Privacy policy

The short version

• Nothing optional is loaded or stored until you affirmatively allow it. Refusing is one click and costs you nothing.
• We never store your IP address, never use fingerprinting, and never record what you type or where you move your mouse.
• There is no advertising, no marketing profile, no cross-site tracking, and no sale or sharing of personal information with anyone.
• The measurement identifiers are random values your own browser generates. They are meaningless anywhere else, and they are deleted from your browser the moment you withdraw consent.
• Location is country-level only, and only because the hosting network adds a two-letter country code to the request. Precise location is switched off at the browser-policy level.
• Optional analytics is currently switched off entirely on this deployment — nobody is being measured at the moment.

Who is responsible for this data

Pckup is the public brand of this site, which is operated as an independent product and runs on the network of its operational delivery partner, Senpex. Pckup does not share the data described here with Senpex or with anyone else for their own purposes.

What we collect, and what we refuse to collect

The complete, itemized list — every value, its purpose, the consent category that gates it, and its retention period — is in the cookie and analytics notice. It is generated from the running code rather than written by hand, so the two cannot drift apart.

In summary, when you allow analytics we record which pages were visited and in what order, how long a page was actually visible and focused, whether a browser is new or returning, a coarse device category, and a two-letter country code — all tied to random identifiers, never to you.

We do not collect your IP address, precise location, query strings, names, email addresses, phone numbers, postal addresses, payment details, form contents, keystrokes, mouse movement, session replay, device fingerprints, full user-agent strings, or any cross-site identifier. Those are enforced prohibitions with tests behind them, not aspirations.

About IP addresses, and the “returning visitor” question

Any web server necessarily sees the IP address of a request in order to reply to it. Pckup never writes yours down. For the fraction of a second it is in memory, it is combined with the current calendar week and a secret key that lives only on the server to produce a one-way value, and then it is discarded. That value is what gets stored.

Because the week and the key both change, the value cannot be linked back to an address or followed from one week to the next, and it never appears anywhere in the administrator interface. It is kept for 14 days.

We are careful about what this can and cannot tell us. It shows that two visits came from the same network in the same week. A network is not a person: offices, households, schools, cafés, VPNs, and mobile carriers all put many people behind one address, and one person moving between home, work, and a phone looks like several networks. So Pckup describes this as a repeat network signal and nothing more. We will not present it as evidence that a particular person came back.

Why we are allowed to do this

Strictly necessary items — your privacy choice, the consent record, your theme preference, and the administrator login session — exist because the site cannot work or honour your choices without them. Storing your refusal is what proves optional processing stayed off.

Everything optional runs on your consent, which we ask for before anything happens, record with a version, and let you withdraw as easily as you gave it. Where consent is the basis, you can withdraw at any time without giving a reason and without losing access to anything.

We do not rely on “legitimate interests” to switch measurement on without asking, and we do not treat continued browsing as agreement.

How long anything is kept

• Session and event records: 30 days.
• Daily aggregate counts: 30 days.
• The rotating network signal: 14 days.
• Consent records: 400 days. These are kept longest on purpose — they are the accountability trail for choices, and they contain no identifiers.
• Your own consent cookie: 182 days, or until you change it, or sooner if the disclosure materially changes.

Retention is enforced by the storage layer itself: every record is written with an expiry, so nothing survives its period through neglect.

Who else is involved

No third party receives this data for its own purposes, and no data is sold, rented, or shared for advertising. The only other parties involved are the infrastructure that runs the site:

• Vercel — hosting and content delivery. It processes requests in order to serve pages, and it is what supplies the two-letter country code.
• A managed key-value store (Upstash or Vercel KV) — where the aggregate counts and consent records are kept, in a storage area isolated from everything else the site stores.

The home-page background video is a Pckup-owned asset served from this site’s own origin — no third-party media host is contacted to display it.

Because the site is reachable worldwide, data may be processed in countries other than your own by these providers as part of hosting.

Who can see the results

The measurement dashboards are administrator-only and behind a server-enforced login; there is no public visitor dashboard. What an administrator sees is aggregate counts — sessions, page views, engaged time, entry and exit pages, referring hosts, device categories, countries. The random identifiers and the network value are never shown, exported, or logged.

How to reach us, and how to exercise your rights

You can change or withdraw your privacy choices yourself at any time, with no request and no waiting: use Privacy and cookie settings at the bottom of every page. Withdrawing stops collection immediately and deletes the random identifiers from your browser.

For anything else — a question, a complaint, or a request to access or delete data — these are the channels this site currently offers:

• The business enquiry form on the delivery API page, which reaches the Pckup team.
• If you have a Pckup account, the support form in your dashboard.

A dedicated privacy mailbox is not published yet. Because the analytics described here is deliberately built so that no record can be traced to a person, there is in practice nothing person-specific for us to look up, export, or delete on request — the identifiers are random, the network value is one-way and rotating, and your IP address is never stored. The one record you control directly is your own consent choice, and the settings link above deletes it.

Children

Pckup is a service for businesses and for people who work as couriers. It is not directed at children, and nothing described here profiles anyone or attempts to infer age.

Changes to this notice

Changes are published with the code that causes them, and every release is listed in the site’s public changelog. If a change materially alters what we disclose, the policy version is raised and you will be asked again — an old answer to a different question is not consent.