Privacy Policy
1. Who is responsible
The controller of your personal data is the developer entity named on the Google Play listing of Parcels & Deals (com.parcels_and_deals.app) ("we", "us"). Contact for all privacy matters: privacy@parcelsdeals.app.
2. Summary
- Parcels & Deals is a parcel tracking app. You add a tracking number, we show the delivery status and notify you when it changes.
- No registration: no name, e-mail or phone number. The app creates a random anonymous profile.
- We store the tracking numbers you add, the optional names you give your parcels, and the delivery events returned for them.
- No advertising. No advertising ID, no advertising or third-party analytics SDKs, and we do not sell or rent data.
- Usage statistics are collected only if you agree and can be switched off anytime.
- You can export or delete everything in the app: Profile → My data.
3. Data we collect — exact list
| Category | Exact data | When |
|---|---|---|
| Anonymous profile | A random identifier generated by the app on first launch (not a hardware or advertising identifier), a server-side profile ID, the app language, profile creation time and last activity time | Always (required for the service) |
| Parcels | Tracking numbers you add, optional parcel names you type, detected carrier, delivery status, delivery events (description, location, time) and estimated delivery date returned by carriers | When you add a parcel |
| Push token | Firebase Cloud Messaging registration token and your notification setting (on/off) | Only if you allow notifications |
| Technical request data | App version and Android version (stored with the profile). Each request also carries your IP address, system language and device manufacturer/model in a technical user-agent header — these are used to deliver the response and are not stored in your profile | Whenever the app talks to our server |
| Usage statistics | App opened/closed and session duration, which of the app's screens were viewed and for how long, notification opened, onboarding completed — linked to the anonymous profile | Only with your "Analytics" consent; nothing is recorded before you agree |
| Consent records | Your choice, its time and the policy version | When you make or change the choice |
| Support correspondence | Your e-mail address and message content | Only if you write to us |
4. Data we do NOT collect
We do not collect, access or request: name, e-mail, phone number, postal address, contacts, photos, files, calendar, microphone, precise or approximate location, payment or financial data, health data, the Google Advertising ID, or any hardware identifiers.
The app contains no advertising and no advertising, attribution or third-party analytics SDKs. The tracking-number scanner uses the Google Play services code scanner: scanning happens on your device, the app has no camera permission, and no images reach us — the app receives only the scanned text.
5. Why we use data and legal bases (GDPR Art. 6)
| Purpose | Data | Legal basis |
|---|---|---|
| Providing parcel tracking: creating the anonymous profile, storing your parcels, retrieving delivery statuses | Anonymous profile, parcels, technical request data | Performance of the service you request (Art. 6(1)(b)) |
| Delivery status notifications | Push token, parcel name or tracking number in the notification text | Your consent via the Android notification permission (Art. 6(1)(a)); withdraw anytime |
| Usage statistics to understand which screens are used and improve the app | Usage statistics | Your consent (Art. 6(1)(a)); withdraw anytime |
| Security, abuse prevention and fault diagnosis | Technical request data | Legitimate interest (Art. 6(1)(f)) |
| Answering your requests | Support correspondence | Legitimate interest / legal obligation for data-subject requests |
6. Who receives data
We use the following service providers (processors). We do not sell data and do not share it for advertising.
| Recipient | What it receives | Why |
|---|---|---|
| Hosting provider (data centre in Germany, EU) | All data listed in §3, stored on our servers | Running the service |
| Google — Firebase Cloud Messaging | Push token and the notification content (status and parcel name or tracking number) | Delivering notifications to your device |
| Parcel tracking data aggregator | Only the tracking number (and the carrier code, once detected) — no profile identifier, no IP address, no device data | Retrieving delivery statuses from carriers |
| Google Play services (code scanner) | Nothing from us; the scanner runs on your device under Google's own terms | Scanning a tracking number, if you use the scan button |
We may disclose data to authorities where the law requires it.
7. International transfers
Our servers are located in the EU (Germany). Some recipients may process data outside the EEA:
- Google (FCM) — transfers to the USA are covered by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses;
- Parcel tracking data aggregator — may be established outside the EEA. We deliberately send it only the bare tracking number, with no name, address, IP or any identifier linking it to you. The transfer is necessary to provide the tracking you request (Art. 49(1)(b) GDPR).
You can request more information via privacy@parcelsdeals.app.
8. How long we keep data
| Data | Retention |
|---|---|
| Anonymous profile, parcels, settings, consent records | Until you delete the account. Delivered parcels move to the archive after 14 days; you can delete any parcel at any time, which also removes it from tracking at the aggregator |
| Push token | Until you disable notifications, the token expires, or you delete the account |
| Usage statistics | Up to 12 months; deleted immediately when you withdraw the Analytics consent or delete the account |
| Support correspondence | Up to 2 years after the request is closed |
9. Your rights (GDPR Chapter III)
- Access (Art. 15) — see what we hold about you: in-app export or e-mail request.
- Rectification (Art. 16) — e.g. rename parcels in the app, or ask us.
- Erasure (Art. 17) — delete the account in the app in two taps, or via the web page.
- Restriction (Art. 18) — ask us to freeze processing while a dispute is resolved.
- Data portability (Art. 20) — Profile → My data → Export data produces a machine-readable JSON file.
- Objection (Art. 21) — object to processing based on legitimate interest by e-mailing privacy@parcelsdeals.app.
- Withdraw consent (Art. 7(3)) — anytime in Profile → Privacy and Profile → Notifications; withdrawal does not affect the lawfulness of prior processing.
- Complaint (Art. 77) — see §16.
We answer within 30 days (extendable to 90 for complex requests, with notice). We may ask you to confirm control of the app installation to prevent abuse.
10. Deleting your data
In the app: Profile → My data → Delete account. On the web (works after uninstalling the app): parcelsdeals.app/delete-account. Deletion is scheduled immediately, can be cancelled within 30 days in the app, and is then permanent: the profile, parcels, settings, consent records, push token and usage statistics are erased, and your tracking numbers are removed from tracking at the aggregator.
11. Consent and notifications
On first launch the app asks one optional question: whether you allow Analytics (the usage statistics described in §3). Nothing is pre-selected; "Decline" and "Accept" are offered equally, and the app works fully either way. You can change the choice anytime in Profile → Privacy.
Notifications are sent only about your parcels (status changes) and only if you grant the Android notification permission. You can turn them off in Profile → Notifications or in Android settings. We do not send promotional notifications.
The app stores a few values on your device (anonymous profile token, theme, consent choice, and — with Analytics consent — a short queue of unsent usage events). Details: Cookie Policy.
12. Security (Art. 32)
All traffic between the app, our servers and third parties is encrypted (TLS 1.2+/HTTPS). Servers run in an EU data centre behind a firewall with key-based access limited to the operator; databases are not reachable from the internet; secrets are stored outside the codebase; access to production data is limited to what operation of the service requires; dependencies are updated regularly. No method of storage is 100% secure — in the unlikely event of a breach affecting your data we will notify the supervisory authority and, where required, you (Art. 33–34).
13. Children
The app is a general-purpose utility that is not directed at children under 16. We do not knowingly collect children's data; as we collect no age or identity information we cannot distinguish users by age. If you believe a child's data reached us, contact privacy@parcelsdeals.app and we will delete it.
14. Automated decision-making
We perform no automated decision-making and no profiling (Art. 22).
15. Changes to this policy
We will update this page when our practices change and adjust the version and date above. For material changes we will inform you in the app before they take effect and, where required, ask for consent again. Previous versions are available on request.
16. Complaints
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or workplace (Art. 77 GDPR). A list of authorities: edpb.europa.eu. We would appreciate the chance to resolve your concern first via privacy@parcelsdeals.app.
17. Contact
Privacy: privacy@parcelsdeals.app · Support: support@parcelsdeals.app · Contact page. Controller: the developer entity named on the Google Play listing of Parcels & Deals (com.parcels_and_deals.app).