Privacy Policy

“iPost PVZ” is an internal work app of iPost. It is used only by staff of iPost pickup points and their managers to receive parcels at the point, hand them over to clients and review the work done.

There is no sign-up in the app. Accounts are created and managed by a company administrator. Clients cannot sign in.

• Staff account — username, role and assigned pickup point. The password is sent only at sign-in over an encrypted (HTTPS) connection and is not stored on the device.

• Session key (token) — kept in the device's secure storage (iOS Keychain / Android Keystore).

• Work actions — every receipt and handover is recorded on the server with the staff username and time (work log).

• Parcel and client data — to do the job, the app shows the tracking number, parcel status and weight, and the client's code, name and phone number from the iPost system. A scanned but not yet confirmed list is kept on the device temporarily and removed when the operation is completed or the user signs out.

• Pickup and SMS codes — the code the client says is sent to the server only to be verified. Codes are never shown to staff and are not stored in plain form.

• App settings — language, theme, scanner, sound and vibration preferences are stored on the device.

The camera is used only to read barcodes and tracking numbers. Frames are analysed on the device in real time; no photos or videos are saved or sent anywhere. Without camera access, codes can be entered with a hardware scanner or the keyboard.

The app uses only the internet, the camera and vibration. It does not request access to location, contacts, photos or the microphone.

Data is used only to run the pickup point: signing staff in and checking their access, receiving parcels and handing them to the right client, sending the client notifications and codes via Telegram, and reports and workload figures per point and per employee.

• No advertising.

• No user tracking, and no third-party analytics or advertising SDKs.

• Data is not sold or shared for marketing.

Data stays within iPost systems. Excel reports are created only when a staff member taps “Share” and are passed to the app they choose. Data may be disclosed to authorised public bodies where the law requires it.

All connections are encrypted (HTTPS), the session key is kept in secure storage, and the app signs the user out automatically when the session expires. Each employee sees only their own point's data. Passwords, tokens and codes are never written to logs.

Data on the device is removed on sign-out or when the app is uninstalled. The work log and parcel history on the server are kept for the company's accounting and reporting and for the period required by law.

Staff accounts are created and deleted by a company administrator, and an account is deleted when employment ends. To access, correct or delete your data, contact your administrator or use the contacts below.

The app is not intended for anyone under 18.

When this policy changes, the update is published on this page and the “Last updated” date above changes.