Privacy Policy

TrakApp LLC ("Trak") provides the Trak mobile application ("the Service"). This Privacy Policy explains how we collect, use, store, and protect your information when you use our iOS and Android apps.

Personal Data means any information that identifies or can identify you.

By creating an account or using Trak, you agree to the practices described in this Privacy Policy. If you do not agree with any part of this Privacy Policy, please stop using the Service.

1. Scope

This Privacy Policy applies to:

• Trak mobile applications for iOS and Android
• All in-app features: groups, tasks, events, expenses, groceries, vibes
• Push notifications and reminders
• Communications and support interactions

This policy does NOT apply to:

• Third-party platforms you use independently
• External websites not operated by Trak
• Apple's and Google's own privacy practices (they handle app store payments)

2. Information We Collect

2.1 Account Information - Required at Signup

• First name and last name
• Username (3-20 characters, lowercase letters, numbers, underscores, periods only)
• Email address
• Password (encrypted, minimum 6 characters)
• Birthdate
• Country (selected from dropdown)
• City (selected from dropdown based on country)
• Currency code (auto-selected from country, can be changed)

2.2 Account Information - Optional

• Phone number with country code
• Profile picture/avatar (JPG, JPEG, PNG, WEBP formats only)
• Monthly income (can be added later in profile settings)

Important: We do not scan or analyze your uploaded photos. Photos are stored as-is and only displayed to you and users you choose to share them with (friends or group members).

2.3 User-Generated Content

All content you create in Trak:

2.4 System-Generated Metadata

• User ID (UUID from Supabase Auth)
• Timestamps: created_at, updated_at, completed_at, joined_at, bought_at, left_at
• Device timezone (auto-detected from device settings for notification scheduling)
• Session tokens (managed by Supabase, stored locally in device AsyncStorage)

2.5 Device & Technical Information

• Device type and model
• Operating system and version
• App version
• Platform (iOS or Android)
• Device identifiers (session ID, installation ID from Expo Constants)
• Language preference
• IP address (used for authentication security only, not tracked)

2.6 Push Notification Data

• Expo push tokens (generated when you enable notifications)
• Device ID (to manage multiple devices)
• Platform (iOS/Android)
• Token registration timestamps
• Notification delivery status

2.7 Friend System Data

• Friend connections between users
• Friend request status (pending, accepted, rejected)
• Request timestamps
• Username search queries (not logged)

2.8 Currency Exchange Data

When you use the currency conversion feature:

• Currency codes (e.g., USD, EUR, GBP)
• Conversion amounts (processed server-side only)
• Exchange rates fetched from ExchangeRate-API
• Cached rates stored in our database (expires after 24 hours)
• No personal information sent to ExchangeRate-API
• All requests proxied through our Supabase Edge Function

3. How We Use Your Information

Trak uses your information to:

• Create and authenticate your account
• Sync your data across all your devices
• Display correct currency formats and regional settings
• Provide currency conversion features with real-time exchange rates
• Enable group collaboration (tasks, events, expenses, groceries)
• Send scheduled notifications and reminders adjusted to your timezone
• Match your local time for notification delivery
• Enable friend connections and user search by username
• Provide customer support when you contact us
• Maintain service security and detect abuse
• Prevent fraud and unauthorized access
• Comply with legal obligations

What We Do NOT Do:

• We do not sell your personal data
• We do not use third-party analytics
• We do not use advertising or cross-app tracking
• We do not access GPS or collect precise location data
• We do not share your data with marketers

4. How We Share Your Information

4.1 With Service Providers

We share information only with these trusted service providers:

These providers process data on our behalf under strict contractual confidentiality and security obligations.

4.2 With Other Users (Group Context)

When you join groups or connect with friends:

4.3 For Legal, Safety, or Security Reasons

We may disclose information if required to:

• Comply with legal obligations (court orders, subpoenas)
• Respond to valid legal requests from law enforcement
• Protect Trak's rights, property, or users
• Detect or prevent fraud, abuse, or security threats
• Investigate Terms of Service violations

We seek to limit such disclosures to what is strictly necessary.

4.4 What We NEVER Share

• Personal data with advertisers
• Data with analytics companies
• Data with third parties for marketing purposes
• Your information for cross-app tracking
• Payment card information (we don't collect this)

5. Data Storage & Transfers

5.1 Primary Storage - Supabase Cloud

• Data stored on Supabase cloud infrastructure in the United States data center
• Subject to U.S. data protection laws
• Row-level security policies protect your data
• Only you and users you explicitly share with can access your data
• Encrypted in transit (HTTPS) and at rest

5.2 Local Device Storage

Trak stores some information locally on your device:

All local storage is automatically cleared when you delete the app.

5.3 Edge Processing (Server-Side Functions)

Six server-side functions run on Supabase infrastructure:

1. Send scheduled push notifications
2. Deliver queued notifications
3. Generate monthly expense reports
4. Queue expense notifications
5. Send manual notifications
6. Fetch currency exchange rates from ExchangeRate-API

These functions:

• Run on Supabase Edge Network (United States)
• Process notification scheduling and delivery
• Fetch and cache currency exchange rates
• Access only necessary data to complete their task
• Do not store additional data beyond what's in the database
• Proxy external API calls (no direct client-to-ExchangeRate-API communication)

5.4 International Data Transfers

• Trak stores and processes data using U.S.-based service providers
• If you use Trak from outside the United States, your data is transferred to the U.S.
• These regions may have different data protection laws than your home country
• By using Trak, you consent to this international data transfer
• We apply technical and contractual safeguards regardless of location

6. Data Security

Trak uses industry-standard security measures:

Technical Security:

• HTTPS encryption for all network communication
• Password hashing and encryption (via Supabase Auth)
• Row-level security on database tables
• Access controls (only authorized users can access specific data)
• Session token management with automatic expiration
• Secure file storage with access policies

Organizational Security:

• Regular security reviews
• Monitoring for abuse and unusual activity
• Modern cloud infrastructure with security best practices

7. Data Visibility & Privacy

What Other Users Can See:

• Your name, username, and avatar (to friends and group members only)
• Shared group content (tasks, events, expenses, groceries you participate in)
• Vibes you send
• Group membership (who's in your shared groups)

What Remains Completely Private:

• Email address (never shown to other users)
• Password (encrypted and never shown)
• Birthdate
• Phone number
• Country and city
• Monthly income
• Personal group content (groups you create for yourself only)
• Payment methods you create (just labels for your own tracking)
• Device information
• Push tokens
• IP address
• Session data

8. What We Do NOT Collect

Trak explicitly does NOT collect:

9. Permissions We Request

10. Your Rights

Depending on your location (GDPR, CCPA, etc.), you may have rights to:

Note: Some rights may vary by jurisdiction. We comply with applicable data protection laws in your region.

11. Data Retention

12. Children's Privacy

• Trak is not intended for anyone under 13 years old
• We do not knowingly collect data from children under 13
• We require birthdate at signup to verify age eligibility
• If we discover a child under 13 has created an account, we will delete it immediately
• Parents: If you believe your child has used Trak, contact us at support@trakapp.io so we can remove their information

13. Cookies and Tracking

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect:

• Changes to our practices
• New features or services
• Legal or regulatory requirements

15. Contact Information

For questions, concerns, or requests regarding your privacy:

Contact us for:

• Privacy inquiries
• Data access requests
• Account deletion requests
• Data export requests
• Security concerns
• Questions about this Privacy Policy