Security and Privacy Contact
Effective date: November 1, 2026. Version 1.
Effective date: November 1, 2026
Version 1.0
1. About this page
This page explains how Packlyn Canada ("Packlyn", "we", "us") protects your Packlyn account and the information in it, how to report a security problem or a privacy concern, who to contact about privacy, and what we do if a breach happens. It applies to Packlyn Design Software (the desktop app and the online version that runs in a web browser) and the Packlyn account service. Packlyn Canada is a print business in Cambridge, Ontario, Canada.
Please read it with our Privacy Policy and our Data Retention Policy. The website https://packlyn.ca and its Plyn chat are covered by the website's own Privacy & Cookie Policy (https://packlyn.ca/privacy/).
No system is perfectly secure, and we cannot promise that information will never be lost or accessed without permission. We describe here what we actually do, so you can decide what is right for you.
2. How we protect your account
- Passwords: we store your password only as a scrypt hash, a slow, memory-hard one-way function, so we never keep the password itself and never write it to our logs. Passwords must be at least 10 characters, are checked against a list of common passwords, and can't contain your name or email address.
- Confirming your email address: a new account is created only after you enter the 6-digit code we email you. Codes expire after 15 minutes and allow a few tries.
- Two-step sign-in: you can turn on two-step sign-in in Packlyn Design › My Account › Account Settings. Each time you sign in, we email a 6-digit code to your account's email address (from info@packlyn.ca), so there's nothing else to install. Each code works once, for 10 minutes, and we store only a one-way hash of it. It is optional for customers. Packlyn staff must use it, with an authenticator app (TOTP) whose secret is stored encrypted with AES-256-GCM and whose recovery codes are stored only as hashes.
- Limits on guessing: repeated wrong passwords pause sign-in for a while, and rate limits slow down attempts to guess passwords, codes or promo codes.
- Sessions: each sign-in creates a random session token that we store only as a hash. A session lasts 12 hours, or up to 30 days if you choose "Remember me", and stops working if it isn't used for 14 days. In the desktop app, a session works only on the computer it was made on, and if you choose "Remember me", the token is encrypted with your operating system's keychain. In the online version, the session is kept in a cookie that scripts can't read and that isn't sent with requests from other websites, and every change also needs a separate security token. Changing your password signs out your other devices, and you can see your signed-in computers and sign any of them out in My Account.
- Signed plan tokens and updates: the features of your plan are sent to the app in a token signed by Packlyn's server, so paid features can't be unlocked by editing files. The desktop app installs only updates signed by Packlyn.
3. How we protect your information
- HTTPS: all traffic between the app, the online version and our servers is encrypted with HTTPS.
- Encryption at rest: designs saved to your account are encrypted at rest on our server with AES-256-GCM, each piece bound to its account, and each design is checked against a SHA-256 checksum whenever it is opened. Two-step sign-in secrets are encrypted with AES-256-GCM. Our backups, including the copies kept on Packlyn's own computer, are encrypted with our server's key.
- Network addresses: we store IP addresses only as keyed one-way hashes, used for security and rate limits. Our request logs contain no personal information.
- Your files: files we store are kept under random names and served only to their owner. Uploaded files are checked, and may be scanned for viruses.
- Card data: card payments are handled by Square. You enter your card in Square's secure card form on Packlyn's payment page, and the full card number and security code go straight to Square. Packlyn's servers never receive or store them. We keep only Square's references to your card, the card brand and the last four digits.
4. What Packlyn staff can and can't see
- Packlyn staff can never see your password or your full card number, because Packlyn doesn't have them.
- Staff use separate administrator or support roles, and they must confirm two-step sign-in on every session before they can use the administrator tools.
- To help you, staff can see account details such as your name, email address, plan, billing records, messages and refund requests, and the notes other staff have added. The administrator tools show how many designs an account has saved and how much space they use, not the designs themselves.
- Every administrator action, including opening a customer's account, is recorded in an audit log with who did it and when. The audit log is append-only and is kept permanently, so actions can always be checked later.
5. What you can do
- Use a strong password that you don't use anywhere else.
- Turn on two-step sign-in, and keep your email account secure too (a strong password and its own two-step sign-in), since your codes arrive there. Packlyn will never ask you for a code.
- Sign out of computers and browsers you no longer use, and remove old computers in My Account.
- Be careful with emails that ask for your password. Packlyn will never ask for your password or your full card number.
- Keep the desktop app up to date, because updates can include security fixes.
6. Reporting a security problem
If you think you have found a security problem in Packlyn Design Software, the online version or the account service, please tell us privately:
- Email packlyncanada@gmail.com with "Security" in the subject line.
- Describe the problem, where it is, the steps to reproduce it and what someone could do with it.
- Include your contact details, so we can ask questions and tell you what we did.
Please follow these basics of responsible disclosure:
- Act in good faith, and use only your own account or test accounts you created.
- Don't access, change or delete other people's information, and stop as soon as you have shown the problem. If you come across someone else's information, don't keep it or share it, and tell us.
- Don't disrupt the service: no denial-of-service attacks, spam, automated scanning that loads our servers, or attempts to trick Packlyn staff or customers.
- Don't share the problem publicly until we have had a reasonable chance to fix it.
We will acknowledge your report, look into it and let you know what we found. We appreciate reports made in good faith that follow these basics. Packlyn does not run a bug bounty program and does not pay for reports. Testing the security of the service in other ways needs our written permission, as the Acceptable Use Policy explains.
If someone may be in immediate danger, contact the police or emergency services first.
7. Raising a privacy concern
If you have a question or concern about how we handle your personal information, or you want to make a request about it, contact us:
- Email packlyncanada@gmail.com with "Privacy" in the subject line.
- Tell us what your question, concern or request is about. If it is about your account, send it from your account's email address if you can.
You can ask what personal information we hold about you, ask us to correct it, withdraw your consent, or ask us to delete it. Many of these can be done yourself in My Account › Privacy And Data. We may ask you to confirm your identity before we act, and we will respond within the time limits set by applicable privacy law.
If you are not satisfied with our answer, you have the right to complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca). If you live in Quebec, you can also complain to the Commission d'accès à l'information du Québec.
8. Our privacy contact
Packlyn Canada has a person responsible for privacy, who oversees how we handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and answers privacy questions, requests and complaints.
- Packlyn Canada, Cambridge, Ontario, Canada
- Email: packlyncanada@gmail.com (please put "Privacy" in the subject line)
- Contact page: https://packlyn.ca/contact/
9. If there is a breach
If we learn of a breach of security safeguards involving personal information, we will:
- act quickly to contain it, for example by closing the problem, changing keys and passwords, and signing everyone out where needed
- work out what happened, what information was involved and who is affected
- notify the people affected, and report the breach to the Office of the Privacy Commissioner of Canada, as PIPEDA requires when the breach creates a real risk of significant harm, as soon as feasible
- where Quebec's privacy law applies, also notify the Commission d'accès à l'information du Québec and the people affected when that law requires it
- tell other organizations that can help reduce the harm, such as a bank or Square, where that can help
- keep a record of the breach, as PIPEDA requires, and fix what allowed it to happen
A notice to you will explain what happened, what information was involved, what we have done, and what you can do to protect yourself, such as changing your password or turning on two-step sign-in.
10. Changes to this page
We may update this page when our services, our safeguards or the law change. Each version has an effective date and a version number, and you can find the current version in the app under Legal and Policies.
Contact us
- In the app: My Account › Help › Message Packlyn Canada
- Email: packlyncanada@gmail.com (put "Security" or "Privacy" in the subject line)
- Contact page: https://packlyn.ca/contact/
- Packlyn Canada, Cambridge, Ontario, Canada