Privacy Policy

1. Who we are

SudokuPacking ("SudokuPacking", "we", "us", "our") makes a mobile application and this website that help you plan what to pack for a trip using a three by three grid of clothing: three tops, three bottoms and three layers.

This Privacy Policy explains what information we collect when you use the SudokuPacking iOS app and the sudokupacking.com website (together, the "Service"), why we collect it, who we share it with, and what control you have over it. For the rules that govern your use of the Service, see our Terms of Service.

For any privacy question, or to exercise any right described below, email contact@sudokupacking.com. We are the data controller for the information described in this policy.

2. The short version

3. Information we collect

3.1 Information you give us

• Photos of clothing and accessories. Taken with your camera inside the app, or chosen from your photo library. We access your camera and library only when you actively ask us to add an item.
• Packing plan content. Plan names, trip labels, item labels, the category each item sits in, which outfits you starred or hid, and any notes you add.
• Email address. Only if you choose to create an account. Accounts are optional and are offered to subscribers who want to back up and restore their plans. We use a one time code sent to your email rather than a password.
• Messages you send us. If you email support, we receive your email address and whatever you write, and we keep the thread so we can help you.

3.2 Information collected automatically

• Product analytics. We use PostHog to understand how the app is used: screens opened, features tapped, whether a grid was completed, crashes and errors. These events are tied to a random identifier, not to your name.
• Device and technical data. Device model, operating system version, app version, language and region, time zone, and a randomly generated installation identifier.
• Approximate location from IP. Our analytics and hosting providers process your IP address as part of delivering the Service. This can indicate a country or region. We do not collect GPS or precise location, and the app never asks for location permission.

3.3 Information from the App Store

If you buy a subscription, Apple processes the payment. Apple gives us a receipt or transaction record confirming that a purchase was made and what it was for. We never receive your card number, billing address or full payment details. Apple's handling of that data is governed by Apple's own privacy policy.

3.4 What we do not collect

• We do not collect precise or background location.
• We do not read your contacts, calendar, messages or health data.
• We do not scan or index your photo library. We only receive the specific images you pick.
• We do not use third party advertising networks or advertising identifiers, and there are no ads in the app.

4. Your photos and packing plans

This is the part most people care about, so here it is in full.

4.1 Free use: fully local

If you are using SudokuPacking without a paid subscription, your photos and your packing plan are written to the app's private storage on your device and nowhere else. They are not uploaded to our servers. They are not visible to us. If you delete the app, that data is deleted with it, and we cannot recover it for you.

4.2 Subscribers: opt in cloud backup

Subscribers can add an email address to create an account. Doing so lets us store a copy of your packing plan data, and then your item photos, in our cloud backend so you can restore them if you change or reset your phone. Storage is provided by Supabase. Photo files are held in a private storage bucket, and access rules are scoped so that only your own account can read your own files. Rendering in the app always prefers the local copy on your device, so the app works with no connection.

4.3 What we do not do with your photos

We do not look through your photos, publish them, share them with other users, sell them, use them in marketing, or use them to train artificial intelligence or machine learning models. The only automated processing applied to an image is the resizing and cropping needed to display it inside your own grid.

4.4 Sharing is something you choose

The app can generate a shareable image card of your grid or a favourite outfit. That card is created on your device and goes nowhere until you choose to share it through your phone's share sheet. What happens after that depends on the app or person you send it to.

5. How we use information

• To provide the Service: store your grid, generate outfit combinations, save favourites, render your photos.
• To sync and restore, for subscribers who have opted into cloud backup.
• To manage subscriptions: confirm entitlement, unlock premium features, handle upgrades and expiry.
• To fix and improve the app: diagnose crashes, find where people get stuck, decide what to build next.
• To support you: reply to emails, investigate a problem you report.
• To keep the Service safe: detect abuse, fraud and misuse.
• To meet legal obligations, including tax, accounting and responding to lawful requests.

6. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract: providing the app, storing your plans, delivering the features of a subscription you bought.
• Legitimate interests: product analytics, crash diagnostics, security and abuse prevention, and improving the Service. We balance these against your rights and keep the data minimal and pseudonymous.
• Consent: camera and photo library access, and any optional marketing email. You can withdraw consent at any time in your device settings or by unsubscribing.
• Legal obligation: keeping records we are required by law to keep.

7. Who we share information with

We share information only with service providers who help us run the Service, and only to the extent they need it. Each is bound by contract to protect it and to use it only on our instructions.

• Supabase — database, authentication and file storage for subscribers who enable cloud backup.
• PostHog — product analytics and crash reporting.
• Resend — sending transactional email such as one time sign in codes.
• Apple — App Store distribution, in app purchases and subscription billing.
• RevenueCat — validating purchase receipts and managing subscription entitlements.
• Cloudflare — hosting and delivering this website.

We may also disclose information if we are legally required to, if we need to enforce our Terms of Service, or to protect the rights, safety or property of our users or the public. If SudokuPacking is ever involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction, and we will notify you before your information becomes subject to a different privacy policy.

8. We do not sell your data

We do not sell personal information, and we do not share it for cross context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended, or under similar laws in other US states. We have not done so in the past twelve months.

9. How long we keep information

• Local data on your device: until you delete it in the app or delete the app.
• Cloud plan and photo data: for as long as your account exists. When you ask us to delete your account, we remove it within 30 days.
• Analytics events: retained in pseudonymous form for up to 24 months, then deleted or aggregated.
• Support emails: up to 24 months after the conversation ends.
• Purchase and tax records: as long as tax and accounting law requires, typically up to 7 years.

Backups may hold copies for a short additional period before they cycle out.

10. Security

Data in transit is encrypted with TLS. Cloud files sit in a private storage bucket with row level access rules that scope reads and writes to the owning account, and signed links that expire. Access to production systems is limited to people who need it. Sign in uses a one time code sent to your email rather than a stored password.

No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping access to your email account and your device secure. If we become aware of a breach affecting your personal information, we will notify you and any relevant regulator as required by law.

11. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy.
• Correct information that is inaccurate or incomplete.
• Delete your personal information.
• Receive your data in a portable, machine readable format.
• Object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent you previously gave, without affecting processing already carried out.
• Not be discriminated against for exercising any of these rights.

To make a request, email contact@sudokupacking.com from the address associated with your account, or tell us enough to identify your data if you never made an account. We respond within 30 days, or within the period your local law requires. You may also use an authorised agent where the law allows it.

On your device, you can revoke camera and photo library access at any time in iOS Settings. The app will keep working, but you will not be able to add new item photos until you restore access.

If you are in the EEA or UK and you believe we have not handled your information properly, you may lodge a complaint with your local supervisory authority. We would appreciate the chance to address it first.

12. Deleting your account and data

You can delete everything at any time.

• Local only (no account): delete individual plans in the app, or delete the app from your phone. Both remove the data from your device permanently.
• With an account: use the delete account option in the app's account screen, or email contact@sudokupacking.com and ask us to delete it. We remove your profile, your stored plans and your stored photos within 30 days and confirm when it is done.

13. Children

SudokuPacking is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email contact@sudokupacking.com and we will delete it. Where local law sets a higher age of digital consent, such as 16 in parts of the EEA, that higher age applies.

14. International transfers

We are based in the United States, and our service providers may process information in the United States and other countries. If you are in the EEA, the UK or Switzerland, your information may be transferred outside your country to a place with different data protection laws. Where required, we rely on the European Commission's Standard Contractual Clauses or another approved transfer mechanism, together with appropriate technical and organisational safeguards.

15. US state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas and other states with comparable laws have the rights listed in section 11, including the right to know, delete, correct and obtain a copy of their personal information, and to opt out of sale or targeted advertising. As stated in section 8, we do not sell personal information or use it for targeted advertising, so there is nothing to opt out of. To exercise any other right, email contact@sudokupacking.com. If we deny a request, you may appeal by replying to our decision, and we will respond to the appeal within 45 days.

The categories of personal information we collect are listed in section 3. Our purposes are listed in section 5, and the categories of recipients are listed in section 7.

16. Changes to this policy

We may update this policy as the app changes or as the law does. When we do, we update the date at the top of the page. If a change materially affects how we handle your personal information, we will give you notice in the app or by email before it takes effect. Continuing to use the Service after a change means you accept the updated policy.

17. Contact us