Privacy
Last updated
Porchlight tracks your packages. To do that, its server keeps your tracking numbers and what the carriers say about them. Your Amazon password and cookies stay on your own device, and so does the text of your email. There are no ads, and nothing is sold.
What the server stores
- Your account
- Your email address, or the account id and email address Apple shares when you use Sign in with Apple.
- Sign-ins
- For each signed-in device, a session token (stored only as a hash), when it was created and when it was last used.
- Devices
- The platform (Mac or iPhone), the app version, and the token Apple gives the app for notifications.
- Packages
- Carrier, tracking number, the title you give it, merchant, order number, where it came from (added by hand, Amazon, Flint or the share sheet), its status and the carrier's latest wording, delivery dates, and when it was last checked.
- Scan history
- Each event the carrier reports, with its time, description and location.
- Amazon items
- The name and quantity of each item in an order, and the link to its picture on Amazon's servers.
- Import records
- The Flint message id or the Amazon order and shipment id behind each imported package, so the same email or order is never added twice.
- Flint connections
- A label such as "Flint on MacBook Pro", when it was paired and when it was last used. The token Flint holds is stored only as a hash.
What stays on your devices
- Amazon
- You sign in to Amazon inside the Mac or iPhone app, on Amazon's own page. The cookies from that sign-in are kept in a separate store on that device. They are never sent to the Porchlight server and never synced to your other devices. The app reads your orders the way you would in a browser and sends Porchlight only the order and shipment numbers, the items, the delivery date, the carrier, the tracking number and, for Amazon Logistics packages, the tracking events.
- Flint
- When Flint finds a shipping email, it sends the carrier, the tracking number, the sender's name, the subject line and the date. Flint also does this once for the last 30 days of mail when you pair it. The body of the email never leaves your Mac.
Who else receives your data
- Carriers and a tracking service
- To check a package, the server sends its tracking number to the carrier (USPS, UPS, FedEx or DHL) or to a third-party tracking service that covers other carriers. Nothing else about you goes with it. Amazon Logistics numbers are not sent to the tracking service.
- Resend
- Sends sign-in email. It receives your email address and the message, which holds a sign-in link and a 6-digit code.
- Apple
- Sign in with Apple tells Porchlight your Apple account id and email address. Notifications go through Apple's push service, which receives your device's notification token and the text of the notification: the package title and its new status.
- Cloudflare
- Runs the Porchlight server and database.
The Porchlight server never contacts Amazon. The web app doesn't show Amazon item pictures, so viewing your packages there sends nothing to Amazon.
Analytics
This website counts page views with a small first-party counter. It sends the page address without any query string and the page you came from. The server adds your country and the type of browser and device. To tell visits apart, it keeps a one-way hash of your IP address and browser mixed with a value that is replaced every day and then deleted. Your IP address itself is not stored, and nothing is saved in your browser.
The Mac and iPhone apps don't collect analytics unless they ask you first.
Security
Session and Flint tokens are stored as SHA-256 hashes. Every query on the server is limited to your own account. Carrier and service keys are kept as server secrets, and all traffic uses HTTPS.
Keeping and deleting
Your data is kept while you have an account.
When you delete a package, its scan history and items are removed right away. A small record with the carrier, tracking number, title and merchant stays so your other devices learn that it was deleted. It is removed when you delete your account.
Signing out of a device removes its notification token.
To delete your account, open Settings and choose Delete account. Every record that belongs to you is removed right away. Cloudflare keeps a point-in-time recovery history of the database for up to 30 days, after which the deleted data is gone from that too.
Changes
If this policy changes, the date at the top changes with it.