Privacy Policy

Introduction

This Privacy Policy explains how PackRat ("we", "us", or "our") collects, uses, and shares your personal information when you use our application and related services. We respect your privacy and are committed to protecting your personal data.

Information Collected

We collect the following types of information:

• Personal identifiers (name, email address, username)
• Device information (device type, operating system)
• Usage data (interactions with the app, features used)
• Location data (if permitted by you)
• User content (pack lists, item details, notes)

We collect this information through:

• Direct interactions (when you create an account or profile)
• Automated technologies (cookies, analytics tools)
• Third-party services (authentication providers)

How the Data is Used

We use your personal information for the following purposes:

• To provide and maintain our service
• To create and manage your account
• To personalize your experience
• To improve our app and develop new features
• To communicate with you about updates or changes
• To analyze usage patterns and optimize performance

The legal basis for processing your data includes:

• Your consent
• Performance of our contract with you
• Our legitimate business interests
• Compliance with legal obligations

Data Sharing & Disclosure

We may share your information with:

• Service providers (hosting, database management, analytics)
• Business partners (with your consent)
• Legal authorities (when required by law)

We may also disclose your information:

• In response to legal requests
• To protect our rights, privacy, safety, or property
• In connection with a business transfer or acquisition

Cookies & Tracking Technologies

Our app uses cookies and similar tracking technologies to:

• Remember your preferences
• Analyze how you use our app
• Improve functionality and performance

You can manage cookie preferences through your browser settings. However, disabling certain cookies may limit functionality.

MCP Connector & Third-Party Clients

PackRat operates a Model Context Protocol (MCP) connector at mcp.packratai.com that lets you connect MCP-capable clients (for example, Claude.ai) to your PackRat account. This section explains how we handle data on that surface.

• OAuth tokens. When you connect an MCP client we store the OAuth refresh token at rest in Cloudflare KV, which encrypts data at rest. Access tokens are short-lived (60 minutes); refresh tokens last 30 days and rotate on use.
• What the MCP client sees. Only the data the scopes you approved authorize. mcp:read exposes read-only tools, mcp:write adds create/update/delete, and mcp:admin is granted only to PackRat admin users.
• What the MCP client does NOT see. The MCP client never sees your PackRat password — sign-in is handled directly by our authentication service. We do not log the conversation content you send to MCP clients; we only see the tool calls those clients make against PackRat.
• Retention. OAuth grants are deleted automatically when the refresh token expires, and immediately when you revoke the connection from your PackRat account or by emailing us.
• Third-party clients. When you connect a third-party MCP client (e.g., Claude.ai) to PackRat, that client's own privacy policy governs how it handles the PackRat data it receives. We are not responsible for the data practices of MCP clients we do not operate.
• Deletion. To delete your PackRat account, or to revoke just the MCP OAuth grants without deleting your account, use the account-settings flow in the app or contact us at hello@packratai.com.

User Rights & Choices

Depending on your location, you may have the following rights:

• Access your personal data
• Correct inaccurate data
• Delete your personal data
• Object to or restrict processing
• Data portability
• Withdraw consent

To exercise these rights, please contact us using the information provided in the "Contact Information" section.

To delete your account and associated data, please visit our Account Deletion page for step-by-step instructions.

Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including encryption, secure servers, regular security assessments, and access controls. However, no method of transmission over the Internet or electronic storage is 100% secure, so we cannot guarantee absolute security.

Data Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. When determining retention periods, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. When we transfer your data internationally, we take appropriate safeguards to ensure your information remains protected in accordance with this Privacy Policy and applicable law.

Children's Privacy

Our service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will take steps to delete such information.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: privacy@packratai.com