What2Pack

Privacy

Last updated November 9, 2026

What What2Pack is

What2Pack is where Scout units plan: a website for Scouts, families and leaders, and Trailsign, its phone app, which shows a unit’s members what’s coming up and puts each trip on the phone so it works with no signal. This policy covers both. The website holds the unit’s records. The app shows them and sends back the changes people make in it.

Website accounts

  • Who has one. Unit leaders, and parents and Scouts a unit administrator approves. An account has a username, an email address, a password (stored only as a hash) and the units and role it belongs to.
  • Staying logged in. A log-in lasts twelve hours. If you tick “trust this device”, the browser keeps a random token for 30 days so you are not asked again; the website records the device and when it was last used, and you can remove it from your account page.
  • Password resets are emailed from skynet@what2pack.org and the link works for one hour.

Signing in to the app

  • By email. You type the email on your unit’s roster, yours or a parent’s. The website checks it against the roster and, if it matches, emails a sign-in link.
  • By password, for leaders. A leader may sign in with their website username and password instead. The password goes to the website over an encrypted connection to sign in and is never stored on the phone.
  • What’s kept. Signing in gives the phone a random key, kept in the phone’s Keychain (or the Android equivalent). The website keeps a record of that sign-in: your email, a fingerprint of the key (not the key itself), the kind of device, when it was last used, and the network address it signed in from. A sign-in lasts 180 days from the last time the app used it, and ends at once when you sign out.

What’s kept on your phone

So the app works without a signal, it keeps a copy of what your sign-in allows you to see: your units’ coming events and meetings, each trip you open (schedule, people by patrol, menus, duty rosters, tents, rides, packing lists, the trip’s write-up and files), the cookbook, your unit’s roster and gear, advancement records, and the map tiles you download. It also keeps what you enter yourself, such as packing ticks, headcounts and saved recipes. Deleting the app removes all of it.

What the app sends to the website

Only the changes you make, and only when you make them. Each change is recorded against your sign-in, the same as a change made on the website.

  • Trip planning: patrols added to a trip, recipes on a menu, duty rosters, grocery lists, tents and rides.
  • Check-offs: grocery items bought, gear checked in and out, meeting attendance, and advancement sign-offs.
  • Photos a gear manager adds to unit gear.
  • Announcements a leader posts to a trip. The website emails them to the families on that trip and shows them in the app.
  • Advancement checklists a leader emails to a Scout or the unit’s advancement coordinator go through the phone’s Mail app, to recipients the leader can see and change first.

Headcounts are not sent to the website. They pass directly between phones on the same trip, over Wi-Fi or Bluetooth nearby, so a count works with no signal. On treks with a crew game, its scores travel the same way.

What the website records

  • Unit records entered by the unit’s leaders: the roster (names, positions, patrols, ranks, the contact details and birth dates the unit keeps, food allergies and dietary needs, a daily-medication flag and any care alert a leader adds), events and meetings, sign-ups and payments, menus and duty rosters, gear, and advancement.
  • Scoutbook. Units may sync their calendar and advancement reports from Scoutbook, the BSA’s system of record. Nothing is written back to Scoutbook.
  • Payments. Units take payments through Zeffy. The website records who paid what for which ticket so the treasurer can reconcile; it never sees card details.
  • Emails it sends: sign-in links, password resets, account approvals, event announcements, trip reminders, payment statements and meeting reminders, all from skynet@what2pack.org.
  • An audit log of who changed what, kept for the unit’s leaders.

Who sees what

The website decides what each account or sign-in may see, by the person’s place on the unit’s roster.

  • A trip’s people, patrols, tents, menus and schedule are shown to the people signed in to that trip and to members of its unit.
  • Phone numbers and email addresses follow your role. Leaders see their unit’s contact details, and a family sees its own. A driver’s phone number is shown only to the adults on that trip and to the parents of Scouts on it.
  • Care flags (food allergies and dietary needs, a flag that someone takes daily medication, and any care alert a leader adds) are shown to the people on the trip, because anyone there may be giving care.
  • Money and notes on a sign-up are shown to the family it belongs to and to the unit’s leaders and treasurer.
  • Planning follows the unit. In a troop, its Scouts and leaders may plan menus, duty rosters and grocery lists. Tents, announcements, advancement sign-offs and changes to unit gear are for leaders. Adults on a trip manage their own car, and parents place their own Scouts in rides.

Medical information

What2Pack holds no medical records. Health forms stay with your unit’s adult leaders, outside the website and the app; the website records only whether a form has been reviewed and is in the binder. The only health details in What2Pack are the care flags above.

Location, camera and calendar (app)

  • Location is used only while the app is open, to show where you are on a trip map and, on trips with a wildlife game, to mark where you saw an animal. It stays on the phone and is never sent anywhere.
  • The camera scans gear QR labels and takes photos you ask for. A gear manager’s photos of unit gear go to the website; photos of your own gear or of wildlife stay on the phone.
  • Your calendar is written to only when you ask to add an event. The app can’t read your calendar.
  • Notifications are reminders and cooking timers set on the phone. Nothing is pushed from a server.

Other services

  • Maps come from Apple Maps and MapTiler in the app, and from Mapbox and OpenStreetMap on the website. A map service sees the request the way any website sees a visit. It is not told who you are.
  • Place details on some trips come from the National Park Service, Recreation.gov, Flickr and GeyserTimes, looked up by place, never by person.
  • Paying and signing up open Zeffy’s payment page or the website’s sign-up form. Neither the app nor the website sees card details.
  • Kroger is used only if you linked your own Kroger account on the website and ask to send a grocery list to your cart.
  • Directions open Apple Maps or Google Maps.

There is no advertising, no analytics, and no tracking across apps or websites.

Children

The app has no accounts of its own. Scouts sign in with the email their unit has on the roster, usually a parent’s. Website accounts for Scouts are created by, and approved by, the unit’s adult leaders. Records about youth members are entered and managed by those leaders. Parents can ask the unit to correct a Scout’s record, or to take a Scout off the roster, which removes them from every phone at its next sync.

Removing your data

In the app, sign out from Home, or from the person icon on a trip. That ends the phone’s sign-in on the website as well. Deleting the app removes everything it kept. Website accounts can be deleted from the account page. To have unit records removed, ask a leader of your unit, or email us from the address on your account or roster entry.

Contact

Questions about privacy: support@what2pack.org. Using Signoff? It has its own policy.