Summary
Pallet is built to collect as little about you as possible.
- No account required. No name, email, or phone number.
- No advertising, no behavioral analytics, no third-party trackers.
- Crash reports and usage metrics use Apple's standard anonymous diagnostics — nothing else.
- We do not sell or share your data.
- The only information our servers hold is an opaque CloudKit identifier provided by Apple and the tracking numbers you ask us to track.
What We Collect
CloudKit user identifier. We use Apple's CloudKit service to identify your account. CloudKit gives us an opaque identifier that is unique to you within Pallet but is not your Apple ID, name, email, or any other personal information. We cannot use it to identify you outside the app. It is provided by Apple and is stable across your devices signed into the same iCloud account, which is how your tracked packages stay in sync.
Tracking numbers. When you add a package, the tracking number is sent to our servers and associated with your CloudKit identifier. We use it to fetch and forward status updates from the relevant carrier.
Carrier-supplied tracking events. Status, timestamps, and scan locations returned by the carrier for each tracking number you've added.
Push notification token. If you enable notifications, Apple provides a token tied to your device. We use it solely to deliver status-change updates for your packages.
What Stays on Your Device
Anything you personalize stays on your device and is never sent to our servers. This includes the title or label you assign to a package, notes, custom sort order, and app preferences. Our servers only ever see the raw tracking number, not what you've named it.
How We Use This Information
- To fetch package status from carriers and display it to you.
- To send a push notification when a package's status changes.
- To synchronize your tracked packages across your devices.
- To diagnose crashes and improve reliability.
Who We Share It With
Only the parties needed to deliver the service:
- 17track — our tracking data aggregator. We send tracking numbers to 17track so they can return up-to-date carrier status. They do not receive your CloudKit identifier.
- Shipping carriers (e.g., FedEx) — for carriers we integrate with directly, receive tracking numbers when we query their tracking endpoints. They do not receive your identifier.
- Apple Push Notification service (APNs) — receives notification payloads addressed to your device token.
- Our cloud hosting provider — stores the data described above under standard data-processing terms.
We do not share data with advertisers, data brokers, or analytics networks. We may disclose information if required by valid legal process.
Analytics and Crash Reporting
We use Apple's standard, anonymous diagnostics — the same crash reports and usage metrics that any iOS app receives through App Store Connect when users opt in at the system level. This data is aggregated by Apple, is not tied to your identity, and is shared with us only in anonymous form. You can disable it at any time in iOS Settings → Privacy & Security → Analytics & Improvements → Share with App Developers.
We do not use Google Analytics, Firebase Analytics, Mixpanel, or any other third-party analytics SDK.
Retention and Deletion
You can remove any package at any time from within the app. When you do, we delete the association between your CloudKit identifier and that tracking number.
The tracking events themselves (status, timestamps, scan locations) are public carrier data and may be retained in an unassociated form so they can be served to other users tracking the same package.
To remove your data, delete the app or use the in-app delete option. This removes all associations between your CloudKit identifier and the tracking numbers you've added.
Security
Data in transit is encrypted with HTTPS/TLS. Data at rest is stored under industry-standard access controls.
Children
Pallet is not directed to children under 13, and we do not knowingly collect information from them.
California Residents
We do not sell or share personal information as defined under the California Consumer Privacy Act. California residents may exercise their rights of access and deletion by emailing support@getpallet.app. Because we hold only an opaque CloudKit identifier and tracking numbers, requests should reference the tracking number(s) in question.
Changes
We may update this policy. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by an in-app notice.
Contact
Pallet
support@getpallet.app