This Privacy Policy explains how Peelpack (the “App”) handles information, both for people who use the App and for people who open a board or kit that someone shared from it as a web link. The App is developed and published by Busra Hekimoglu, an independent developer publishing as NoxTri (“we”, “us”). It applies to the App on iPhone and to its shared link pages.
Peelpack has no ads, no analytics, no tracking and no accounts. Your photos, stickers, boards, kits and things stay on your iPhone and in your own private iCloud, which we cannot see. Only when you tap Create link or Update link are that one board’s or kit’s titles and sticker images uploaded to our link server, so the people you send the link to can open it; Stop sharing deletes them. People who open a link can reserve items, with an optional first name.
1. Who is responsible
The data controller for the information described here is Busra Hekimoglu, the developer who publishes Peelpack as NoxTri. You can reach us at support@logventure.net.
2. What stays on your device and in your iCloud
The App keeps the following on your iPhone:
- your stickers and the photos you made them from;
- item titles, notes and the product links you added;
- which items you want, have and pack;
- your boards and kits;
- for a board or kit you share, the link’s ID and the key that lets you manage that link.
If iCloud is on for your iPhone, the App syncs this data through Apple’s iCloud (CloudKit) to your own private iCloud database, so it is on your other devices and survives a reinstall. Your private iCloud database belongs to your Apple Account: Apple stores it under its own privacy policy, and we, as the developer, cannot see or access it. If iCloud is off, the data stays on that iPhone only (Settings says “iCloud is off”). Deleting a sticker, board or kit in the App deletes it from your iPhone and, through sync, from your iCloud. Deleting the App removes the copy on that iPhone; the copy in your iCloud stays and comes back if you reinstall the App. To remove that too, delete your stickers, boards and kits in the App while iCloud is on, before you delete the App.
3. Camera, photos and stickers
The App asks for camera access the first time you choose Take a photo, and uses the camera only to take the photo you turn into a sticker. Choose from Photos opens the iOS photo picker, and the App receives only the photos you pick. The cutout is made on your iPhone by Apple’s Vision framework, and the white edge and shadow by Core Image; your photos are not sent to us, to Apple or to anyone else to do this. The App does not change or delete anything in your photo library. You can turn camera access off at any time in iOS Settings › Peelpack.
4. Adding from a shop link
When you paste a link and tap Get images, your iPhone fetches that page directly from the shop’s website, reads its title and the pictures it lists, and downloads those pictures so you can pick one. The request goes from your iPhone to that website, not through our servers, so the website sees it like a visit from a browser (for example, your IP address) and handles it under its own privacy policy. The link is saved with the item so you can open the product page later. Peelpack does not track prices and adds no affiliate or tracking codes to links.
5. Sharing a board or kit as a link
Sharing is optional and happens only when you open Share on a board or kit and tap Create link. The App then uploads to our link server:
- the board’s or kit’s name;
- for each of its first 60 items: its title (on kits with its quantity, such as “×2”), a random item ID, and its sticker image as a PNG resized to at most 768 pixels;
- whether it is a board (surprise mode) or a kit (open mode).
Nothing else is uploaded: not your original photos, notes, product links, other boards or kits, your name, Apple Account, iCloud identity, device identifiers or location. The server returns the link and a random key that lets you manage this link; the key is kept with the board or kit in the App (and so in your iCloud), and the server stores only a hash of it.
Update link sends the current titles and stickers again; reservations for items still on the list are kept, and the images and reservations of removed items are deleted. Changes in the App do not reach the link until you tap Update link.
Anyone who has the link can see the board’s or kit’s name, titles, stickers and which items are reserved, without the App or an account. The link is not listed anywhere, and its page asks search engines not to index it, but anyone you or they send it to can open it. When the link is sent in a messaging app, that app may fetch the page title and a sticker to show a preview.
Stop sharing deletes the share from the server: its titles, its sticker images, all of its reservations and its abuse counters, and the link stops working. Deleting a shared board or kit in the App also deletes its link from the server; if you are offline at that moment, the App tries again the next time it opens. Deleting the App does not stop a link, so tap Stop sharing first. If you can no longer do that (for example, you lost your phone with iCloud off), email us the link and we will delete it.
6. Reservations by people who open a link
People who open a link can tap an item to reserve it (“I’ll get this” on boards, “I’ll bring this” on kits) and can type an optional first name of up to 40 characters. For each reservation the link server stores the item, the name if one was given, the time, and a hash of a random token that the viewer’s browser creates to recognise its own reservations.
- Boards use surprise mode: the name is stored with the reservation but never shown to anyone, neither on the page nor to the board’s owner in the App. The owner sees only how many items are reserved; everyone with the link sees which items are taken, not by whom.
- Kits use open mode: the name is shown next to the item to everyone who has the link, and to the kit’s owner in the App.
The viewer’s browser keeps those random tokens and the last name typed in its local storage, on the viewer’s own device, so they can undo their own reservations. The page itself sets no cookies and loads no third-party scripts, fonts or trackers. A viewer can remove their reservation with Undo in the same browser; the owner can remove all of them with Reset reservations; Stop sharing deletes them all. If you would rather not give a name, leave it empty and “Someone” is shown instead.
7. Protection against abuse
To stop one person from flooding a link with changes, the link server counts reservation changes (reserving and undoing) per share and per hour. To do this it combines the viewer’s IP address with the share’s ID, computes a SHA-256 hash of the result, and stores the first 32 characters of that hash with the hour and a counter; the IP address itself is not stored. More than 30 changes in an hour from the same address on the same link are refused until the next hour. Old counters are deleted from time to time as new reservations come in, and all of a link’s counters are deleted when sharing stops. The link server does not write IP addresses, browser details or access logs to its database.
8. Where the link server runs
The link server is a Cloudflare Worker: shares and reservations are stored in Cloudflare D1 and sticker images in Cloudflare R2. Cloudflare, Inc. processes this data on our behalf to run the service, and its network handles each request (including its IP address) to deliver it, under Cloudflare’s own privacy policy. Cloudflare may process the data in countries other than yours, including the United States.
9. How long we keep it
- Shared boards and kits and their reservations: until the owner taps Stop sharing (or asks us to delete them); there is no automatic expiry. Data of removed items is deleted on Update link, and a reservation is deleted when its viewer taps Undo or the owner taps Reset reservations.
- Abuse counters: as described in section 7.
- Emails you send us: as long as needed to answer you.
10. No ads, analytics or tracking
The App contains no advertising, analytics, crash reporting or tracking tools, and no third-party SDKs. It does not track you across other companies’ apps or websites, so it never asks for App Tracking Transparency permission. Its App Store privacy label lists only data used for App Functionality and not linked to you (the content you share), and no data used to track you. If you have chosen in iOS Settings to share analytics with app developers, Apple may pass anonymous crash reports to us under its own privacy policy.
11. Purchases
Peelpack Plus is sold by Apple through the App Store. Apple processes the payment, and we never see your payment details or your Apple Account details. To unlock unlimited stickers, boards and kits, the App only asks StoreKit whether you have an active Plus purchase; Restore purchases asks Apple again. No purchase information is sent to our link server.
12. Children
Peelpack is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has typed their name on a shared link or shared a board, contact us and we will delete it.
13. Your rights
Under laws such as the GDPR or KVKK you have the right to access, correct and delete your data and to object to its processing. We process shared data to provide the link and reservations that its owner and viewers ask for (performance of a contract), and the hashed counters on the basis of our legitimate interest in protecting the service from abuse. Because there are no accounts, we cannot tell who uploaded a share or made a reservation: to have data deleted, use Stop sharing, Reset reservations or Undo, or email us the link (and, for a reservation, the item and the name used) and we will delete it. You can also complain to your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK).
14. Changes to this policy
If the App changes in a way that affects your privacy, we will update this page and the “Last updated” date before that change is released.
15. Contact
Questions about this policy and deletion requests: support@logventure.net. If you email us, we use your email address and what you write only to reply to you.