PackLox Privacy Policy

Last updated: 2026-10-25

Operator: HR Tech Consulting Pty Ltd trading as PackLox (“PackLox”, “we”, “us”, or “our”), Australia.

Contact: admin@packlox.com

1. Scope

This Privacy Policy describes how we collect, use, store, share, and protect information when you:

1. Download or use the PackLox mobile application (the “App”);
2. Use related PackLox websites or services we operate (including packlox.com and PackLox API endpoints); or
3. Contact us by email or in-app support channels.

“Personal information” means information that identifies or can reasonably be linked to an individual under applicable privacy laws. We aim to handle personal information in a manner consistent with the Australian Privacy Principles (APPs). Where the APPs do not strictly apply (for example if a small-business exemption is available), we still use this Policy as our operating standard.

By using PackLox, you acknowledge this Policy. If you do not agree, do not use the App or create an account.

2. Product summary

PackLox helps collectors scan, identify, save, value, and organise collectibles (for example trading cards, coins, comics, games, sneakers, and related categories).

• An account is required to use the App (email sign-in).
• Portfolio data may also be stored on your device for performance and offline access after you sign in.
• Cloud sync / backup and other online features (catalog search, market pricing, AI photo analysis, push alerts) process additional data when you use those features.

3. Information we collect

What we collect depends on how you use PackLox.

3.1 Information you provide

3.2 Information collected automatically

Sanitised telemetry design. Analytics events are configured not to include API keys, passwords, raw image bytes, local file paths, or free-text personal notes. Crash reports may still include technical stack traces and device metadata. If a future build changes this, we will update this Policy.

3.3 Information from service providers

We may receive or process information through providers that power PackLox, including:

• Supabase — authentication, database, and object storage (production project region: United States — Oregon / us-west-2);
• PackLox API hosting (currently Render or equivalent cloud host) — AI orchestration, catalog search, pricing responses, data-request APIs;
• AI model providers via our backend only (for example Google Gemini and OpenAI-compatible APIs) — image recognition / analysis; API keys never ship in the App;
• Market / catalog data providers via our backend — including PriceCharting, SportsCardsPro (sports cards), and KicksDB (sneakers);
• Catalog image / metadata sources — including RAWG (video games), Rebrickable (LEGO), and Scryfall (Magic: The Gathering card imagery), where used and attributed in the App;
• Firebase (Google) — Analytics, Crashlytics, and Cloud Messaging;
• Apple App Store / Google Play — distribution and in-app purchases / entitlements;
• Cloudflare — website / edge hosting for PackLox web properties where used;
• Email delivery through our auth stack — password reset and account emails.

We do not receive your full payment card number. Card payments are handled by Apple or Google under their terms.

Sign-in today is email/password (and related auth flows) via Supabase. If we add Apple or Google Sign-In later, we will update this Policy and apply those providers’ limited-use requirements.

3.4 Information we do not intentionally collect

PackLox is not designed to collect:

• Precise GPS location for advertising or tracking;
• Contacts, call logs, SMS content, or microphone audio;
• Health / fitness data;
• Government ID numbers;
• Payment card PAN / CVV.

3.5 Photos and EXIF metadata

Photos you capture or select may include embedded EXIF or similar metadata (for example capture time, device model, and — if present on the file — location). PackLox does not currently strip EXIF data before upload or analysis. If you do not want location or other EXIF fields processed, remove them in your device photos app before selecting the image, or avoid uploading photos that contain that metadata.

We do not use photo EXIF to build advertising profiles.

4. How we use information

We use information to:

1. Provide the App (scan, identify, save, display, value, organise);
2. Operate accounts (authenticate, reset passwords, associate cloud records with your user ID);
3. Sync and back up portfolio and images when you enable sync;
4. Run AI analysis on images you choose to analyse;
5. Show catalog and market context from connected sources;
6. Deliver local or push notifications you allow (for example price alerts);
7. Manage subscriptions and entitlements through Apple/Google;
8. Secure and operate infrastructure (abuse prevention, debugging, rate limits);
9. Improve reliability via crash and sanitised usage diagnostics;
10. Process in-app export and account-deletion requests;
11. Comply with law and respond to support requests.

We do not sell your personal information. We do not share personal information for cross-context behavioural advertising.

AI and training

• PackLox does not use your photos to train PackLox’s own machine-learning models.
• When you run AI analysis, images (and related request metadata) are sent to our backend and then to the configured AI API provider for inference / service delivery.
• We do not sell your photos as training data.
• Whether a provider may use API inputs for its own model improvement is governed by that provider’s API terms and our account settings with them. We select API / enterprise-style configurations intended for service delivery; we will update this section if those settings change.
• We do not independently control how long a provider retains API payloads beyond their published terms and our contractual settings.

5. Legal bases (where GDPR / UK GDPR apply)

If you are in a region that requires a “legal basis”, we typically rely on:

• Contract — to provide the App features you request;
• Legitimate interests — security, fraud prevention, reliability, and limited diagnostics that do not override your rights;
• Consent — where required (for example certain notifications);
• Legal obligation — when we must retain or disclose information.

6. How we share information

6.1 Service providers

6.2 Staff and admin access

Authorised PackLox personnel may access account or portfolio records through internal admin / support tools only as needed to:

• provide customer support;
• investigate abuse, security, or billing issues;
• operate and maintain the service;
• process data-export requests that are not fully automated.

Admin / ops access may use elevated credentials (for example a database service role) that can see more than a normal end-user session. Access is limited to personnel with a need to know and is subject to confidentiality obligations.

6.3 Legal and business transfers

We may disclose information if reasonably necessary to comply with law, enforce our terms, protect rights and safety, or complete a merger, acquisition, or asset sale (with appropriate protections).

6.4 What we do not do

• We do not sell personal information.
• We do not share your portfolio with other users, except one collector photo as described in section 6.5.
• The App does not embed third-party pricing or AI API secrets.

6.5 Collector photos in Discover

When you have accepted the current Terms, and a catalog product has no official image, authorised staff may select one photo you uploaded and display it to other people in Discover and on that product page. It is labeled as a collector photo. Your other photos, notes, and purchase details are not shown.

Deleting the photo, the item, or your account removes that Discover image. If an official image is later available, we show the official image instead. We do not sell these photos.

7. International transfers

PackLox is operated from Australia. Your information may be processed in the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards offered by those providers or other lawful transfer mechanisms.

8. Retention

9. Security

We use reasonable technical and organisational measures appropriate to the risk, including:

• HTTPS for API and auth traffic;
• server-side secrets (AI/pricing keys never shipped in the App);
• Supabase Row Level Security policies designed so cloud rows are scoped to the signed-in user;
• access controls for production systems and admin tools;
• sanitised analytics event design.

No method of transmission or storage is 100% secure. You should keep your own backups of important collection records and photos. Optional cloud sync is a convenience feature, not a guaranteed archive. Liability for data loss is addressed in the PackLox Terms of Service.

10. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to certain processing, and to withdraw consent where processing is consent-based.

In the App

• Delete local portfolio items in the App;
• Schedule account deletion in the App (30-day grace period; cancel any time before purge);
• Request a data export from Settings (processed via our support/ops workflow);
• Disable notifications in system or App settings;
• Sign out (local portfolio data is not automatically wiped on sign-out).

How to exercise rights / complain

1. Use the in-app controls where available; or
2. Email admin@packlox.com with subject “Privacy Request” and the email on your account.

We aim to acknowledge privacy complaints within 7 days and to provide a substantive response within 30 days (or sooner if required by law).

If you are in Australia and unsatisfied after our response, you may contact the Office of the Australian Information Commissioner (OAIC). If GDPR/UK GDPR applies, you may lodge a complaint with your local supervisory authority.

Google Play / web deletion path

Account deletion is available in the App. You may also email admin@packlox.com with subject “Account Deletion”. We will point you to the in-app flow or process an equivalent request.

11. Children’s privacy and minimum age

You must be at least 13 years old to create a PackLox account. PackLox is not directed at children under 13. We do not knowingly collect personal information from children under 13 for accounts. If you believe a child under 13 has created an account, contact admin@packlox.com and we will take reasonable steps to delete it.

(The App Store / Play age rating for content may differ from this account minimum; the account minimum in this Policy and the Terms controls.)

12. Images, catalog content, and valuations

PackLox displays third-party catalog data, images, and market estimates for identification and portfolio context only.

• Catalog photos and similar media are representational only and may not match your physical item.
• An image match or AI suggestion does not verify authenticity or identity.
• PackLox is an independent, unofficial product and is not affiliated with publishers, mints, manufacturers, or grading companies unless expressly stated.
• Market values are estimates, not appraisals, offers, or financial product advice. See the Terms of Service for full disclaimers.

Attribution notices (including PriceCharting, RAWG, Rebrickable, Scryfall, and Wizards fan-content notices where applicable) appear in the App.

13. Push notifications and communications

With your permission, PackLox may send local or push notifications (for example price alerts), which requires processing device push tokens (§3.2). You can revoke permission in device settings. We may send transactional emails required for account security (password reset). We will not send marketing email unless we introduce that feature and provide an unsubscribe method.

14. Website cookies

If packlox.com or related sites use cookies or similar technologies (for example hosting, security, or basic analytics), that processing is limited to operating and securing the site. We will expand this section if we add advertising or advanced web analytics.

15. US state privacy notices

If you are a resident of a US state with consumer privacy laws (for example California), we disclose that:

• We collect the categories in §3 for the purposes in §4;
• We do not sell personal information and do not share it for cross-context behavioural advertising;
• You may request access, deletion, or correction via admin@packlox.com;
• We will not discriminate against you for exercising privacy rights.

16. Data breaches

If we experience an eligible data breach under the Australian Notifiable Data Breaches scheme, we will assess the incident and, where required, notify affected individuals and the OAIC as soon as practicable. We may also notify users in other regions as required by applicable law.

17. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date will change. For material changes we will provide additional notice in the App or by email where appropriate. Continued use after the effective date means you accept the updated Policy to the extent permitted by law.

18. Contact

Privacy / data requests / complaints Email: admin@packlox.com Operator: HR Tech Consulting Pty Ltd (PackLox), Australia

Liability limits, data-loss responsibility, and related legal terms are set out in the PackLox Terms of Service.