PackMule Mobile Privacy

About This Beta

PackMule TMS, based in South Carolina, United States, operates the PackMule Owner Operator mobile app for iPhone and Android and its hosted beta service. The marketing website has a separate notice. Contact PackMule TMS at [email protected] with privacy questions. Use only records you are authorized to provide and keep independent copies of important originals during beta testing.

Accounts and Company Records

PackMule stores account identifiers, usernames, names, optional email addresses, password hashes, company memberships, truck assignments and access permissions. It also stores the business information you save, such as trucks, brokers, loads, expenses, fuel and odometer entries, maintenance, invoices and chosen attachments. This information supports sign-in, your company workspace, calculations, documents, security and recovery. Passwords and session tokens are not included in routine feedback or crash reports.

App Activity

Supported app versions send PackMule the time of an app launch or return after at least 30 minutes in the background. These records are linked to the signed-in account, company and owner or driver role. PackMule separately records successful app and website sign-ins. The private administration dashboard uses this information for app-open totals, recent active users and companies, and usage trends during beta testing and service operation. Short app switches and automatic session checks do not add opens. These activity records do not include documents, screen contents, passwords or precise location. Pending app-open records can remain in private phone storage while offline. Only the last 30 days can be delivered to the selected PackMule hosted beta; older pending records are discarded when activity tracking next runs. Retry references older than 31 days are removed during server activity processing; daily activity totals and sign-in times remain with the account until applicable account or company deletion. The app also sends its foreground or background state about every 30 seconds while connected, using a temporary connection reference tied to the signed-in session. PackMule uses the latest state for private owner, driver and total online counts; the dashboard refreshes about every 15 seconds. Connections without a recent update expire from online counts after 75 seconds. Background trips, offline phones and website visits do not mean someone is online in the app. Presence updates are not queued for later delivery or stored as a heartbeat history. Old connection states are removed during presence processing after 10 minutes without an update, and are removed with the applicable account or company deletion. This activity tracking is separate from optional crash reports.

Company Access

Company owners manage dedicated driver logins, assigned trucks and permissions. Owners control each driver’s displayed ranking name and permission to view rankings; viewing permission is separate from ranking participation. PackMule administration and service providers process information as needed to operate, support, secure and recover the service. Company documents are not published to other participating companies through rankings.

Monthly Driver Rankings

Beta participation includes monthly individual-driver rankings for Revenue, Miles, revenue per mile (RPM) and profit per mile (PPM), calculated from completed loads, recorded mileage and allocated costs. Participation is required during beta, even if an owner does not permit a driver to view rankings. Permitted viewers in other participating companies can see leading drivers’ displayed names, metric values and ranks. Automatic names use the format User 0001. These are pseudonyms, not a guarantee of anonymity; an identifying name can reveal who you are. Total participant counts are not displayed. Owners select only their own company’s drivers; permitted drivers see their own ranking view and the shared leaders.

Documents and Cloud Reading

You choose rate confirmations through Camera, Photos or Files. Before the first cloud read, the app asks for permission for the selected account and PackMule server and remembers it on that phone. Selected rate confirmations are uploaded to PackMule’s hosted DigitalOcean backend. PackMule renders the pages and sends page images to OpenAI for reading; extracted document text is not sent. Images can include personal or business information visible on the pages. Review and correct the returned draft before choosing Save. Reading alone does not create a company load or save its attachment. You can use manual entry instead. Sharing or saving a document through your phone’s share sheet sends it to the destination you choose.

Temporary Reading Files and Usage Limits

Temporary upload and rendered-page files on PackMule’s server are cleaned up after processing. Server-side unsaved extracted drafts expire after 15 minutes. When you choose Save, the approved company record and any attachment you choose to keep follow the company storage and deletion policies below. PackMule keeps a pseudonymous per-login usage identifier and current-month API-usage total to enforce reader limits, plus an aggregate test budget. These counters do not contain document contents. If a reader limit is reached, manual entry remains available. Updated app versions require internet access for cloud reading and do not download or require the previous 2.5 GB reader model or reader-training feature.

OpenAI Processing and Retention

PackMule sends the reading request with response storage disabled, without tools or a model-training feature. OpenAI’s separate API retention and safety rules still apply. API content may be retained for safety and abuse monitoring, generally for up to 30 days, with exceptions that can require longer retention. PackMule’s temporary-file cleanup does not erase provider-held copies. OpenAI API data controls

GPS and Odometer Information

GPS recording starts only when you explicitly start a trip or location test. With your permission, an active trip can collect precise location, observation times and accuracy while PackMule is in the background or the screen is locked. Operational trip observations and the odometer readings you confirm are stored on the phone and synchronized to your company’s hosted records. Use Pause or End to stop active collection. Your iPhone or Android permission settings also control location access. Recovery after an interruption is best-effort and does not recreate missing observations.

Feedback and Optional Crash Reports

Feedback you submit includes your message and account, company, device, build, screen and time information. It goes through the PackMule backend and Resend to PackMule’s support mailbox. Documents, precise GPS samples, passwords and application logs are not attached automatically. Updated versions that remove optional PackMule crash reporting do not collect or upload those reports. Earlier iPhone versions may still send reports using a saved opt-in, even if the control is no longer shown. In older iPhone versions with an Optional Crash Reports control, reporting is off by default for each account/server combination and can be turned off there. If enabled in an earlier version, limited crash codes, numeric stack offsets, build, device and operating-system details can be sent after reopening the app. These reports are linked to your account on the server; they are not anonymous. The Android beta does not include this optional PackMule native crash-report feature. Operating-system diagnostics and Apple TestFlight or Google Play diagnostics are separate and follow their own settings and privacy terms.

Service Providers

DigitalOcean hosts the backend, databases, private document storage and encrypted recovery copies. OpenAI processes selected rate-confirmation page images for cloud reading. Resend handles support and alert email delivery, and Google Workspace hosts the PackMule support mailbox. Apple, Google Play and Expo provide app distribution or build services. Apple’s TestFlight and Google Play may separately process store-account, installation, testing and diagnostic information under their own privacy terms. The store account used to install PackMule is separate from your PackMule business login. These providers may retain technical, security, delivery and service records. The build source archive excludes private business documents, databases, credentials and private model weights. Provider contracts and privacy terms also apply to their services.

Storage and Retention

We retain saved company business records, documents and trip evidence to provide the company workspace until the company removes them or requests company deletion. Removing an item from a screen does not necessarily erase its older stored versions or recovery copies immediately. Confirmed deletion requests use automated processing; completion is not immediate. We remove the information covered by the confirmed request from active systems within 30 calendar days and expire its older recovery copies within 90 calendar days, both measured from the original authenticated request. Support correspondence and provider-held copies are included in that review. If information must be retained for a necessary exception, we explain the information, reason, and end or review date instead of declaring it deleted. Local crash reports are bounded to 20 reports and seven days; hosted technical crash receipts are limited to the latest 50 per company.

Your Choices and Account Deletion

You can update available account information, change your password, manage permissions and sign out. An owner can request whole-company deletion separately from personal-driver deletion. Company deletion covers the company workspace, associated accounts and company records. In current app versions, open Menu → Company for account options and the link to the website’s deletion request. Older versions may label this menu item Account. Deletion requests and confirmation are handled on the website. Review the scope and confirm your current password before submitting. Each confirmation explains the processing timeframe and retained-data handling. You do not need a second email or call to have an accepted request processed. Contact [email protected] with questions or if you cannot access the request screen.

Driver Accounts and Personal Deletion

A driver can request personal-account deletion through the website. A company owner can also initiate that driver’s confirmed deletion. Personal deletion revokes the driver’s login and removes the personal profile, sessions, private GPS observations, diagnostics and rankings. Company loads, expenses, documents, recorded business mileage and audit history remain with the company. Removing access alone revokes access and does not delete the driver’s account. Whole-company deletion is a separate owner action.

Minimal Deletion Records

We remove minimal deletion-status records from active systems 180 days after deletion is fully completed. Older backup copies and the small checkpoint needed to verify their cleanup are removed within 90 more days, with a final deadline of 270 days after full completion. These records are limited to request and necessary scope references, dates, deadlines and completion evidence—not the deleted business documents, precise GPS observations or passwords. They support confirmation and prevent an older backup from silently restoring removed information. Pending requests are not treated as completed or discarded just because time has passed.

Deletion Confirmation and Phone Copies

Current app versions use the website for deletion requests and confirmation. Follow the website’s instructions to keep private confirmation access and check progress after account access ends; this does not restore account access or reveal names or business records. A receipt means the request was received, not that deletion is complete. Save your request reference and any private confirmation access as instructed. Older app versions may have saved private confirmation access in the phone’s protected storage. Anyone using the unlocked phone can check those saved references; losing the phone or reinstalling may remove that access. Check confirmation before removing an older installation that holds your saved access. The status distinguishes active-system removal from remaining recovery-copy handling. Confirmation access ends when its minimal record expires. PackMule cannot remotely erase an offline phone or documents you exported to Files, Photos or other services. The confirmation screen provides guidance for removing copies you control. Deleting the whole app can affect every account on that phone and unsynchronized work, so follow those instructions carefully.