With the following privacy policy, we would like to inform you about the types of personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent in the context of providing our application.
The terms used are not gender-specific.
As of: September 18, 2026
Nils Egbers
Borkumstraße 12B
13189 Berlin, Germany
Email address: bagpacker.app@gmail.com
Legal Notice (Imprint): https://getbagpacker.com/legal/imprint.en
The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.
Relevant legal bases according to the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations may apply in your or our country of residence or registered office.
We delete personal data that we process in accordance with legal requirements as soon as the underlying consents are revoked or there are no other legal bases for processing. This applies to cases where the original purpose of processing no longer exists or the data is no longer required. Exceptions to this rule exist if legal obligations or special interests require longer storage or archiving of the data.
Specifically, data that must be retained for commercial or tax law reasons or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons must be archived accordingly.
In accordance with legal requirements, we take appropriate technical and organizational measures to ensure a level of protection for your data appropriate to the risk. If data is transferred to servers (e.g., when sharing lists or as part of optional premium features), the communication between our app and the servers is generally encrypted (SSL/TLS technology).
Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:
The content you create – packing lists, categories, items, notes, and profiles – is stored differently depending on which features you use.
1. Local storage (default). In ordinary use, all content you create is stored exclusively locally on your own device. We as the operator have no access to it. If you uninstall the app, this data is irretrievably deleted.
2. Shared lists. If you share a list with other people, the content required for this is stored on servers within the European Union so that everyone involved can see and edit it. The following is transferred: the title of the list, the travel dates, the names of the destinations, the names and colour markers of the people entered, the names of categories and items, quantities, assignments to people, and the packing status including who checked off an entry. In addition, a join code and the display names and join times of the participants are stored.
Deliberately not transferred: your notes on individual items, the coordinates and place identifiers of your destinations, any information on gender or age group, and the inputs from which the list was originally generated.
3. Synchronization between your own devices. If you use synchronization between several of your own devices, your profiles and inventory lists are additionally stored on the same servers. In this case, your notes and – if you have provided them – information on gender and age group are also transferred, as these are used to generate the packing lists. This data is assigned exclusively to your account and is not visible to other users.
4. Reports. If you report content in a shared list, we store the report together with an excerpt of the reported content and your voluntary explanation, as well as the identifiers of the accounts involved. This serves to review the report and to enforce our house rules.
Service provider (items 2 to 4): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Firebase / Cloud Firestore). Storage location: Frankfurt am Main, Germany. Privacy Policy: https://firebase.google.com/support/privacy
Types of data processed: Content data, usage data, meta, communication, and procedural data.
Data subjects: Users.
Legal bases: Performance of a contract and prior requests (Art. 6(1)(b) GDPR) for the features you choose; for handling reports additionally legitimate interests (Art. 6(1)(f) GDPR) in protecting other users.
Deletion: You can delete your account at any time within the app. All lists, profiles, and settings stored under your account are then removed from the servers; success is verified on the server side. Reports already submitted and content in other users' shared lists remain unaffected. A record of the deletion is stored to prevent the account from being recreated. Detailed instructions – including for the case that you no longer have the app installed – can be found at Delete account and data.
Using our app does not require an account. You can use the app without signing in. An account is only required if you wish to share lists with others or synchronize between several of your own devices.
We use Firebase Authentication for sign-in. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy Policy: https://firebase.google.com/support/privacy
Sign in with Google: When you sign in with your Google account, a sign-in token issued by Google is transmitted to the authentication service. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy Policy: https://policies.google.com/privacy
Sign in with Apple: When you sign in with your Apple ID, your email address and your name are requested and a sign-in token is transmitted. Apple offers you the option to hide your email address; in that case we receive an anonymized forwarding address. Service provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Privacy Policy: https://www.apple.com/legal/privacy/
Types of data processed: Inventory data, contact data, meta, communication, and procedural data.
Data subjects: Users.
Purposes of processing: Provision of our online services and user-friendliness, security measures.
Legal bases: Performance of a contract and prior requests (Art. 6(1)(b) GDPR).
When you contact us (e.g., by email or contact form), the information of the inquiring persons is processed to the extent necessary to respond to the contact inquiries and any requested measures.
Types of data processed: Inventory data, contact data, content data, usage data, meta, communication, and procedural data.
Data subjects: Communication partners.
Legal bases: Legitimate interests (Art. 6(1)(f) GDPR), performance of a contract and prior requests (Art. 6(1)(b) GDPR).
Our app can remind you of an upcoming trip – for example, that you have not yet completed a packing list.
These reminders are scheduled and displayed exclusively on your own device. No data is transmitted to us or to third parties for this purpose, and no push identifier (“push token”) is processed. There is no sending of messages via our servers.
To display reminders, the app requires your operating system's notification permission. You can withdraw this at any time in your system settings; in addition, you can switch reminders off in the app's settings.
Legal bases: Performance of a contract and prior requests (Art. 6(1)(b) GDPR).
When you enter a destination, we offer autocomplete suggestions. For this purpose, the character string you type is transmitted to a map service. If you select a suggestion, its identifier, name, address, address components, and coordinates are retrieved.
No location is determined via your device. Our app does not request any location permission and does not access your position.
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Places). Privacy Policy: https://policies.google.com/privacy
Types of data processed: Content data, usage data, meta, communication, and procedural data.
Data subjects: Users.
Legal bases: Performance of a contract and prior requests (Art. 6(1)(b) GDPR) – the search is carried out in response to your input.
For a destination you have entered, we retrieve a weather forecast and climatic average values in order to tailor the packing suggestions accordingly.
What is transmitted are the geographic coordinates of the destination you entered and the travel period. These are not your current whereabouts – our app does not request any location permission. No user account or identifier is transmitted; the request is made without signing in.
Service provider: OpenMeteo GmbH, Hintere Schilligmatte 6, 6463 Bürglen (UR), Switzerland. Email: info@open-meteo.com; Website: https://open-meteo.com
Basis for third-country transfer: An adequacy decision of the European Commission exists for Switzerland.
Types of data processed: Location data (coordinates of the destination), usage data, meta, communication, and procedural data.
Data subjects: Users.
Legal bases: Performance of a contract and prior requests (Art. 6(1)(b) GDPR).
To improve the usability, stability, and functionality of our app, we use an analytics service. It helps us understand which features are used and where difficulties occur.
Collection takes place exclusively after your express and voluntary consent, which we request via a dialog within the app. Without your consent, the service is not started and no analytics data is collected.
Service used: PostHog; service provider: PostHog, Inc., USA. Processing takes place on servers within the European Union (EU cloud). Privacy Policy: https://posthog.com/privacy
Types of data processed in detail:
Data subjects: Users.
Purposes of processing: Reach measurement, provision of our online services and user-friendliness.
Legal bases: Consent (Art. 6(1)(a) GDPR).
Storage period: Event data is retained for a period of 84 months.
Withdrawal: You can withdraw your consent at any time with effect for the future by changing the corresponding setting in the app.
To detect and fix technical errors and crashes, we use an error analysis service. The same service also receives feedback that you voluntarily send us from within the app.
Both take place exclusively after your express and voluntary consent, which we request via a dialog within the app.
Service used: Sentry; service provider: Functional Software, Inc. (“Sentry”), USA. Processing takes place on servers within the European Union. Privacy Policy: https://sentry.io/privacy/
We distinguish two processes:
1. Error and crash reports. If a technical error occurs, information about the state of the app and the device at the time of the error is transmitted – such as device type, operating system version, app version, and the technical error description. The contents of your packing lists are not transmitted. We do not attach any personal reference.
Errors during app startup. If the error occurs while the app is starting up, it cannot be transmitted immediately. It is then stored temporarily on your device – for no longer than 14 days – and transmitted the next time the app starts successfully, exclusively if your consent is in place at that time. Otherwise it is deleted. Only the technical error message and the error trace are stored; the contents of your packing lists and your inputs are not affected.
2. Feedback from within the app. If you write to us using the feedback function, the text you enter and – if you provide one – your email address are transmitted to the service so that we can handle your request. Providing an email address is voluntary. If the service is not active, your feedback is instead opened as a prepared email in your email program; sending it is then done by you.
Types of data processed: Meta, communication, and procedural data; for feedback additionally content data and, where applicable, contact data.
Data subjects: Users, communication partners.
Purposes of processing: Security measures, feedback, provision of our online services and user-friendliness.
Legal bases: Consent (Art. 6(1)(a) GDPR).
Storage period: The storage period is determined by the provider's specifications. A startup error buffered on the device is deleted after 14 days at the latest.
Withdrawal: You can withdraw your consent at any time with effect for the future by changing the corresponding setting in the app.
We use a subscription management service to administer optional paid features. The purchase itself is processed through the respective app store (Apple App Store or Google Play Store); we do not receive any payment data.
No user identifier assigned by us is transmitted to the service; the assignment is made via an anonymous identifier generated by the service itself.
Service provider: RevenueCat, Inc., USA. Privacy Policy: https://www.revenuecat.com/privacy
Types of data processed: Contract data, usage data, meta, communication, and procedural data.
Data subjects: Service recipients and clients, users.
Purposes of processing: Organizational and administrative procedures, provision of our online services and user-friendliness.
Legal bases: Performance of a contract and prior requests (Art. 6(1)(b) GDPR).
On startup, the app retrieves a configuration file with which we can enable or disable individual features. No content entered by you is transmitted in the process.
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Firebase Remote Config). Privacy Policy: https://firebase.google.com/support/privacy
Types of data processed: Meta, communication, and procedural data.
Data subjects: Users.
Purposes of processing: Provision of our online services and user-friendliness, security measures.
Legal bases: Legitimate interests (Art. 6(1)(f) GDPR) in a stable and controllable operation of the app.
We include so-called affiliate links or other references to the offers and services of third-party providers in our online offering. If users follow the affiliate links and subsequently take advantage of the offers, we may receive a commission or other benefits from these third-party providers. To track whether users have taken advantage of the offers of an affiliate link used by us, it is necessary for the respective third-party providers to know that the users have followed an affiliate link used within our online offering.
Types of data processed: Contract data, usage data, meta, communication, and procedural data.
Data subjects: Users.
Purposes of processing: Affiliate tracking.
Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
We are pleased when you review our app. Within our app, we offer you the option to go directly to the review function of the respective app store (Apple App Store or Google Play Store). We only redirect you to the corresponding page of the store. We do not transmit any personal data from you to the store operators. Submitting a review is voluntary and is subject to the terms of use and privacy policies of the respective store operator (Apple Inc. or Google LLC).
This section provides you with an overview of the terms used in this privacy policy.