Privacy Policy

1. Who is responsible

Entity

Starthrop Dynamics, Unipessoal Lda

Company number (NIPC)

519488261

Registered office

Rua da Sociedade, n.º 4, 2695-567 São João da Talha, Loures, Portugal

Privacy contact

support@starthrop.com

2. What data we process, and why

We collect what the service needs to work and, separately, whatever you choose to give us — your name and your mobile number are optional, and the table says which is which. Nothing is collected «just in case it turns out to be useful». You can also use the service without creating an account: in that case we ask for no email, name, mobile number or password, and the parcels you follow are linked to your device (point 5).

A note about the name. The name is optional: the account is created and the service works entirely without it. We process it on the basis of legitimate interest (Article 6(1)(f) GDPR), and not on performance of the contract — because the service is proven to work without a name, and a field the product chooses to ask for does not create the objective necessity that basis would require. Purpose: to identify and personalise your account, so that the product addresses you by a name rather than by an email address. Necessity: the name is not used to deliver, to track, to charge or to notify — none of those functions touches it and none requires it. Balancing: it is a single field, written by you, which we check against no document, disclose to no shop, carrier, other user or advertiser, and use for no profiling and no advertising — it is handled only by the infrastructure providers listed in section 8, like the rest of your account. The impact on your privacy is minimal, and the benefit is yours. Objection: you may object to this processing at any time by writing to support@starthrop.com — the name is deleted from your account, which keeps working without it. In the Profile you can correct the name or remove it, without writing to us. The email request stays available for anyone who prefers it.

A note about the mobile number. It is optional: the service works entirely without it, and we only store it if you enter it in the Profile. The basis is therefore your consent (Article 6(1)(a) GDPR), which you give by entering it. Purpose: keeping, at your request, a contact number of yours with the rest of your Profile, so that you can look it up, correct it or export it. What we do not do with it: we do not use it to sign you in, for two-step verification, or to deliver, track, charge or notify; we do not verify it, we send it no SMS, calls or messages you did not ask for, and we disclose it to no shop, carrier, other user or advertiser. Withdrawing: deleting it in the Profile withdraws your consent and removes it from the account; you can also ask us to delete it. Using it for any other purpose would be a change to this policy (point 15).

What we do not collect

We send you no SMS, we do not verify your mobile number and we do not use it to sign you in or for two-step verification. The number you enter is stored as you typed it. Between 20 August 2026 and version 1.1.0 the profile did not ask for it; anyone who had filled it in before kept it on their account. Either way it comes out in the export, and you can correct or delete it in the Profile.

We no longer collect delivery instructions. Until 21 August 2026 the address had an optional field for them. It was removed for the same reason as the phone number: they were used for nothing — they did not go to the carrier, they appeared on no screen and were passed to no one. Any you had already written stay with your address, appear in the export of your data and disappear if you delete your account.

We do not collect your payment details — not the card number, not the cardholder name, not the billing address, including when you make a voluntary contribution. See point 7.

We do not collect what you bought from the shops you order from, the price you paid, or the reason for the purchase. None of that is needed to follow a delivery.

We use no advertising identifiers, do no cross-app tracking and show no ads in the service. Optional Google Analytics/Firebase measurement and the anonymous statistics, both described in section 4, measure usage and quality; they do not receive your email, name, mobile number or address.

The measurement choice on the pages of starthrop.com and the app Statistics and diagnostics choice are independent. Refusing optional measurement does not prevent the service, use without an account, sign-in, payments or requested notifications.

3. Server logs, and what they are for

Like any service on the Internet, our server keeps a log of the requests it receives. That log contains the IP address the request came from, your account identifier when you are signed in, the path requested and the outcome. That log stays with the provider hosting the service and rolls over after about seven days — we do not keep it beyond that, nor use it for anything else.

We use this for two concrete things, and not for others:

• Rate-limiting. Sign-in is throttled by two independent counts: one on the origin of the request, which is the IP address, and one on the email address typed into the form. Five failed attempts within fifteen minutes block that count for another fifteen, and one successful sign-in clears both. The count on the email applies to whatever was typed, whether or not an account exists for it — if it only counted for real accounts, the block itself would reveal which ones exist. The system does not know whose account it is: it counts attempts, it does not tell account holders apart.
• Understanding failures. When something goes wrong, these logs are where you see what happened.

What does not go into these logs, by explicit server configuration: passwords, your email, your name, your mobile number, your address, cookie contents and recovery codes.

We do not use these logs to build profiles, measure audiences or for any commercial purpose.

The anonymous statistics in point 4 do not store your IP address: the requests that carry the counts leave no IP in the application’s logs, and, to limit how often they can be sent, the server uses only a cryptographic digest of the IP, in memory, which is not written down.

4. Cookies and what is stored on your device

One cookie: your session, called edid_session. It only keeps you signed in — with or without an account.

Duration

follows the session’s duration. See point 5

When it stops being valid

when you sign out, when you recover your password, when the session expires, or when you delete your account

Protections

HttpOnly (page JavaScript cannot reach it), SameSite=Lax and, over a secure connection, Secure

The session cookie is necessary for the service to work: without it you cannot be kept signed in.

We also store on your device what is in the table. Only the first two rows are necessary for the service — the first only for those who use it without an account; those in the last row serve the anonymous statistics in point 4, and stop being written if you object; the others exist to respect choices you made, or so as not to repeat a question or a notice:

Only the device code is sent to us, and only to resume or merge your parcels. The rest stays on your device. You can remove all of it by clearing the browser’s or the app’s data.

In the service we use no cookies or any other storage for advertising. When your app version offers Statistics and diagnostics and you accept, Google Analytics/Firebase measures navigation and usage; Crashlytics receives crash reports and Performance loading times. On Android, the same choice controls notification delivery metrics. Events, installation identifiers, technical device characteristics and technical outcomes are processed, without sending email, name, address or parcel contents. With the same choice, our server keeps progress markers linked to your account: for each step on a closed list, the first time, the last time and how many times it happened — not the sequence of what you did, nor what you typed. They come out in the export and are deleted with the account.

Anonymous statistics in the app

To understand how the app is used and to fix faults, we count events from a closed list — for example, “a lookup was made”, “the app was opened” or “an error occurred” — aggregated per day, together with the platform, the app version, the language, the country of your device’s language and the category the visit came from (a search or a social network, for example). For errors we keep the type, the screen where they happened and the point in the code — never the message. These counts do not include your account, your device, your IP address or anything you type — such as tracking numbers — and cannot identify you; that is why we do not ask for your consent. You can object: if you answer “No” to Statistics and diagnostics — when the app asks or, at any time, in the Profile —, the app stops reading and storing on the device the category the visit came from, the country of your device’s language and the record of errors already counted, and clears what was there; the counts continue, with only the platform, the version and the app’s language. Without an answer, there is no objection. They are kept on our server, with a copy in Google Cloud’s BigQuery, both in the European Union. Daily counts are kept with no time limit, because they are not personal data; aggregated errors, for 400 days.

In the app, your Statistics and diagnostics choice is stored in edid-diagnostico; it starts without permission and can be withdrawn in your Profile. Withdrawal stops new optional collection and clears local Analytics data and unsent reports; it does not retrospectively erase information already received by providers. Advertising consents remain denied.

Measurement on the pages of starthrop.com

The pages of starthrop.com, including the Package Tracker page and this document, are the institutional website of Starthrop Dynamics. Visit measurement on those pages is optional, only happens with your choice and serves to understand how the website is visited and which campaigns bring visitors; the providers, purposes, cookies and retention periods are in the Starthrop Dynamics Privacy Policy and Cookie Policy. That measurement is not part of the app: in the app (package-tracker.starthrop.com and the iOS and Android apps) only what this point 4 describes applies.

5. Authentication and sessions

You can use the service without an account, create an account with your email and a password, or sign in with “Continue with Google” or “Continue with Apple”. There is no other way in.

The session ends after 30 days without use. Every time you use the service that count restarts — anyone using the app regularly does not have to sign in again.

There is a limit that use does not extend: no session lasts more than 180 days from the moment it was created. After that, authentication is requested again, even from someone who uses the service every day.

The session ends immediately when:

• you sign out;
• you change your password — in that case the sessions on the other devices end, and the one you are using continues;
• you recover your password — in that case all end, including the one you are using;
• you delete your account.

Signing in with Google or Apple

If you choose one of them, it is Google or Apple that confirms who you are; we never see the password of those accounts. From them we receive the identifier of your account with them and the email — in Apple’s case, it may be a private relay address, if you choose one. Apple also gives us a credential, which we keep encrypted and which serves only to ask Apple to revoke the link when you delete your account or disconnect Apple. If you already have an account with the same email, we do not merge them on our own initiative: you sign in with your password and connect Google or Apple in the Profile. You can disconnect them in the Profile, as long as another way to sign in remains.

Using the service without an account

Without an account, the service creates a visitor account for your device, which is only created on your first lookup. To track as a visitor we do not ask for your name, email, mobile number or a password. That does not mean there is no personal data: the tracking numbers you follow, the history of those parcels, the device code, the session cookie and the server logs (point 3) may relate to you, and so we treat them as personal data, with the same rights (points 11 and 12). The visitor account is an internal account — with no real email and no password anyone knows —, not an anonymisation of your data. The device receives a random code, stored on it (point 4); we keep only a cryptographic digest of it, which is a pseudonym, not anonymous data. That code serves two things: resuming your parcels when the session ends, and merging them into an account, if you create one or sign in to one you already had — in that case we ask you to confirm, and repeated parcels are not duplicated.

Worth knowing: visitor parcels are linked to that device. We do not delete parcels, events or visitor accounts because of their age or inactivity: while the visitor account exists on the server, the history stays. But if the code is lost — for example, by clearing the app’s data, uninstalling it or clearing the browser — you can no longer open them, and we cannot tell whose they are in order to give them back; what was stored stays stored, and we do not delete it for that reason. To delete them, use “Delete the data on this device”, in the Profile, before deleting the app. To be able to recover your history and use it on other devices, create a free account — it is optional.

The password saved on your device

If your system — iPhone, iPad, Mac or Android — offers to save your password, it is it that saves it, in the system credential manager, because you allowed it to. That copy belongs to the system: it stays under the system's control, it can be deleted in the system's settings, and when it asks for Face ID, Touch ID or the device passcode to fill it in, it is your operating system protecting a password it holds. Our own statement is about us: neither the app nor our servers store your readable password. On the server there is only a cryptographic derivation, which cannot be turned back into it; the app uses the password to sign you in and does not keep it.

6. Notifications

If you allow it, we alert you when a parcel you added changes status. That is the service’s function, which is why the basis is performance of the contract — the same as in the table in point 2.

Every notification we send comes from an event on one of your deliveries. That is the only path in the service that creates an alert: there is no mechanism for promotional notifications.

So that we can send you an alert, your device generates a notification identifier and we store it, linked to your account. That identifier is handed to the platform’s notification service: Apple, on Apple devices; Google, on Android.

The notification carries two things and nothing else: the status of the parcel, already translated by us, and the name you gave it — or, if you gave it none, the carrier’s name or “Your parcel”. It does not carry your name, your email, your mobile number, your address, the tracking number or the text the carrier wrote. That text stays stored but appears on no screen: the delivery's history shows the status as translated by us, the date and the place the carrier gave — not the sentence it wrote. If you ask for your data inside the app, that sentence is included in the export, because it is about your parcel and it is your right to see it.

The permission your device asks for to show notifications is a technical control of the system, and can be withdrawn at any time in its settings. Withdrawing it affects neither your rights nor the rest of the service, and it is not the basis for the processing.

7. Free, voluntary contributions and the former plans

Package Tracker is free: tracking, using it without an account, creating an account, saving your address, exporting your data and deleting your account cost nothing. There are no ads and no plans for sale.

What never reaches us

If you make a voluntary contribution, the transaction is processed by the store where you make it — the App Store or Google Play — or, on the web, by Stripe. The same applies to the former subscriptions. We neither receive nor process your card number, the payment method credentials, the cardholder name or the billing address. Those stay with the store, or with Stripe, and with whoever each of them uses to process them. In web payments, Starthrop Dynamics is the merchant of record and Stripe is the payment processor.

Contributions are not linked to your account

A contribution is voluntary support for the service’s development: a payment to Starthrop Dynamics, which is a company — not a donation to a non-profit organisation. It unlocks nothing, gives no advantage, is not a subscription and does not change what the service does. In the apps, the purchase is made in the store without us attaching any identifier of yours, and our server does not record that you contributed. We only count, anonymously and in aggregate, how often the support screen was seen and how many contributions were completed, cancelled or failed (point 4). If you contribute on the web, Stripe collects your email and payment details on its own page; Starthrop Dynamics, as the merchant, has access to the record of that payment in Stripe — amount, date, email and country — and keeps it for the period that tax and accounting law requires.

The former plans, BASIC and PLUS

Up to version 1.1.0 we sold the BASIC and PLUS plans. They are no longer sold. For anyone who still has or had a subscription, we know and store: which plan; the subscription’s status — active, in a grace period, with billing failing, cancelled, ended or refunded; the dates of the paid period; and the reference the store assigns to the purchase, to recognise the messages it later sends us. Without this it is not possible to honour the paid period, a cancellation or a refund.

The identifier we used to send to the store

When a plan was bought, we sent the store a random identifier, generated by us, containing no name, email, address or account code of yours. It links the purchase to your account when the store tells us about a renewal, a cancellation or a refund. We do not send the stores your account’s internal identifier.

That identifier is still personal data: it does not carry your name, but it can be linked to a purchase of yours. That is why it has a retention period and why it is described here. We do not call it anonymous, because it is not.

8. Who the data is shared with

We do not sell data and we do not share it for advertising. For the service to work we rely on the following providers, each with a strict role:

Package Tracker does not send your address, name, email or mobile number to the carriers, to AfterShip or to the app stores. Nor is your address shown to other users. It is kept in your account, in the service's database — hosted by the provider named in the table above, like the rest of your data. Where that database sits, and what that does not guarantee, is in point 9.

This is a statement about what we do. A carrier delivering a parcel to you naturally knows the delivery address — it got it from whoever sent you the parcel, not from us.

Google Ireland Limited also provides the optional app services Google Analytics/Firebase, Crashlytics and Performance. The choice serves usage statistics and diagnostics; we do not share account identity with these services. The 14-month period refers to configured Analytics retention, not a uniform promise to delete every copy or data held by every Google service.

9. Where the data is processed

The infrastructure hosting the service and the database is in the European Union, in the Frankfurt region, Germany. That is where your account, your address and your parcels are kept, and that is where the server logs described in point 3 are kept.

Part of the backups described in section 10 stays with the same provider, in the same region. The rest are encrypted copies kept by the company itself, outside the provider: on its own equipment and in Google Cloud storage in Belgium, also in the European Union. The copy of the anonymous statistics in point 4 is kept in Google Cloud’s BigQuery, in the European Union multi-region location.

That says where the data is kept, and it is not the same as saying nothing leaves Germany. Three things are worth keeping apart, because they are usually run together: where the data is kept, where the backups are kept, and who can reach it in order to keep the service running. Hosting is provided by a company with international operations: the console and the administration interface we operate the infrastructure through are not confined to this region, and technical maintenance access can be carried out from outside it.

The remaining providers named in point 8 are companies with international operations, and the processing they carry out may involve transferring data outside the European Economic Area — in particular the carrier lookups, signing in with Google or Apple, the delivery of notifications, the service's email and payments in the stores. Each of them publishes its own data processing terms, which apply to that processing and set out the safeguards it rests on.

If you want to know, for a specific provider, which safeguard applies and where to read it, write to support@starthrop.com and we will reply with the exact reference.

10. For how long

For as long as your account exists — with an account or as a visitor. We do not delete parcels or events because of their age or inactivity: the history stays until you delete the parcel or the account. There is a single exception, and only for one source: DHL is not a source in use in the service today; if and while DHL’s official interface is used, the information obtained from it is deleted 30 days after delivery, as a condition set by DHL itself — the parcel, the history from other sources and everything else remain. This period does not apply to any other carrier.

When you delete your account, your data is erased — account, mobile number, addresses and their history, parcels, tracking events, sessions, recovery requests, notification identifiers, links to Google and Apple, the account’s statistics markers and the plan record — from the database that runs the service, in a single operation that either runs entirely or does not run. It is immediate, and it is about the live database that we say so. Not everything ends at that instant, and what remains falls into two categories, no more: the residual records, of which there are four and which are listed in the table below, and the technical backups, which are a different thing and are explained at the end of this point.

Category one — the four residual records:

About the payment identifier: we keep it for as long as your account exists — including after the subscription ends, because without it an earlier purchase would stop being recognisable — and we delete it 180 days after you delete the account. That period is not arbitrary: it covers the windows in which the store can still write to us about your purchase — Apple retries billing for up to 60 days, and a refund or a dispute can arrive after that. Once the 180 days pass, it is erased. We do not keep it for accounting purposes: the store processes the charge and the transaction’s financial records stay with it — all that reaches us is this identifier and the state of the subscription.

The backups

The database has backups that exist for a single purpose: rebuilding the service if something goes badly wrong. They are not used for routine lookups or to selectively recover one person’s data. There are four kinds:

The copies kept by the company are encrypted when they reach its equipment, and can only be opened with a key that neither the hosting provider nor Google Cloud has. When you delete your account, your data leaves the live database immediately, but remains in these copies until each one expires. If the service ever has to be rebuilt from a copy, we delete again the accounts whose deletion appears in the record described above, which we keep for 30 days. For that reason, no copy kept by the company lasts longer than that record: a copy older than it could no longer be restored without bringing deleted accounts back into the service, so it is deleted.

One-off copies may also exist, taken before a maintenance operation — before a change to the database structure, for instance — so that we can go back if the operation goes wrong. They stay with the provider or, encrypted, with the company, and they have the same purpose, the same protection and the same retention period as the other copies kept where they are.

Password recovery requests expire after one hour and are invalidated as soon as they are used, or when you make a new request.

11. Deleting your account

You can delete the account from your Profile, with double confirmation. It is final. Without an account, “Delete the data on this device”, in the Profile, deletes the visitor account and its parcels in the same way.

Having a former paid plan does not prevent deletion. Your right to erase your data does not depend on any commercial matter.

But deleting the account does not cancel a former subscription. The plan was bought on the App Store, on Google Play or on the web, and it is cancelled where it was bought: in the App Store, in Google Play, or in the customer portal from your account. A store subscription is not something we can cancel for you.

If you delete the account without cancelling, you will continue to be charged by whoever charges you. The app warns you about this before you confirm, and shows the link to where you bought.

12. Your rights

As the data subject, you have the rights of access, rectification, erasure, restriction, objection and portability. Part of them you exercise in the product, without writing to us, and it is this:

• Export — download your data as a file, from your profile, also without an account. That is the right of access and the right to portability.
• Delete the account — in the profile, with double confirmation. It is final.
• Correct or remove your name and mobile number — in the profile. That is rectification, on the part we can hand you directly.
• Correct your address — in the profile. The previous version stays stored, as stated in point 2.
• Disconnect Google or Apple — in the profile, as long as another way to sign in remains.
• Withdraw consent to Statistics and diagnostics — in the profile, at any time. Withdrawal does not affect processing carried out before it. The same “No” also counts as objecting to the anonymous statistics on the device (point 4).

What still depends on writing to us: changing the account's email address, which identifies the account and is not yet editable in the product; objecting to the processing of your name, which rests on legitimate interest, or asking us to delete your mobile number, if you prefer that route to the Profile; and restriction of processing. For those, write to support@starthrop.com. You also have the right to lodge a complaint with the supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD).

13. Security

Connections to the service are encrypted in transit.

Passwords are stored only as a cryptographic derivation — never as you typed them. Recovery requests, sessions and the device code of those using the service without an account are stored as a cryptographic digest: the value in your cookie does not exist in our database, and a recovery request cannot be reconstructed from what we keep.

The email we send is cryptographically signed (DKIM) and the domain is protected by SPF and DMARC, to make it harder for anyone to impersonate us.

Server logs are configured to omit passwords, email, name, mobile number, address, cookies and recovery codes. Provider access credentials do not live in the service’s code.

14. Minors

The service is intended for people aged 18 or over, with or without an account. We do not ask for documents to confirm it.

We do not knowingly collect data from minors.

15. Changes

This policy carries a version and date at the top, and the version in force is always published on this page. From version 1.1.0, its reference address is starthrop.com/package-tracker/privacy/, with a version in each language. Previous versions are kept and can be requested at support@starthrop.com.

When there are material changes — ones that significantly alter what we do with your data — we inform users before they take effect, by means appropriate to the nature of the change and whenever the law requires it.

What changes with version 6.14. The service is presented only as Package Tracker, a product of Starthrop Dynamics, at starthrop.com/package-tracker/ and package-tracker.starthrop.com; the contact is support@starthrop.com and account deletion is described at starthrop.com/package-tracker/delete-account/. The former public website was discontinued, so its measurement is no longer described here; measurement on the pages of starthrop.com is in the Starthrop Dynamics privacy policy (point 4). The account code is now described by its real role (point 2), and the list of what stays on your device includes the technical marker for a sign-out awaiting confirmation (point 4). The new iOS and Android apps use the same providers — Apple and Google, including Firebase and signing in with Apple and with Google — for the same purposes. There are no new categories of data, purposes, legal bases, recipients or retention periods. The next paragraph describes version 6.13.

What changes with this version, and since when. Already true before version 1.1.0: signing in with Google or Apple, available since 14 October 2026; what a notification carries (point 6); and the end of sales of the BASIC and PLUS plans, withdrawn from sale on 21 October 2026. True from version 1.1.0, on the day this policy takes effect: use without an account, the free service with voluntary contributions, the optional mobile number in the Profile, direct lookups with the carriers, the anonymous statistics and the new contact address. AfterShip only stops receiving requests at the cut-over described in point 8.

How we tell you. When a change requires it, we tell those who have an account with an email by email and, in the app, in the notice that appears when a new version is opened. The notice periods in the Terms of Service (point 13) still apply to what they govern.

16. Contact

Any question about this policy or about your data: support@starthrop.com.