Backpacked Privacy Policy

Last updated: October 30, 2026

This Privacy Policy describes how Appify ("we", "us", or "our") handles information in connection with the Backpacked mobile application (the "App"). Backpacked is designed with privacy in mind: there are no accounts, your travelers, packing templates, and trips are stored only on your device, the App contains no advertising and no crash reporting, and its usage analytics never include what you write in the App.

Appify, based in Warsaw, Poland, is the data controller for personal data processed in connection with the App. You can contact us at any time using the details in the Contact Us section.

1. Information We Collect

Data Stored on Your Device

Everything you create in the App is stored locally on your device and is never sent to our servers. This includes:

  • Your name and avatar, and the names and avatars of the travelers (people or pets) you add
  • Packing templates and their items, counts, and rules
  • Trips: destinations, dates, travelers, packing lists, shopping lists, and packed or bought status
  • Cover photos you pick from your photo library or choose from the suggestions, and the last weather forecast fetched for each trip
  • App preferences, such as theme, language, reminder settings, and which guide tours you have seen

We do not receive, see, or have access to this data. Because it is not sent to us, we cannot recover it if you delete the App or lose your device, unless it is included in a backup made by your device (for example iCloud or Google backup), which is governed by Apple's or Google's terms.

No Accounts

Backpacked does not require, and does not offer, an account. We do not ask for your email address, phone number, or password.

Destination Search, Photos, and Weather

To suggest destinations, cover photos, and forecasts, the App sends requests to the Backpacked backend service operated by us. Only the information needed for each request is sent:

  • Destination search: the text you type in the destination field (once you have typed at least three characters) and a random session identifier that groups the searches for one destination. When you pick a suggestion, the place identifier is sent to look up the place's coordinates.
  • Cover photos: the short name of your destination (for example "Lisbon") is used to search for photos.
  • Weather forecast: the coordinates of your destination and your trip dates, requested only when a trip is within 14 days of starting or in progress.

These requests do not include your name, the names of your travelers, your packing lists, or any other contents of your trips. The backend passes them on to the third-party providers listed in Section 4. Like any online service, our backend and those providers can see the IP address and basic technical details (such as device type and app version) of the request. We do not use this information to identify you.

To confirm that requests come from the genuine App, the App also sends a Firebase App Check token with each request. App Check uses Apple App Attest or DeviceCheck on iOS and Play Integrity on Android, which involve a device attestation handled by Apple or Google.

If you type a destination without choosing a suggestion, or if these features are unavailable, you can still use the App: the typed text is used as the destination, and you can pick your own cover photo.

Server Logs

Our backend runs on Google Cloud (region europe-central2, Warsaw) and keeps technical logs of requests for security, abuse prevention, cost control, and troubleshooting. A log entry records the time, the type of request and its path, which can include a destination search text, the result status, how long it took, and errors. Entries are not linked to a name or an account.

Purchases

Premium is a one-time purchase handled by the Apple App Store or Google Play and managed through RevenueCat. RevenueCat creates an anonymous identifier for your installation and receives purchase information (such as which product you purchased and when) so the App can unlock Premium and restore it after a reinstall. We never receive your payment details, and RevenueCat does not receive your name or email address from the App.

Remote Configuration

The App uses Firebase Remote Config to receive on/off settings that let us switch the destination, photo, and weather features off in an emergency, for example to control costs. Firebase generates an installation identifier for this and receives basic device information in the process.

Analytics

The App uses Firebase Analytics to help us understand how the App is used and which features to improve. The data collected includes:

  • Device type, operating system version, and app version
  • Usage events, such as finishing the welcome screen, creating a trip, starting or finishing packing, using a feature, and seeing or closing the Premium offer
  • General details about your use: whether you have Premium, whether reminders are on, and rounded figures such as how long ago you started using the App, how many trips and travelers you have, how long a trip is, and how far ahead it was planned
  • A random app-instance identifier generated by Firebase

Analytics data is pseudonymous. It never includes your name, the names of your travelers, destinations, trip dates, or the contents of your templates and packing lists. We do not use it to identify you. Analytics is disabled in debug/development builds and is only active in production releases.

Backpacked does not use advertising or crash reporting services, does not use your device's advertising identifier, and does not track you across apps or websites.

Information You Send Us

If you contact us by email or through the support form, we receive your email address and the contents of your message. We use it only to reply to you and delete it when it is no longer needed.

2. How We Use Your Information

We use the information described above to:

  • Provide destination suggestions, cover photos, and weather forecasts
  • Process purchases and unlock or restore Premium
  • Keep the backend secure, prevent abuse, and control costs
  • Diagnose technical problems
  • Understand how the App is used and decide what to improve
  • Answer your questions and handle privacy requests

3. Legal Bases for Processing

If you are in the European Economic Area, the United Kingdom, or another region with similar laws, we rely on the following legal bases under the GDPR:

  • Performance of a contract (Art. 6(1)(b)): to provide the features you ask for, such as destination search, forecasts, and the Premium features you purchased.
  • Legitimate interests (Art. 6(1)(f)): to keep the App and backend secure and stable, prevent abuse, control costs, and understand how the App is used so that we can improve it.
  • Legal obligation (Art. 6(1)(c)): to respond to privacy requests and keep records required by law.

4. Third-Party Services

Backpacked uses the following third-party services, each governed by their own privacy policies:

  • Google Cloud and Firebase: hosting of our backend, App Check, Remote Config, and analytics. See Firebase Privacy Policy.
  • Google Places: destination search and place coordinates. See Google Privacy Policy.
  • Weather providers: forecasts are supplied by one of Tomorrow.io, Open-Meteo, or Visual Crossing. The provider in use is shown next to the forecast in the App and can change over time.
  • Photo providers: cover photo suggestions come from Pixabay or Pexels. The App loads and downloads the suggested photos directly from their servers, so they can see your IP address when you view or save one.
  • RevenueCat: in-app purchase management. See RevenueCat Privacy Policy.
  • Apple App Store / Google Play Store: purchases are processed through the respective platform's payment systems. We do not have access to your payment details. See Apple Privacy Policy.

These providers process data on our behalf or under their own terms, and only for the purposes described in this policy. We do not sell your personal data or share it for advertising.

5. International Data Transfers

Google, RevenueCat, and the other providers above may process data on servers located outside the European Economic Area, including in the United States. Where data is transferred outside the EEA, it is protected by appropriate safeguards, such as the EU–U.S. Data Privacy Framework where the provider is certified, and the European Commission's Standard Contractual Clauses.

6. Device Permissions

The App may request the following device permissions, only when needed:

  • Photo Library: To let you choose a cover photo for a trip. The App only receives the photo you select; it cannot browse your library. The selected photo is copied into the App's own storage on your device and is never uploaded.
  • Notifications: To send trip reminders, such as when a forecast is ready or when items are still left to buy. These are local notifications scheduled on your device; they do not involve our servers. You can turn them off in the App's settings or in your device settings at any time.
  • Internet access: To search destinations, load photos, fetch forecasts, and process purchases. Android may also let the App restart scheduled reminders after your device reboots.

The App does not access your location, contacts, microphone, or camera.

7. Data Retention & Deletion

Data on your device stays there until you delete it or uninstall the App. You can delete travelers, templates, trips, and packing items at any time in the App, and uninstalling the App removes all of its local data.

Because there are no accounts, we do not hold a profile or any of your trip data that we could delete on request. The limited data described in Sections 1 and 4 is retained as follows:

  • Server logs: kept only as long as needed for security and troubleshooting, and then deleted automatically.
  • Analytics: pseudonymous event data is kept for up to 14 months, and then deleted automatically.
  • Purchase records: kept by Apple, Google, and RevenueCat as required by tax and financial regulations.
  • Emails you send us: kept until your request is resolved, and then deleted unless we are required to keep them.

If you believe we hold data about you, contact us at [click to reveal email] and we will help.

8. Your Rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you
  • Have inaccurate data corrected
  • Have your data deleted
  • Restrict or object to certain processing
  • Receive your data in a portable format (data portability)

Since most of your data is stored only on your device, you already control it directly. To exercise any of these rights regarding data we hold, contact us at [click to reveal email] . We will respond within one month. You also have the right to lodge a complaint with a data protection authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or the authority in your country of residence.

9. Data Security

We take reasonable measures to protect your data. Data in the App is stored using your device's standard storage mechanisms. Communication with our backend is encrypted over HTTPS, and requests are verified with Firebase App Check. Our backend does not store your trips or travelers.

However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

Backpacked is not directed at children under the age of 16. We do not knowingly collect personally identifiable information from children under 16. You may add the names of family members, including children, as travelers; this information stays on your device and is not transmitted to us. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will promptly delete it.

11. Links to Other Sites

The App may contain links to external websites or services not operated by us, such as the credits shown with forecasts and photos. We strongly advise you to review the privacy policies of any third-party sites you visit. We have no control over and assume no responsibility for the content or privacy practices of external sites.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this page periodically. Continued use of the App after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:

Appify
Email: [click to reveal email]
Warsaw, Poland