Privacy Policy, made clear.

Your personal data is a responsibility we take seriously, never a product we sell. This Privacy Policy explains what information Pack N' Zoom collects, why we collect it, and the rights you have over it.

Effective: April 16, 2026
Updated: April 16, 2026

We do not sell your data.

Without exception. Your personal information is never sold, rented, or traded to third parties.

No third-party trackers.

We use only first-party cookies that keep you signed in and allow the Service to function properly.

Encrypted by default.

Data is protected with TLS 1.2+ in transit, encryption at rest for sensitive information, and modern password hashing.

Pack N' Zoom is owned and operated by Ideas Bucket LLC ("Ideas Bucket," "we," "us," or "our"). Protecting your privacy is a core principle of how we build and operate the Pack N' Zoom travel planning platform (the "Service"). This Privacy Policy explains what personal data we collect, how and why we use it, how we protect it, and the rights and choices available to you.

This Privacy Policy is designed to comply with the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable data protection laws. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

§ 01

Data Controller & Contact Details

Ideas Bucket LLC, the owner and operator of Pack N' Zoom, is the "data controller" of your personal data. This means Ideas Bucket LLC determines the purposes and means of processing your personal data.

Data Controller
Entity: Ideas Bucket LLC, owner and operator of Pack N' Zoom
Data Protection Officer

Contact our Data Protection Officer regarding any matter relating to this Policy.

§ 02

About Pack N' Zoom

Pack N' Zoom is an online travel planning platform owned and operated by Ideas Bucket LLC. It is designed to make organizing travel simple and efficient, whether you are planning a weekend getaway or coordinating a multi-city vacation, by bringing every detail of your trip together in one place.

The Service allows you to plan trips, share itineraries with friends, family, and travel companions, and ask questions about destinations, logistics, and travel tips. Its built-in community and Q&A features connect you with fellow travelers who can share first-hand experience.

§ 03

Personal Data We Collect

We collect only the personal data necessary to provide, improve, and secure the Service. The categories of data we collect are described below.

3.1

Data You Provide Directly

Account Data: name, email, username, hashed password, profile photo, and optional profile details.
Trip & Planning Data: destinations, dates, itineraries, packing lists, notes, budgets, travel preferences, and any content you create.
User-Generated Content: Posts, Trips, comments, community questions and answers, reviews, and any other content you publish.
Communications Data: messages you send to us (support, feedback) and messages you send to other users through the Service.
Survey & Feedback Responses: information you voluntarily share in surveys, beta tests, or feedback forms.
3.2

Data We Collect Automatically

Usage Data: pages visited, features used, time spent on the Service, referring URLs, and interactions with content.
Device & Technical Data: device type, operating system, browser type, and language settings.
Server Logs: IP addresses logged for limited security and operational purposes only — never for analytics, advertising, or profiling.
First-Party Cookies: our own cookies and local storage to keep you signed in, remember preferences, and understand Service usage. No third-party trackers.
3.3

Data From Third Parties

Affiliate & Booking Partners: referral identifiers and booking completion signals — not your booking details, which stay with the partner.
SSO Providers (Google & Facebook): basic profile information you authorize. See Section 3.5 for a full description of the data we receive and the data we do not request.
Special Categories of Data

We do not intentionally collect special categories of data (racial or ethnic origin, political opinions, religious beliefs, health data, sexual orientation). Please do not include such information in content you create or share on the Service.

§ 03.5

Sign In With Google & Facebook

We offer Sign in with Google and Sign in with Facebook as convenient alternatives to password-based accounts. When you choose to sign in this way, we receive only the basic profile information you authorize, and we use it solely to authenticate you and create or access your Pack N' Zoom account.

Sign in with Google
What we receive
  • Your name (as set on Google)
  • Your email address
  • Your Google account ID
  • Your profile picture (if set)
We never access
Gmail, Calendar, Drive, Photos, contacts, or location history. Our use of Google API data complies with the Google API Services User Data Policy, including Limited Use.
Sign in with Facebook
What we receive
  • Your name (as set on Facebook)
  • Your Facebook account ID
  • Your profile picture (if set)
  • Email address (only with your permission)
We never access
Friends list, posts, photos, messages, pages you follow, or your activity. We do not post on your behalf or use Facebook data for advertising or profiling.
We use this information only to:
1
Authenticate you when you sign in
2
Create or link your Pack N' Zoom account
3
Contact you about essential account matters
Your control over connected accounts

You may disconnect Google or Facebook from your Pack N' Zoom account at any time through your account settings. You may also revoke our access directly through your Google or Facebook security settings.

Lawful basis for processing this data: performance of a contract.

§ 05

User-Generated Content

The Pack N' Zoom community is built on shared travel knowledge. Every Trip you create is assigned one of four visibility settings, and you control which setting applies: Private, where only you as the author can see and modify the Trip; Restricted link access, where only people holding the link can see it; Limited user access, where only the users you select can see it; and Public, where anyone on the internet can view it.

Because visibility determines who may already have viewed your content, it also determines how we handle deletion. Please review the following carefully.

Public Posts

Upon deletion, may be reassigned to an anonymous user where the Post has received community engagement.

Public Trips

Visible to anyone on the internet. This setting is permanent. Upon deletion, may be reassigned to an anonymous user where the Trip has received community engagement.

Private Trips

Visible only to you. Inaccessible immediately on deletion; fully removed from active systems within 30 days.

Restricted-Link Trips

Visible only to people holding the link. Inaccessible immediately on deletion; fully removed from active systems within 30 days.

Limited-Access Trips

Visible only to the users you select. Inaccessible immediately on deletion; fully removed from active systems within 30 days.

Comments & Answers

Follow the treatment of their parent content: anonymized on Public content and deleted with non-public content.

Public Content

When Public content is deleted, we may reassign it to an anonymous user to preserve community knowledge. Your name, username, and profile photo are removed; the content is attributed to a generic identifier with no link to you.

Right to Erasure Interaction

Once content is fully anonymized and can no longer be linked to you, it ceases to be "personal data" and falls outside the scope of erasure. You always retain the right to request erasure of data that remains identifiable.

Private, Restricted-Link, and Limited-Access Trips

Deleted Trips set to Private, Restricted link access, or Limited user access become inaccessible immediately and are permanently deleted from active servers within 30 days. Residual copies in encrypted backups are overwritten on a rolling schedule within 90 days. Revoking a link or removing a selected user takes effect immediately, though we cannot recall copies that someone may have saved while they still had access.

Setting a Trip to Public is permanent

Public Trips help fellow travelers plan with confidence, and because others may come to rely on them, this setting cannot be reversed. A Public Trip cannot later be changed to Private, Restricted link access, or Limited user access. We strongly recommend reviewing your itinerary, notes, and any personal details before publishing. You may still edit or delete a Public Trip at any time, and deletion is handled as described above.

§ 06

How We Share Personal Data

Our Commitment

We do not sell, rent, or trade your personally identifiable information to third parties.

All marketing is conducted in-house, and your personal data is never used as a source of revenue.

We disclose personal data only in the following limited circumstances:

With Other Users
Content you choose to make Public (Posts, Public Trips, comments) is visible to anyone on the internet. A Restricted-link Trip is visible only to people holding the link, a Limited-access Trip only to the users you select, and a Private Trip only to you.
With Processors
A limited number of trusted service providers (such as cloud hosting, email, and customer support tools), each bound by a written data processing agreement.
With Affiliate Partners
When you follow an affiliate link, you leave the Service, and the partner's privacy policy governs any booking you make.
For Legal & Safety Reasons
Where required by law or legal process, or where necessary to protect the rights, property, or safety of Ideas Bucket LLC, our users, or others.
Business Transactions
In connection with a merger, acquisition, reorganization, or sale of assets involving Ideas Bucket LLC, subject to the protections of this Policy.
§ 07

International Data Transfers

Pack N' Zoom is operated by Ideas Bucket LLC from the United States. When personal data is transferred across borders, we rely on the following safeguards:

Supplementary Measures
Encryption and pseudonymization, applied where necessary.
§ 08

How Pack N' Zoom Generates Revenue

How a company generates revenue says a great deal about how it treats your data. Our business model is outlined below:

Primarily through affiliate commissions.

When you discover hotels, flights, or activities on Pack N' Zoom and book through our partner links, Ideas Bucket LLC may receive a referral commission at no additional cost to you. All bookings are completed on partner websites; we do not process reservations.

We may
Display non-targeted advertising
With consent
Send curated travel emails
We never
Sell personal data or use cross-site cookies
§ 09

Your Privacy Rights

Depending on where you are located, you may have the following rights under applicable data protection laws.

Right of Access

Request confirmation of processing and receive a copy of your data.

Right to Rectification

Request correction of inaccurate or incomplete personal data.

Right to Erasure

Request deletion of your personal data, subject to public content rules.

Right to Restriction

Request that we restrict processing of your data in certain circumstances.

Right to Data Portability

Receive your data in a structured, machine-readable format.

Right to Object

Object to processing based on legitimate interests or direct marketing.

Right to Withdraw Consent

Withdraw consent at any time without affecting prior processing.

Rights Regarding Automated Decisions

Not be subject to decisions based solely on automated processing.

Right to Lodge a Complaint

File a complaint with your supervisory authority.

How to exercise your rights

To exercise any of these rights, email privacy@packnzoom.com. We will respond within one month of receipt, which may be extended by up to two additional months for complex requests. No fee is charged unless a request is manifestly unfounded or excessive.

Submit a data request
§ 10

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

01Account information
Life of account + 30 days after closure
02Private, Restricted & Limited Trips
Deleted within 30 days of removal
03Public Posts and Trips
Retained indefinitely in anonymized form
04Server logs & IP addresses
Up to 90 days
05Marketing consent records
Up to 3 years after withdrawal
06Support communications
Up to 3 years post-resolution
07Encrypted backups
Up to 90 days on a rolling basis
08Legal & financial records
6–10 years, as required by law
§ 11

Data Security

We implement technical and organizational measures appropriate to the level of risk, including:

TLS 1.2+ encryption in transit
Encryption at rest for sensitive data
Role-based access controls
Regular penetration testing and vulnerability management
Password hashing with bcrypt or Argon2
Data protection training for personnel
Documented incident response plan
Breach notification within 72 hours
§ 12

Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal data from children below the applicable minimum age.

United States
13years

Under COPPA.

§ 13

Automated Decision-Making & Profiling

Pack N' Zoom does not make decisions based solely on automated processing — including profiling — that produce legal effects or similarly significantly affect you. If this ever changes, we will update this Policy and, where required, obtain your explicit consent.

§ 14

Cookie Policy

This Cookie Policy forms part of our Privacy Policy. We use only a minimal set of strictly necessary cookies and do not use any third-party tracking, advertising, or cross-site analytics cookies. Because every cookie we set is strictly necessary, we do not display a cookie consent banner.

14.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help sites work efficiently and provide information to site owners. Similar technologies — local storage, session storage, pixels — are covered by this policy the same way.

14.2 Strictly Necessary Cookies Only

Every cookie we use is strictly necessary.
No consent banner is required for strictly necessary cookies.
No Banner

Strictly necessary cookies are either essential for the Service to function, or they are set only when you explicitly request a feature (for example, choosing a language or enabling "Keep me signed in").

Authentication & Security
Session Cookies
Keep you logged in as you move between pages. Expire when you close your browser or log out.
Authentication Cookies
Identify you as a signed-in user and maintain your authenticated session securely. Typically expire after 30 days of inactivity or when you log out.
"Remember Me" Cookie
Set only when you actively choose the "Keep me signed in" option at login. Keeps you signed in across browser sessions on the device you have explicitly trusted. Retained for up to 30 days after your last use, or until you log out.
CSRF Protection Tokens
Protect against Cross-Site Request Forgery attacks by verifying that form submissions and state-changing actions come from you. Session duration only.
Security Cookies
Detect suspicious activity, prevent fraud, and protect your account (for example, flagging logins from unrecognized devices). Retained for up to 90 days.
Load Balancing Cookies
Ensure your requests are routed consistently to the same server during a session for reliable performance. Session duration only.
User-Selected Preferences

Set only when you actively make a choice. Treated as strictly necessary because they exist solely to deliver a feature you have explicitly requested.

Language Preference
Set when you choose a language other than the default. Remembers your selection so you do not have to reset it on every visit. Retained for up to 12 months.
Display Preference (Dark / Light Mode)
Set when you toggle the color theme. Remembers your choice so the Service looks the way you prefer. Retained for up to 12 months.
Interface Preferences
Set when you adjust small personalization options such as map view preferences or sort order in your trip list. Retained for up to 12 months.

14.3 What We Do Not Use

Our approach to cookies differs meaningfully from that of many online platforms. We do not use:

  • Third-party advertising or retargeting cookies
  • Third-party cross-site analytics (Google Analytics cross-site, Meta Pixel, etc.)
  • Data broker or audience-matching cookies
  • Cross-device or cross-context behavioral tracking
  • Browser fingerprinting for tracking or profiling

Because we use only strictly necessary cookies, we do not display a cookie consent banner. If we ever introduce non-essential cookies, we will update this Cookie Policy and present a consent banner to users in jurisdictions that require one before any such cookies are loaded.

14.4 Your Cookie Choices

You may control cookies, including strictly necessary cookies, in the following ways:

1
Browser Controls
Block or delete cookies via your browser settings. Blocking strictly necessary cookies will prevent the Service from working — for example, you will not be able to stay signed in.
2
Reset Preferences
Reset language, theme, and other interface preferences at any time from your account settings.
3
Sign Out
Signing out of the Service clears your authentication and "Remember Me" cookies.
4
Global Privacy Control (GPC)
We honor browser-based Global Privacy Control signals. Because we do not use any cookies subject to GPC opt-out, this does not change our cookie usage; however, the signal is honored as a request to opt out of any sale or sharing of personal information.

14.5 Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. Because there is no industry standard for interpreting DNT, and because we do not use tracking cookies in any case, our response to DNT is straightforward: we do not track users across the internet regardless of your DNT setting.

14.6 Changes to This Cookie Policy

If we ever introduce new categories of cookies that are not strictly necessary (for example, first-party analytics or any third-party services), we will update this Cookie Policy, deploy a cookie consent banner where required by law, and notify users of the change per Section 16.

§ 15

California & US State Rights

Residents of California, Colorado, Connecticut, Virginia, Utah, or other states with comprehensive privacy laws may have rights similar to those described in Section 9, including the right to know, delete, and correct personal information, to opt out of its sale or sharing, and to non-discrimination.

CCPA/CPRA Compliant

Ideas Bucket LLC does not "sell" personal information and does not "share" it for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA.

§ 16

Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or the Service itself. For material changes, we will notify you by email, through the Service, or by other reasonable means before they take effect. The "Updated" date at the top of this page reflects the most recent revision.

§ 17

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or the privacy practices of Ideas Bucket LLC, please contact us using the details below.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority — see Section 9.

Thank you for trusting Pack N' Zoom with your travel plans. Ideas Bucket LLC takes that trust seriously and is committed to protecting your privacy at every step of the journey.