TRACK Privacy Policy
No effective or revision date has been approved. Operator identity, applicable legal requirements, provider details and data practices require confirmation. This draft is based on existing project legal content; it is not a statement that production policies have changed.
This Privacy Policy explains what information TRACK handles, why it is used, and the controls available to you. It describes the current product and is not a statement about features that are not currently available.
1. Information you provide
When you create a TRACK account, you provide information such as your name, email address, and password. TRACK stores a protected password representation rather than your password in readable form. Email verification and password-reset requests also involve your email address and short-lived security tokens.
You may add or edit subscription details, notes, payment details, dates, categories, and management links. You may also provide notification preferences, AI preferences, feedback about AI insights, and other information you choose to enter in the app.
2. Information from connected services
If you connect a bank through Plaid, TRACK receives the bank-account and transaction information that the connection makes available for subscription detection and account features. TRACK stores the subscription-related records and evidence needed to show detections and manage them. TRACK does not receive or store your bank password through this connection.
If you connect Gmail, TRACK requests Google's Gmail read-only permission and searches for messages that may contain subscription, renewal, receipt, trial, cancellation, or price-change information. When needed to classify those messages, TRACK may process relevant message content. TRACK may retain limited message metadata, snippets, and derived subscription or evidence fields. TRACK does not maintain a general full-mailbox copy and does not send, edit, delete, archive, or manage Gmail labels. Gmail access tokens and refresh tokens are handled by the server and protected when stored.
TRACK has no direct connection to or import from Apple's subscription system. Apple-billed subscription activity may be detected from evidence available through a connected bank or Gmail account. Apple subscription management happens through Apple's external management experience.
3. Subscription, detection, and notification data
TRACK stores subscription records, payment and price-history records, detected subscription records, evidence from connected bank or Gmail sources, and status or review decisions. Detection results can include merchant names, amounts, currencies, billing cycles, dates, source labels, and limited message or transaction details needed to explain the result.
TRACK stores notification preferences for payment reminders, trial reminders, price alerts, and related in-app or device notifications. Device notification permission is controlled by your device and operating system.
4. AI-related processing
Some TRACK AI features may use an external AI provider. When smart analysis or the assistant is enabled and a provider is configured, TRACK may send a limited, sanitized, structured subscription context and the question you ask to OpenAI through the server. This context is intended to support subscription insights and answers. It can include subscription, payment, evidence, and detection details relevant to your question, but TRACK does not send passwords, access tokens, or your full Gmail mailbox for this feature.
TRACK may retain personal learning preferences and related feedback to adapt insights for your account. Participation in shared learning is separate and requires your opt-in.
AI output is advisory. TRACK may also produce deterministic, non-provider insights when AI is disabled or unavailable. You can turn smart analysis off in Settings.
5. How TRACK uses information
TRACK uses information to create and secure accounts, verify email addresses, deliver password-reset and verification messages, connect and synchronize bank or Gmail sources, identify possible subscriptions, show evidence and reminders, provide requested AI-assisted insights, respond to support requests when available, prevent abuse, and operate and improve the service.
TRACK does not use the information described here to sell personal data or to provide behavioral advertising. TRACK does not add an advertising SDK, cross-app tracking SDK, or product analytics SDK as part of the current application.
6. Service providers
TRACK uses service providers to operate the product. Plaid provides the bank connection and related financial-data access. Google provides Gmail OAuth and Gmail services. OpenAI may process the limited AI context described above when AI is enabled and configured. Resend is used for transactional email such as email verification and password-reset messages. [Before publication: confirm the current backend hosting and database providers and insert an accurate description.] Expo provides the mobile application runtime and build ecosystem.
These providers may process information under their own terms and privacy policies. TRACK does not disclose more information to a provider than is needed for the relevant feature, subject to the operation of that provider and the information you choose to connect or enter.
7. Security
TRACK uses measures such as authenticated sessions, protected password handling, server-side protection for OAuth credentials, encrypted storage for connected-service secrets, scoped data access, and allowlisted account exports. No method of storage or transmission can be guaranteed completely secure.
8. Your controls
You can review and manage subscriptions, notification preferences, AI settings, and connected bank or Gmail services in the app. You can disconnect supported services, export the TRACK data made available by the account export feature, and permanently delete your TRACK account from Settings.
Disconnecting a bank or Gmail connection stops TRACK's future access and synchronization through that connection. Disconnecting does not automatically erase transaction history, subscription records, or evidence already imported into TRACK. Deleting your TRACK account is a separate action.
Account deletion removes the local TRACK account data associated with the account and invalidates its sessions. TRACK also attempts to revoke or clean up connected Plaid and Google access, but provider-side processing or retention may be outside TRACK's control. Do not assume that deleting a TRACK account deletes information held independently by a bank, Google, Plaid, OpenAI, Resend, or another provider.
9. Retention
TRACK keeps account and subscription information while it is needed to provide the service or while your account remains active. Security and transactional records may be retained for as long as reasonably needed for their purpose. TRACK does not promise a fixed retention period for every category of information or for information retained by third-party providers.
10. Children
TRACK is intended for adults and is not knowingly directed to children.
11. Changes to this policy
TRACK may update this Privacy Policy when the product or its data practices change. The current version will be posted at this URL. Continued use after an update means that you have had an opportunity to review the updated policy.
12. Contact
Questions about privacy can be directed to support@trackclearly.com.