you select and displays a live preview. Audio is off by default. If you enable audio, the selected microphone is also active while that preview is open, and its audio is included when you record. Preview alone does not save a recording. Recording begins when you start a capture, and camera and microphone access ends when you leave the Packing Station or quit. Hiding the window in the tray or menu bar does not itself close an active preview. Recordings may contain people, voices, addresses, shipping labels, and other details in view. Barcode recognition runs on your computer; detected values, formats, recording offsets, and your label confirmations are submitted with the completed capture.
Local storage and background work. The desktop application encrypts staged original recordings and their queue metadata in its application-data directory. Authentication tokens, the local encryption key, settings, and cached account, Proof, order, and integration information use operating-system-protected encrypted storage. The application separates queued evidence and cached records by PackProof account. It can retain an offline recording and resume its upload after connectivity returns while the originating account is signed in. Choosing to continue in the background keeps uploads and account-status checks running in the tray or menu bar. Quitting stops that work until the application opens again.
Capture metadata. When a recording is submitted, PackProof receives its account and Proof association, original bytes, size and hash, detected label information, your declaration, a randomly generated installation identifier, app version, operating-system family, selected camera label, capture start and end times, and whether the app reported being offline. Desktop timing and device details are client-reported; they are not independent verification of the recording time, hardware, or your legal identity.
Local retention. By default, a completed recording becomes eligible for local media cleanup 24 hours after the server confirms its commit, once finalization also succeeds. Settings also offer cleanup after confirmation or after seven days. Cleanup runs while the relevant account is signed in and queue processing is active, so a copy can remain longer when the app is closed or processing is paused. Pending, failed, and interrupted recordings are retained until they can be completed or you explicitly discard an eligible local recording. Cleanup and discard remove local media chunks, not the encrypted queue-history metadata. Cached records and queue history do not currently have automatic age-based deletion. Signing out, upgrading, or uninstalling does not erase the retained application data. This local retention is separate from server-side retention of Proofs and evidence.
Sharing and exports. Creating a share link requires the current recipient preview and your explicit approval to share original recordings and future updates. Desktop links have a selected expiry of one, seven, or thirty days. Anyone with the link can access its authorized content until access ends; revocation cannot recall downloaded copies or screenshots. A Proof export or diagnostic file is saved to the location you choose outside the protected queue. Those files are not covered by the queue's automatic cleanup and may be accessible to other people or software with access to that location.
Diagnostics and reporting. The desktop app keeps rotating local logs of coded operational events, timestamps, app version, and operating-system family. An exported diagnostic report also includes architecture, configuration and connection status, available and staged byte counts, unreadable-job count, and update and reporting state. It does not include recording contents or account, Proof, order, tracking, or camera identifiers. If a staging or production build is configured for centralized reporting, it automatically sends limited error reports to PackProof's Sentry project: a fixed error category and code, app version, release channel, operating-system family, and a random event identifier, with ordinary report transport metadata. Automatic reports exclude recordings, audio, attachments, authentication tokens, account and shipment identifiers, camera and installation identifiers, exception text, stack traces, filesystem paths, and screen/session replay. Development builds do not send these reports. Settings shows whether reporting is enabled; the notification preference does not control error reporting. As with other HTTPS services, the receiving provider can observe connection metadata such as source IP address and request time.
Notifications and updates. While you are signed in, the app checks for Proof-attention and marketplace-sync changes and can show generic operating-system notifications without shipment details. You can disable desktop notifications in Settings. Configured packaged releases check their update service and can download an update when you request it; these requests expose ordinary network and platform/update-request metadata to the distribution provider. The app does not send evidence or account credentials to the update service. Encryption and account separation reduce access risk but do not protect against every action by software, administrators, or people who can access your operating-system account.
19. How PackProof uses collected data
We use the information described in this policy to:
- create and authenticate PackProof accounts
- authorize access to Proofs you participate in
- connect and disconnect marketplace integrations you request
- import and display order metadata you select
- accept evidence uploads, compute and store digests, record attestations, and finalize Proofs
- maintain append-only audit history and retrieve manifests
- operate, secure, debug, and improve the service
- respond to your requests and to provider account-deletion notifications
- comply with law and protect PackProof, our users, and the integrity of stored records
20. How marketplace and provider information is distinguished from PackProof facts
Every value on a Proof is treated as one of three kinds:
- PackProof fact — something PackProof can establish from its own infrastructure, such as when a Proof was recorded, who joined as a participant, that an object was received, or that a SHA-256 digest was computed and stored
- User attestation — a participant statement PackProof recorded but did not independently verify
- External data — metadata supplied by a participant or integration, including marketplace order fields and carrier observations
PackProof does not promote an attestation or external field into a PackProof fact. PackProof does not independently verify marketplace-supplied transaction claims, item authenticity, or the truth of a packing or shipping statement.
21. PackProof does not sell personal data
PackProof does not sell personal data. PackProof does not share personal data for cross-context behavioral advertising.
22. Disconnecting marketplace integrations
You may disconnect a marketplace connection such as eBay from PackProof. When you do, PackProof deletes stored OAuth credentials for that connection and disables the connection so PackProof can no longer call that provider on your behalf. The same disconnect control applies to Shopify shops and to Google or Meta/Facebook identity links.
Imported transactions, Proofs, evidence, attestations, manifests, and audit events that already exist are not deleted by disconnecting a marketplace.
23. Account deletion requests
You may request deletion of your PackProof account in Account → Privacy & account, or at /new/delete-account in the web application. Sign in and confirm the request. This starts a review and does not immediately erase your account or retained evidentiary records.
We will review account deletion requests. Access credentials and connection tokens associated with your account can be removed or disabled. PackProof may still retain finalized evidentiary records as described below.
24. Provider account deletion notifications
Some providers, including eBay, may notify PackProof that a user closed their provider account. When PackProof processes such a notification, it deletes stored OAuth credentials for matching connections, disables those connections, and anonymizes the stored provider display reference.
Provider account closure does not, by itself, delete PackProof Proofs, evidence bytes, manifests, or audit events. Provider account data and PackProof evidentiary records are separate.
25. Retention of finalized evidentiary records
A Proof is a persistent, server-side record. Navigation, logout, capture UI state, and local device storage do not delete or invalidate a Proof.
After a Proof is finalized, PackProof rejects mutation of Proof status, committed evidence, attestations, core transaction facts, and the canonical manifest. PackProof may retain finalized evidentiary records, committed evidence objects, hashes, timestamps, provenance, and audit events where it has a legitimate operational, security, legal, or integrity reason to preserve them—including so that other participants can still retrieve the same record, and so that PackProof can maintain an append-only history.
Shipment observations may be appended after finalization; they do not rewrite the frozen core manifest.
26. Security practices
PackProof uses HTTPS for the hosted API and web application. Durable Proof changes authenticate, authorize, load the Proof, validate the transition, and persist in a database transaction with constraints and audit events.
Evidence bytes are stored in an object store. Canonical domain state is stored in PostgreSQL. Marketplace tokens are stored server-side as described above. The public web bundle does not contain API secrets or database credentials.
These practices reduce risk; they are not a guarantee that unauthorized access, loss, or alteration cannot occur. You should notify us promptly at admin@thepackproof.com if you believe your account or a connection has been compromised.
27. Third-party service providers
PackProof uses service providers to operate the product. Depending on configuration, these include:
- Amazon Web Services, including Cognito, compute, database, object storage, content delivery, secrets, and logging
- eBay, when you choose to connect an eBay account
- Shopify, when you choose to connect a shop
- Google, when you choose to link a Google identity (this is not Cognito sign-in)
- Meta/Facebook, when you choose to link a Facebook identity (this is not Cognito sign-in and is not Facebook Marketplace import)
- EasyPost, when a staging or test tracking adapter is configured for shipment observations
- Sentry, when a desktop staging or production build is configured to send limited coded error reports
Providers process information according to their terms and PackProof’s instructions where applicable. PackProof does not control a marketplace’s or carrier’s own data practices.
28. Your rights and how to contact us
Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information, or to object to or restrict certain processing. PackProof will consider requests as required by applicable law, subject to the retention of evidentiary records described above and to verification of the requester’s identity.
To make a request, contact admin@thepackproof.com. If we deny a request in whole or in part, we will explain the reason we are able to provide, including where retention is required to preserve a finalized Proof or to protect the rights of another participant.
29. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. The current version is published at the /new/privacy path of the PackProof web application.
If we make material changes, we may also provide additional notice in the product when practical. Continued use of PackProof after an update means the updated policy applies to that ongoing use.