Privacy Policy
Last updated: June 25, 2026 · Version: Development Draft
1. Introduction
[Company Name] (“we,” “us,” or “our”) operates the Alpacalist application and website (collectively, the “Service”). This Privacy Policy explains what personal information we collect, how we use and share it, how long we retain it, and what rights you have with respect to it.
By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy.
Geographic Availability
The Service is currently available only to users located in the United States. Access from all other countries is restricted. We intend to expand availability as we build the appropriate compliance infrastructure for additional regions.
2. Information We Collect
2.1 Information You Provide Directly
Account information
- Email address (required to create an account, sign in, and receive transactional emails)
- First and last name (optional, used for profile display only)
- Password (stored as a cryptographic hash; never stored in plaintext)
App content
- Names and descriptions of packing trips and template lists you create
- Names and notes for individual packing items
- Trip departure and return dates you enter
Waitlist
- Email address submitted on our coming-soon waitlist page
2.2 Information Collected Automatically
Authentication session data
When you sign in, session tokens are stored in secure, HTTP-only cookies in your browser. The access token expires after one hour; the refresh token has a 60-day rolling expiry.
CAPTCHA and bot detection (Cloudflare Turnstile)
We use Cloudflare Turnstile in invisible mode on sign-in, sign-up, and password forms to prevent automated bot activity. Cloudflare may collect your IP address and browser interaction data. Use of Turnstile is subject to the Cloudflare Turnstile Privacy Addendum.
Infrastructure logs
Our hosting provider (Vercel) and database provider (Supabase) automatically collect server-side logs that may include IP addresses and request timestamps.
Browser local storage
We store one preference flag in your browser's local storage to remember whether you have dismissed the “Add to Home Screen” prompt. This data stays on your device and is never transmitted to our servers.
2.3 Information We Do Not Collect
We do not collect payment information, precise geolocation data, phone numbers, government-issued identification, or biometric data.
3. How We Use Your Information
| Purpose | Data used |
|---|---|
| Provide and operate the Service | Account information, app content |
| Authenticate you and maintain your session | Email, session tokens |
| Send transactional emails (confirmation, password reset, invitations) | Email address |
| Detect and prevent bots and unauthorized access | IP address, CAPTCHA tokens |
| Notify waitlist subscribers about launch | Waitlist email |
4. How We Share Your Information
4.1 Service Providers
We share personal information with the following companies that process data on our behalf:
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication, email delivery | Account data, app content, session tokens |
| Cloudflare | Bot detection (Turnstile CAPTCHA) | IP address, browser interaction data |
| Vercel | Application hosting | Request logs including IP addresses |
4.2 Legal Disclosures
We may disclose your information where required by applicable law, valid legal process, or to protect the rights, property, or safety of Alpacalist, our users, or the public.
4.3 Business Transfers
In connection with a merger, acquisition, or sale of company assets, your personal information may be transferred as part of that transaction. We will notify you of any such change.
4.4 No Sale of Personal Information
We do not sell your personal information to third parties.
5. Cookies and Similar Technologies
| Technology | Provider | Purpose | Required? |
|---|---|---|---|
| Authentication cookies | Supabase | Maintain your signed-in session | Yes — disabling breaks the Service |
| Local storage flag | Alpacalist | Remember install banner dismissal | No — clear browser storage to remove |
6. Data Retention
| Data | Retention |
|---|---|
| Account information (email, name) | Until you delete your account |
| Packing lists, templates, and items | Until you delete them or your account |
| Archived trips | Until you delete your account |
| Beta waitlist emails | [Retention period — to be defined] |
| Session cookies | Access token: 1 hour; Refresh token: 60 days of inactivity |
| Infrastructure logs | Per Supabase and Vercel policies |
When you delete your account, we permanently delete your profile, all packing lists, all templates, all packing items, and your authentication record from our database.
7. Your Privacy Rights
7.1 All Users
You may at any time:
- Access and review your account information and packing data through the app
- Correct your name or email address in account settings
- Delete your account and all associated data via Settings → Delete Account
7.2 California Residents (CCPA/CPRA)
California residents have the right to know what personal information we collect, request deletion, correct inaccurate information, opt out of the sale or sharing of personal information (we do not sell personal information), and be free from discrimination for exercising these rights.
7.3 International Users
The Service is not currently available outside the United States. If you believe we hold personal data about you, please contact us and we will promptly delete it.
7.4 Submitting a Request
To submit a privacy request, contact us at:
We will respond within 30 days, or as otherwise required by applicable law.
8. Children's Privacy
The Service is intended for users who are at least 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information without parental consent, please contact us and we will take steps to delete that information.
9. Security
We implement technical and organizational measures to protect your personal information, including encrypted data transmission (HTTPS/TLS), cryptographic password hashing, per-user database access controls (row-level security), and CAPTCHA verification on authentication forms. No system is completely secure, and we cannot guarantee absolute security of your information.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes before they take effect. Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.
11. Contact Us
For questions or concerns about this Privacy Policy or our data practices:
[Company Name]
Email: [PRIVACY CONTACT EMAIL]
Address: [COMPANY ADDRESS]