Last updated November 7, 2026.
Paloma shows no ads and runs no analytics. Nothing described here is used to track you across other companies' apps or sites. Data leaves the device for two reasons: the account it belongs to lives on Paloma's server, and the app is a client of it; and when something breaks, a crash report goes out so we can fix it.
What we collect
- Apple account identifiers. Apple's stable user id for this app, and — only on the first authorization — the email and name Apple lets us see. You can hide the address behind Apple's relay.
- Parcels you add. Tracking numbers, the names you give them, scan history, the origin and destination those scans report (which can include a postal code), shipment details such as service and weight, and predicted dates. We have to send the number to a tracking service or the carrier to track the shipment. A few carriers also require the destination postal code, which we ask you for and send with the number.
- Forwarded shipping mail. If you point an inbound alias at us, we parse the message for tracking numbers and then keep only what the parcel record needs. The message body is never stored.
- Opt-in Gmail inbox scanning. If you connect Gmail, Paloma requests read-only Gmail access (
gmail.readonly). On the first scan it reads recent shipping-oriented messages; from then on it reads each new message that arrives in the inbox — headers and body — to look for tracking numbers. It keeps only what the parcel record needs and discards the rest. It does not store messages, and it does not send or modify mail. You can disconnect Gmail at any time in Settings. - Device tokens. An APNs token, so we can tell this phone that a parcel moved. It is stored as an address, not as a credential.
- Purchases. If you subscribe, RevenueCat tells us whether Paloma Pro is active. We do not store your payment card.
- Diagnostics you send. Optional crash and hang summaries from MetricKit, posted while you are signed in, so we can fix the build. They are logged and discarded, not used for advertising.
- Crash reports. When the app crashes or hits an error, a report goes to Sentry, our error-tracking provider: the stack trace, the app and iOS version, the device model, and the steps leading up to it. It does not include your account, screenshots, or a recording of the screen, and tracking numbers, email addresses and sign-in tokens are removed on your phone before it is sent.
What we do not collect
We do not sell data. We do not run a third-party analytics or advertising SDK; the one third-party SDK in the app, Sentry, reports crashes. Camera frames used to read a label never leave the phone. Gmail access, when you opt in, is read-only: Paloma reads each new message to find shipping information and keeps only that — not a copy of your inbox.
Who else sees it
17TRACK, the tracking service Paloma uses, receives the tracking number, the carrier when we know it, and, for the few carriers that require one, the destination postal code you entered. It is not sent your name, your email, or your Paloma account id. It sends back the scan history and shipment details such as origin, destination, service, and estimated delivery date. Carriers we ask directly, currently UPS and DHL, receive only the tracking number. Apple sees Sign in with Apple and push traffic. Google sees the OAuth consent and API calls when you connect Gmail. RevenueCat sees the Paloma user id we identify as, so a purchase and its webhook name the same account. Apple Maps receives the city, region, and postal code at each end of a parcel's journey, so we can place them on a map and measure how far the parcel traveled. Apple Weather receives the map coordinates of a destination when a parcel is arriving soon, so we can show the forecast for delivery day. No account identifier goes with either. Sentry receives crash and error reports from the app and the server, with the details above removed, and processes them only so we can fix them. Hosting is Fly.io in the United States.
How long we keep it
- Parcels and their tracking history, including delivered and archived ones: until you delete the parcel or your account. They are never removed on a timer.
- Your account — Apple identifiers, the email and name Apple shared, your forwarding alias, and subscription status: until you delete your account. You can ask for a new forwarding address from Settings at any time; the old one stops working at once.
- Sign-in sessions: each one expires 90 days after it was last used, and in any case 365 days after sign-in, and is then deleted. Settings → Sign Out Everywhere ends every session on every device at once.
- Emails we read, forwarded, shared, or found in Gmail: the body is never stored. The Message-ID, sender, and subject of each one are kept for 30 days so the same email is not turned into a parcel twice, then deleted. What the parcel record took from the email — the tracking number, the item or retailer name, and the dates — stays with the parcel.
- Gmail connection: until you disconnect Gmail or delete your account.
- Device tokens: until Apple reports the token is no longer valid, the app unregisters it, or you delete your account.
- Live Activity tokens: deleted when the activity ends, and in any case 7 days after the app last registered them.
- Diagnostics you send: never written to Paloma's database. Each one is a single line in the server log, which is not archived.
- Crash reports: never written to Paloma's database. Sentry keeps them under its own retention so we can fix the build, and they are not tied to your account.
- IP addresses, used only to rate-limit requests: at most 1 day.
Deletion
Settings → Delete Account removes the account row and everything on it — parcels, devices, sessions, the forwarding alias, any Gmail connection (and a revoke of the Google refresh token), and the Apple refresh token we keep solely to revoke Sign in with Apple, which Apple requires of an app that offers deletion. We also ask 17TRACK to stop tracking a deleted parcel's number, unless another Paloma parcel still uses it.
Contact
Privacy questions: hello@glaslabs.io.