How PAKT handles your data

Last updated: 3 October 2026

PAKT is an app for group trips. We help you plan trips, build packing lists, split expenses and keep your crew together. To do that we need limited data from you. This document describes what we collect, what we use it for, and what rights you have.

1. Who we are

PAKT is a product of Solvt, based in the Netherlands. For privacy questions: hello@paktogether.app.

2. What data we collect

Required data (to log in)

• Email address — for magic-link authentication (no password).

Optional profile data (you provide)

• Display name — so your crew knows who's doing what.
• Avatar photo — if you upload one from your photo library.
• Household members — partner name, kids, couple name.

Trip data (you or your crew create)

• Trip name, destination, dates, country, vacation type
• Packing list items, tasks, status (checked / open)
• Expense descriptions, amounts, payer, participants
• Planning entries (date, time, location)
• Optional trip cover photo (from your photo library)
• Activity log: who changed what (for crew visibility)

Documents with a trip (optional, Pro)

You can keep tickets, bookings and invoices with a trip (PDF or photo, up to 10 MB per file). They are kept in protected storage at Supabase in the EU. Only members of that trip can open them, through a temporary link. What you add yourself in Documents we do not read and do not send to an AI. If you use Import a booking, what is described there applies.

Importing a list with AI (optional)

When you use Import a list, you send a pasted text or one photo you choose to PAKT. We pass it on to Anthropic, which turns it into packing list items. You see the items before anything is added. Only the text or photo, the names of the packing list categories and our instruction go to Anthropic. Your name, email address, trip or crew are not included. PAKT does not store the text, the photo or the result. We only record that an import happened: time, text or photo, number of items, usage and cost. We need this for the free import, the daily limit and cost tracking. Legal basis: your consent, which we ask for before your first import. Nothing goes to Anthropic unless you tap Import.

Importing a booking with AI (optional)

When you use Import a booking, you send a PDF, a photo or pasted email text of a booking to PAKT, for example a hotel, flight, rental car or ticket. We pass it on to Anthropic, which turns it into travel details: names, addresses, dates, times, booking codes and amounts. A PDF is sent to Anthropic in full, up to the first 10 pages. Anthropic is instructed not to return payment or identity details, and PAKT also removes card numbers and IBANs from the result itself. You see everything first and tick what should be added. Only when you tap Add does PAKT store what you ticked in your trip: plans, trip info, optionally an expense and, if you choose, the file in Documents. Your crew can see this. Beyond that we only record that an import happened, just like Import a list. Legal basis: your consent, which we ask for before your first import.

What we do NOT collect

• No location data
• No contacts from your phone
• No third-party analytics (no Google Analytics, Mixpanel, etc.) — only anonymous product statistics in our own database, never shared or sold
• No advertising identifiers
• No access to your photo library — only specific photos you pick yourself

3. How we use your data

Only to run the PAKT app:

• Log you in and keep your session
• Show trips and related data to you and the members of those trips
• Send notifications to crew members when a trip changes (in-app only, no push)
• Provide customer support if you reach out

We never sell your data to third parties. We never use it for advertising.

4. Who sees what

• You see your own profile, your own household members, and all data from trips you're a member of.
• Crew members of a trip see the trip data (packing list, expenses, planning), the names of fellow members, and who changed what. They cannot see your other trips.
• Database access rules (Row-Level Security) ensure no one sees anything they're not a member of.

5. Sub-processors

We use these third parties:

• Supabase (Frankfurt, EU) — our database + authentication provider. All personal data is stored on EU servers. Supabase acts as processor under GDPR; we have a data processing agreement in place.
• Apple — for optional Apple-ID sign-in and the €14.99 lifetime in-app purchase. Apple's own privacy policy applies to that transaction.
• RevenueCat (US) — manages the purchase status of the lifetime unlock (no payment details; those stay with Apple). Processor under EU SCCs.
• Google (US) — only when you optionally sign in with Google; processes your email address and name under Google's own privacy policy.
• Sentry (US/EU) — anonymous crash reports to help us fix bugs; no personal data is included.
• Resend (US) — sends our emails (login codes, confirmations) to your email address.
• Anthropic (US). Processes only the text, photo or PDF you choose to import. Anthropic does not train on it and keeps inputs and outputs for up to 30 days by default. Longer only if a request is flagged in abuse checks (up to 2 years) or where the law requires it. Processor under EU Standard Contractual Clauses (SCCs).

6. Retention

• Account data is retained until you delete your account.
• On account deletion: your profile and data are immediately removed. Data from trips you were a co-member of is anonymized (your name is removed; the trip data remains for the other members).
• Deleted trips sit in the Trash for 30 days, then they're permanently gone.
• Activity log is automatically pruned after 30 days for non-Pro users.
• Trip documents are kept until the uploader or the organiser deletes them, the trip is permanently deleted, or the uploader deletes their account.
• We keep records of AI imports (without content) for as long as your account exists. If you delete your account, we remove your identity from those records and keep only the cost overview.

7. Your rights (GDPR)

Under the EU General Data Protection Regulation you have:

• Right of access — you see all your data in the app.
• Right of rectification — directly editable in the app.
• Right of erasure — via Profile → Delete account.
• Right to data portability — request an export via hello@paktogether.app.
• Right to object — contact us if you disagree with how we process data.
• Right to lodge a complaint — you can file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

8. Security

• All communication runs over HTTPS (TLS 1.2+)
• Passwordless authentication via magic-link (no password database to leak)
• Database access restricted via Row-Level Security policies
• Supabase is SOC 2 Type II + ISO 27001 certified

9. Cookies

The PAKT app is a native iOS/Android app — no cookies. This website (paktogether.app) uses only technical cookies where needed (no tracking).

10. Children

PAKT is intended for users aged 13 and over. We do not knowingly collect data from children under 13. Parents can add their kids as "household members" (without an own account) for packing list purposes.

11. Changes to this policy

Material changes are announced via an in-app banner + email to your registered address. Minor textual updates are made without notice; the "Last updated" date at the top stays current.

12. Contact

Questions about this privacy policy? hello@paktogether.app