Label data contains customer names, addresses and order numbers. This page describes what the software actually does, not what a template says it might do.
A label you check is parsed in memory, rendered in memory, and discarded when the response is sent. It is not written to disk, not written to a database, and not included in any backup. There are four exceptions and every one of them is listed below.
This is verified rather than asserted: a full-text search of our events table for the payloads actually submitted returns zero rows, and tests fail the build if a future change starts recording content.
Structure, never content. For each check:
The label hash exists so we can tell that a corrected label was re-checked without keeping either version. It cannot be reversed into a label.
Never recorded: field data, barcode payloads, addresses, names, order numbers, or any other content of a label.
Each of these stores the label itself, because it cannot work otherwise.
Sharing a check stores its ZPL so the link can render. It is never automatic — it takes a deliberate click, the warning is on the button, and an expiry is required with no default. You can delete a permalink from its own URL at any time. Expired and never-existed links are deliberately indistinguishable.
The “this label failed in the real world” form stores what you send, because that is the point of it. It is only ever used to decide which rules to write next.
Pinning a label to a suite stores it, because you cannot re-check a label that was not kept. Deleting the suite deletes the labels with it.
A queued print job holds your label only until the agent on your network collects it. Those bytes live in Redis under a one-hour expiry and are deleted the moment an agent takes them. They are never written to our database, which has a practical consequence worth stating plainly: the print queue is not in our backups. A restore from last night cannot resurrect yesterday’s shipping labels, because they were never on the disk that was backed up.
The self-hosted edition sends us nothing at all — not usage, not errors, not even a licence check. Licences are signed files verified offline, so the software runs air-gapped. Structural logging is off by default there and writes only to your own database when switched on. See pricing.
To ask what we hold about you, or to have something removed, email privacy@labelproof.dev. Permalinks and suites you can delete yourself without asking.