Privacy Policy

Last updated: 1 November 2026

Whereabox is built to need as little about you as possible. There is no account and no sign-up. This policy explains, in plain English, what data the app and our server handle, why, and what you can do about it.

1. Who we are

Whereabox (the “app”, “we”, “us”) is operated by an individual developer, Mark Moore, 15100 6th Ave SW, Seattle, WA 98166, United States, who is the controller of the personal data described in this policy.

You can reach us about anything in this policy at [email protected].

2. What the app does

Whereabox is an iPhone app that tracks parcels. You add a tracking number by typing or pasting it, by scanning a shipping label with the camera, or by sharing a link from another app. The app detects the carrier, asks our server to look up the parcel’s tracking events, and shows you the journey and the estimated delivery date. Delivered parcels are kept in an archive on your iPhone, which you can share as text or PDF. It can send you notifications about your parcels and show them in a Live Activity and a home-screen widget.

3. Data we collect and why

a) Parcel information

The tracking numbers you add, any optional labels or names you give your parcels (for example “Running shoes”), the category you choose for them, and the destination country. We need these to look up your parcels with the carriers and show you their status. They are stored on our server and linked to an anonymous installation identifier — not to your name, email or any account.

If a carrier requires a postal code to show tracking events (for example DHL), the app asks you for the destination postal code. It is sent only to that carrier, and only when the carrier asks for one, and it is stored on our server with the parcel’s tracking data for the same period (see section 7). We do not ask for your full delivery address.

b) Installation identifier and push notification token

On first launch the app generates a random installation identifier. If you allow notifications, Apple also gives the app a push notification token. We use these to deliver notifications about your parcels and to restore your parcels if you reinstall the app on the same device.

c) Technical server logs

Like any web service, our server records technical logs of requests: IP address, request time and user agent. We keep these for up to 30 days for security and to prevent abuse, and then delete them.

d) Camera

If you use the label scanner, the camera is used only on your device to read the tracking number from the label. Images are processed on your iPhone and are not uploaded to us or anyone else.

e) Nothing else

We do not collect or ask for:

• an account, email address, phone number or name;
• your contacts;
• your location — the app does not track where you are;
• advertising identifiers;
• analytics or tracking SDKs — there are none in the app.

We do not sell your data and we do not share it with anyone for advertising.

4. Legal basis

Under the EU General Data Protection Regulation (GDPR) we rely on:

• Performance of the service you request (Art. 6(1)(b) GDPR) — for parcel information, the installation identifier and notification tokens, which we need to track your parcels and notify you;
• Our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR) — for technical server logs used to detect and prevent abuse.

5. Processors and recipients

We share data only with the parties needed to provide the service:

• 17TRACK (Hong Kong), a carrier-data aggregator, which receives tracking numbers only, in order to query carriers on our behalf, and processes them under its own terms;
• The carriers themselves, which receive the tracking number when their tracking data is queried and, only if a carrier asks for one, the destination postal code;
• Apple, which delivers push notifications and Live Activity updates to your device;
• Hetzner Online GmbH (Germany, EU), our hosting provider, on whose servers our database and logs are stored.

We do not give your data to anyone else unless we are legally required to.

6. International transfers

Our server is hosted in the EU. However, a parcel’s tracking data lives with the carriers that handle it, so depending on the parcel’s route, tracking numbers may be processed by carriers and by the aggregator outside the EU, including in countries that do not have an EU adequacy decision.

7. How long we keep data

• Parcels stay on our server while they are in your feed.
• When you delete a parcel, it is unlinked from your installation right away, together with the name and category you gave it. Its tracking number, events and any postal code are deleted from our server up to 6 months after the last device stops following it.
• After a parcel reaches its final status (for example delivered or returned), its tracking number and events are deleted up to 6 months after the final status.
• Your archive of delivered parcels is stored on your iPhone, not on our server, and stays there until you delete it.
• Server logs are kept for up to 30 days.
• The installation identifier and notification tokens are kept until you delete your install (see below) or write to us, or until the app has had no parcels on our server and has not contacted it for 6 months.

8. Deleting everything

You can remove all of your data from our server at any time in the app: Settings → Reset install. This deletes your installation, all of your parcels and your device tokens from our server. Tracking numbers that are no longer linked to anyone are deleted on the schedule in section 7, and server logs on their normal 30-day schedule.

Deleting the app from your iPhone stops it from contacting our server, but does not by itself remove your parcels from it — use “Reset install” first, or write to us.

9. Your rights

If the GDPR applies to you, you have the right to:

• access the personal data we hold about you;
• rectification of inaccurate data;
• erasure of your data;
• restriction of processing;
• data portability — to receive your data in a structured, machine-readable format;
• object to processing based on our legitimate interests;
• lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

To exercise any of these rights, email [email protected]. Because we do not know who you are, we may ask you for a tracking number from your feed so that we can find your data. We will reply within one month.

10. Children

Whereabox is not directed at children under 13, or under 16 in EU countries where that higher age applies. We do not knowingly collect personal data from children. If you believe a child has used the app and want their data removed, contact us and we will delete it.

11. Changes to this policy

We may update this policy when the app or the law changes. We will change the “Last updated” date above, and if a change is significant we will point it out clearly on this page.

12. Contact

Questions or requests about your data: [email protected].

Controller: Mark Moore (individual developer), 15100 6th Ave SW, Seattle, WA 98166, United States.