# PaketQR: What leaves your iPhone, and what stays on it

The code on a shipping label carries your full name and home address in clear text. That is why this page is specific about where each piece of data sits. Written for the current build; it is the same account of the app that its own help screens give.

## On your iPhone

Parcels, codes, raw payloads, item photos and receipt photos are stored on your iPhone. The local copy is the system of record and is file-protected while the iPhone is locked. There is no account to create and nothing to sign in to.

## iCloud sync

On by default. Parcel records are copied into your own private iCloud database — your account, not a server this project runs. The name and address read out of the code are encrypted on the iPhone first, with the key in your iCloud Keychain. Receipt and item photos are synced as well, and a receipt photo keeps its capture location. Switching sync off deletes the copy in iCloud; the parcels on the iPhone stay. Another device with sync still on puts its own copy back, so switch it off there as well.

## Tracking

Without Pro, PaketQR sends nothing to its own server for tracking: the app holds the number and opens the carrier’s own page when you ask it to, which hands the tracking number to the carrier’s website. Pro follows a parcel, and the app then asks DHL, Hermes and DPD about it through api.paketqr.de, a server this project runs. A request carries the tracking number and the carrier; some requests also carry an anonymous key generated on your iPhone, and push notifications need a push token so an answer can reach you. No name, no address, no payload bytes, no cookies. The same parcel is not asked about twice in quick succession, and a parcel the carrier has delivered is not asked about again by itself. Switching tracking off deletes every stored history at once. The app works fully without it.

## What is kept from a carrier’s answer

The status, the history steps and the carrier’s headline are stored on the parcel so the timeline survives a relaunch. A later answer adds to that record and never removes anything from it. How long it is kept is yours to set — one month, one year, or always, and always is the default. A carrier’s answer reaches the evidence PDF only if you put it there at the export sheet.

## Spotlight

On by default, and nothing is transmitted: the index is local to the iPhone. What goes in is the parcel’s name, the merchant, the recipient’s address, the carrier, your own alias and note, and the deadline. What stays out is the tracking number, the receipt’s numbers, and everything a recognizer read off a photograph.

## Calendar

Write-only access, and only if you ask for an entry. By default the event names the merchant; with that switched off it names the occasion and the carrier instead. The tracking number and the note are a separate switch.

## Sharing and export

A receipt photo is kept as it came from the camera, with its capture time and, where the camera recorded one, its place — that is what makes a receipt evidence. Sharing a single image out of the app strips those details first. “Export all data” under Settings › Data does not: it packs every parcel, receipt and photo into a ZIP unchanged, because that archive is your own backup. It carries those details to wherever you send it, which is worth knowing before you pass it on.

## No analytics, no third parties

No third-party SDKs, no advertising, no crash reporting, no transmitted analytics. A few local counters record how the app is used — how many parcels were created, how many of them got a receipt, how often a code could not be read. They hold nothing out of a code: no names, no addresses, no tracking numbers, no times. They sit in the app’s own settings on the iPhone and are never sent anywhere.

## Privacy mode

One switch turns off, in one go, everything the app can disclose about a parcel: iCloud sync, tracking, Spotlight and both calendar details. Your individual settings are kept and apply again as soon as you switch the mode off.

## Deleting

Delete one parcel, the whole archive, or all data. Moving a parcel to the archive deletes nothing; deleting the parcel deletes its photos, its receipt and its raw payload from the iPhone and, while iCloud sync is on, from iCloud and your other devices as well — none of which the app can bring back. “Delete archive” takes only the archived parcels; the open ones stay. “Delete all data” removes every parcel and everything attached to it, and switches iCloud sync off — another device still holding its own copy can put that copy back into iCloud, so delete there as well.

## Contact

Questions about this notice, or a request about your data: support@paketqr.de

## Controller and imprint

Nicolas Zimmer  
c/o COCENTER  
Koppoldstr. 1  
86551 Aichach  
USt-IdNr.: DE175934966  
support@paketqr.de

Last updated September 18, 2026