Privacy

What we store

Your account is an email address, a hashed password, and your subscription status. Your data, the collections, cards, records, reminders, tags, photos, and documents, is not on our servers: it lives on your device. If you choose cloud backup, we also hold an encrypted copy of it that we cannot open, and, only if you choose it, a recovery key that can unlock that copy. That is the whole list.

On your device

TrackThat is local-only. Your device does not hold a copy of your data, it holds your data: every Collection, Card, Detail, photo, and document, plus your sign-in session. The whole app works with no connection at all. Nothing stored on your device tracks you, and there is no cookie banner because there are no tracking cookies.

Cloud backup, if you choose it

Cloud backup is optional and off until you turn it on. When it is on, your data is encrypted on your device before it leaves, and what reaches our servers is a sealed copy we cannot open. We can see how big it is and when it last changed, nothing inside it. Turn backup off, or delete your account, and the copy is removed.

Because we cannot open your backup, we also cannot recover it for you if you forget your password and lose your device at the same time. So when you turn backup on, you choose: keep it that way, or let us hold a recovery key. With a recovery key, forgetting your password can never cost you your data; the trade, stated plainly, is that we then hold a key that could open your backup, and you are trusting us with it. You can change your choice later, in either direction.

Your account works on one device at a time, and your data follows you: sign in on a new device and it pulls your backup down, up to date with your last change. Signing in on a new device signs the old one out, and the app tells you before it happens.

Analytics

We count visits with Umami, a cookieless analytics service: how many people came, which pages they saw, roughly where from. Aggregate numbers only, no cookies, no cross-site tracking, no advertising, no individual profiles.

Error reports

When something breaks, an automatic report goes to Sentry with the technical details of the failure, scrubbed of personal data. We do this on legitimate interest: it is how we keep the service working.

Payments

Payments are handled by Stripe. Your card number never touches our servers, we keep only your subscription's status. What Stripe holds is covered by Stripe's own privacy policy.

Email

Email is transactional only, ever: verification, password resets, receipts, payment problems. No marketing email, no newsletter, no "we miss you."

Photos and files

Photos, video, and documents live on your device with everything else, and we do not touch them: no resizing, no recompression, no metadata changes. The file you add is the file that is stored, byte for byte, and the file that comes back in a backup or an export. That also means your photos keep everything your camera saved, including any hidden location data; nothing of yours is edited, so nothing is stripped. With cloud backup on, media travels the same way as everything else: encrypted on your device first, unreadable to us.

Backups and real deletion

Deleting something in the app removes it on your device immediately. With cloud backup on, the deletion reaches your cloud copy the next time the backup updates. Deleting your backup, or your whole account, removes the sealed copy from our storage immediately. Our own disaster-recovery snapshots cover only the small account database (email addresses, subscription status), never your data: point-in-time recovery reaches up to 3 days back, nightly snapshots age out within 14 days, and restoring from one re-applies pending deletions. That is the honest shape of "permanently removed."

Export and backup

Two safety nets, both built on your device, both always available. Create backup makes a dated file that puts everything back exactly as it was. Export makes a copy for reading: browsable pages, spreadsheets (CSV), or both, with every photo and document alongside. Both keep working if your subscription lapses and your account goes read-only. Your data is yours.

Questions and requests

For access, correction, deletion, or anything else about your data, write to support@trackthat.app.