Privacy policy

Last updated: 2026-11-07

Draft text, not yet reviewed. It may change before it is final.

Some features described here, such as accounts, reminders, AI tailoring, sharing and statistics, are not live yet. The text describes how they will work when they launch.

Who is responsible

pakkeliste.com is run by Mahope (CVR 39413892), trading as Mahoje. Mahope is the data controller for the personal data described on this page.

The short version: you can build and keep packing lists without an account, and your lists stay on your own device unless you choose to sign in or share one.

What we collect

Lists on your device. By default your lists are stored in your own browser. We do not receive them.
Account. If you create an account, we store your email address and the lists you save to it. You sign in with a magic link sent to your email, or with a passkey. For a passkey we store only the public key and an identifier; nothing biometric leaves your device.
Reminders. If you ask for a reminder before a trip, we store your email address, the departure date and the list the reminder is about.
AI tailoring. If you ask for a list to be tailored, we send abstract needs only, such as a destination, month, trip length, trip type, number of travellers and general needs like "prescription medication" or "child aged 2".
Shared lists. If you share a list, we store the link token in hashed form and the list itself.
Statistics. We count page views and a few events, such as "list printed". The tools we use are cookie-free and build no profile of you.
Affiliate clicks. When you click a recommended product we count the click per product and day. The count contains no personal data.
Technical data. Like every website, our hosting and Cloudflare handle your IP address and request data to deliver pages and protect against abuse.

What is never sent to AI

Names, medicine names, free text about health, email addresses and account details are never sent to an AI provider. Only the abstract needs described above are sent. We do not keep personal data in the AI answer cache or in logs.

Why we use the data

To show you a packing list and let you edit, save, print and share it.
To let you sign in, keep lists in sync between your devices and move a local list into your account.
To send the reminder you asked for.
To tailor a list with AI when you ask for it.
To understand which pages and features are used, so we can improve the site.
To count affiliate clicks, so we can see which recommendations are useful and settle with our partners.
To keep the service secure and available.

Legal basis

Account, sign-in, saved lists, shared lists and AI tailoring that you request: performance of a contract with you (GDPR Article 6(1)(b)).
Reminder emails: your consent (Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every reminder.
Cookie-free statistics, affiliate click counts and security: our legitimate interest in running and improving a safe service (Article 6(1)(f)). These do not involve profiling or personal data beyond what is needed.

Private lists and sharing

A list is private by default. It is shared only if you choose to, and then through a link with a long random token that is hard to guess. Anyone who has the link can see the list, so send it only to people you trust.

A shared list contains only the list itself: items, quantities and categories. It does not show your email, your account, travellers' names or ages, or notes about health. Do not type personal details into item names, because those are part of the list.

Shared lists are never in our sitemap and tell search engines not to index them.

Who helps us process data

We use the following providers. They handle data only to provide their service to us.

Hosting: Hetzner, where our servers run.
Traffic delivery and protection: Cloudflare, which sits in front of the site.
AI tailoring: the AI provider we use for the feature, which receives only the abstract needs described above.
Email: our own mail server. We use no third-party marketing or newsletter service.
Statistics: Plausible and Umami, both cookie-free.
Affiliate partners: when you click a recommended product you leave our site, and the partner's own privacy policy applies there.

How long we keep data

Lists on your device stay until you delete them or clear your browser data.
Your account and the lists saved to it stay until you delete your account.
A reminder is kept until it has been sent or you cancel it.
AI answers are cached for 30 days, keyed by the abstract needs and containing no personal data.
Statistics and affiliate click counts are totals without personal data.
Deleted data can remain in daily backups until the backup is overwritten.

Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict its use, to receive it in a portable format, and to object to processing based on our legitimate interest. You can withdraw consent at any time.

You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the data protection authority in the country where you live.

Cookies and local storage

If you do not sign in, the site sets no cookies. If you sign in, it sets one strictly necessary session cookie that keeps you signed in. It is not used for tracking or advertising, so no cookie banner is needed.

Your lists and settings are stored in your browser's own storage on your device. That is not sent to us. Statistics are cookie-free. If you click through to an affiliate partner, that partner may set its own cookies on its own site.

Contact

Questions, requests about your data or complaints: write to mads@mahoje.dk. Mahope, CVR 39413892.

Changes

When the service changes in a way that affects your data, we update this page and the date at the top. For larger changes we tell account holders by email.