Privacy Policy

PACC Trac is a yard operations system used by hydrogen producers, their customers and PACC staff. It records the work done to a trailer — arrivals, inspections, fills, movements, holds and the documents and photographs that evidence them. This page explains what personal data that involves, where it is kept, and who to ask about it.

PACC Trac is operated by PACC, which is the controller of the data described here. Questions about this policy, or about the data held on you, go to support@pacctrac.com, or to whoever administers PACC Trac at your own organization.

There is no self sign-up

You cannot create a PACC Trac account. Accounts are issued by PACC or by an administrator at the organization you work for, and they are issued to a named person for a named scope. That means the personal data in your account did not come from you filling in a form — it came from your employer, who decided you needed access to their yard.

What we hold about you

Your account. Your name, your email address, your role, the producer, site or customer your access is scoped to, whether the account is active, and the date it was created. We also stamp the time of your most recent sign-in. Your password is never stored: what is stored is a PBKDF2-HMAC-SHA256 hash of it, salted per account, which cannot be turned back into the password you typed.

Your session. Signing in sets one cookie: pacc_session on the yard's own hostname, or pacc_control_session on the PACC desk's — two different names because they are two different sign-ins, and neither host reads the other's. It is HttpOnly, SameSite=Lax, scoped to the exact hostname that issued it and to no other, sent only over HTTPS in every deployed environment, and it expires seven days after it is issued. The session record itself holds nothing but an opaque token, your account id and those two dates — no IP address, no browser fingerprint, no device profile. Signing out deletes it.

Failed sign-ins. When a sign-in attempt fails, we record the email address it was made against, the IP address it came from, and a count, so that repeated attempts can be slowed down. That is the only place an IP address is written anywhere in the product, and the record is deleted the moment a sign-in against that account succeeds.

The work you record. Check-ins, procedure steps, fills, movements, holds, issues, notes and field edits are attributed to the account that performed them, with a timestamp. That attribution is the point of the record: these are evidence of work done at a facility, and an unattributed one would be worth nothing.

Photographs. The trailer, the plate, the sticker, the certificate, the proof of fill — every photograph taken in PACC Trac is stored with the account that took it and the time it was taken. The app captures with its own camera and never reads your photo library. Images are re-encoded before they are sent, so the original file's embedded metadata does not travel with them.

Terms acceptances. Accepting the Terms of Use records your name, your role, your organization, which version you accepted and when. That register is append-only: a later acceptance is added beside an earlier one, never over it.

Email we send you. When PACC Trac emails an order confirmation, a ticket or an issue notification, it logs the recipient address, the subject, which event caused it and whether it was delivered. The body of the message is not stored.

What we do not hold

PACC Trac does not collect location. There is no GPS, no geolocation, and no location permission in either the website or the iOS app — a trailer's position is a yard slot you chose from a map, not a coordinate read off your phone.

There is no analytics, no crash reporting, no advertising and no attribution SDK in this product. Not disabled — absent. The iOS app embeds no third-party code at all, and the website loads no third-party script. Nothing you do here is tracked across other apps or websites, and nothing about you is sold, rented or shared with a data broker.

On your device

Face ID and Touch ID. If you turn on biometric sign-in in the iOS app, your credential is saved into that iPhone's Keychain behind the Secure Enclave, tied to that device only and never synchronized to iCloud. It is invalidated automatically if the enrolled biometrics on the device change, and signing out deletes it. Your fingerprint or face is never available to PACC Trac and never leaves your device — iOS only ever tells the app yes or no.

No signal, no queue. PACC Trac does not hold your work for later. When the phone has no signal, an action you take — including a photograph — is refused on the spot, on screen, and nothing about it is saved to the device or sent once the connection returns. Nothing is projected as done until the server has actually accepted it, so what you see on screen never gets ahead of what we hold. You try the action again once you have a connection.

Camera. The camera is used to scan a QR sticker, a barcode or a plate and to take the photographs described above. It is not used in the background.

Cookies

One first-party cookie. The session cookie — named pacc_session on the yard's own hostname and pacc_control_session on the PACC desk's — is the sign-in described above. There are no advertising or measurement cookies, which is why PACC Trac has no cookie banner to click through.

Where it is kept, and who can see it

PACC Trac runs on Cloudflare Workers, and the records are held in a Cloudflare D1 database — one database per environment. Photographs and uploaded documents are stored in that same database rather than in a separate media service. No specific storage region is guaranteed by this configuration, so this page does not claim one.

Access follows the scope your account was issued for. A customer seat sees that customer's own loads, tickets and documents. A facility seat sees its own site. PACC administrators can see across tenants, because operating the platform requires it. Cloudflare processes the traffic as our hosting provider, and Resend delivers the emails PACC Trac sends. Beyond those two, no personal data is passed to anyone else.

How long it is kept

Operational records — check-ins, fills, movements, tickets, photographs, documents and terms acceptances — are retained as evidence of work performed, and are not edited or deleted after the fact. There is no automatic expiry: they are kept until the organization they belong to asks for them to be removed. Sessions stop working seven days after they are issued, and are deleted outright when you sign out.

Seeing, correcting or deleting your data

Ask the administrator at the organization your account was issued by, or write to support@pacctrac.com. We will provide a copy of the personal data held on your account, correct anything that is wrong, and disable the account on request.

One limit is worth stating plainly rather than burying: a completed operational record is not deleted just because the person who made it leaves. The record that a named person inspected a trailer on a given day is the evidence the facility relies on, and removing the name would destroy the record rather than anonymize it. Account access is revoked; the history of work already performed stays.

Children

PACC Trac is a workplace tool, issued to employees and contractors. It is not directed at children, it is not offered to anyone under 13, and we do not knowingly collect data from them. There is no age check in the product, because there is no way to get an account without an employer issuing you one.

Changes to this policy

If this policy changes we will publish the new version here with a new effective date. Where a change is material, PACC will tell the organizations whose people use PACC Trac rather than relying on you to re-read the page.

The Terms of Use govern the service itself. Support explains how to get help or an account.