Tracktivity is provided by Dennis Röttger.
Contact for privacy questions or to exercise any of the rights below: privacy@traxtivity.com.
Account data: your email address, display name, and password (your password itself is never visible to us — it's handled entirely by our authentication provider, Supabase Auth).
Activity data: whatever names, schedules, and notes you choose to enter for the things you're tracking, plus the resulting history — confirmed, missed, or skipped, and when. We don't offer a dedicated category for any particular kind of activity (e.g. medication) — it's a general-purpose tool, and what you track with it, including whether you choose to enter anything sensitive, is entirely up to you.
Confirmation photos: if you or a supporter require photo confirmation for an activity, the photo you take to confirm it.
Supporter relationships: invite codes, which activities you've chosen to share with which supporter, and related permission settings.
Device and notification data: push notification tokens (so we can alert you or your supporters about missed activities) and whether those notifications were actually delivered.
Preferences: your chosen language, and the record of your consent described below (when you gave it, and to which version of this policy).
Most of this — account data, activity scheduling, supporter features — is processed because it's the service you signed up for (contractual necessity, GDPR Art. 6(1)(b)).
Because activity names and notes are free-form and entirely up to you, they could end up containing sensitive personal information (for example, if you choose to track your own medication schedule) even though we don't design or market any feature specifically around that. We ask for your explicit acknowledgment of this before you start using the app — see "Your consent" below — and you can withdraw at any time; because this data is core to what the app does, withdrawing it in practice means deleting your account, which you can do yourself at any time from Account settings.
We also process limited data (e.g. error logs, abuse patterns) under legitimate interest (Art. 6(1)(f)) to keep the service secure and working, balanced against your rights — we don't use this for advertising or profiling.
Because you're free to enter whatever you like in an activity's name and notes, that could include sensitive personal information — that's your choice, not something we ask of you. Before you start using the app, we ask you to acknowledge this and consent to our processing of whatever you choose to enter, separate from simply creating an account. You'll see this request the first time you use the app, and again if we make a material change to this policy that affects what you agreed to.
You can withdraw consent at any time by deleting your account (Account → Delete my account) — we don't have a way to keep your account active while withholding this data, since tracking activities is the core purpose of the app.
Supporters, only for activities you explicitly choose to share with them — nothing is visible to a supporter by default. You control this per activity and can revoke it at any time.
We never sell your data. We do show ads to accounts that haven't bought the one-time "remove ads" option, through Google AdMob — see "Advertising" below for exactly what that does and doesn't involve.
A small number of service providers process data on our behalf (see "Sub-processors" below) strictly to operate the app, under their own data processing agreements with us.
Tracktivity shows a small banner ad to accounts that haven't bought the one-time "remove ads" option — this is what keeps the app free for everyone else. The ad itself comes from Google AdMob, a third-party advertising service.
If you're located in the European Economic Area, the United Kingdom, or a U.S. state with its own advertising privacy law: you can skip the rest of this section, it doesn't apply to you. You will only ever be shown ads that are not personalized to you — nothing about your device or how you use it is used to choose which ad you see.
If you're located anywhere else, the ads you see may be personalized — chosen using things like your device's advertising identifier (a bit like a nickname just for ads, separate from your name or email) and general interest categories, the same way ads commonly work in other free apps. You can turn this off at any time in your device's own settings (on most phones: Settings → Privacy → Ads), which limits every app on your device — not just Tracktivity — to non-personalized ads.
Either way, none of your actual data in Tracktivity — activity names, notes, schedules, photos — is ever shared with AdMob or any advertiser.
Supabase — database, authentication, file storage, and the server-side functions that check for missed activities and handle account deletion.
Expo (Expo Application Services) — delivers push notifications to your device.
Resend — sends the farewell email if you delete your account.
Google AdMob — serves the banner ad shown to accounts without the "remove ads" purchase (see "Advertising" above for exactly what it does and doesn't see).
RevenueCat — verifies and manages the one-time "remove ads" purchase.
Where any of these providers process data outside the European Economic Area, that transfer relies on their own standard contractual clauses or equivalent safeguards. This section will be finalized once the underlying hosting region and data processing agreements are confirmed.
For as long as your account exists. If you delete your account, deletion is immediate and permanent: every activity, history entry, photo, and supporter connection you have is removed straight away, not after a delay.
Confirmation photos specifically are deleted automatically after 60 days, regardless of whether you delete your account — the record that an activity was confirmed, missed, or skipped is kept, just not the photo itself. [PLACEHOLDER: confirm and state how long residual copies may persist in routine database backups after either kind of deletion, per your hosting provider's backup rotation policy.]
Under GDPR (and equivalent laws elsewhere), you can: access the data we hold about you; correct it if it's wrong; have it erased; restrict or object to our processing of it; receive a portable copy of it; and withdraw consent at any time (see "Your consent" above).
Account deletion, language/notification preferences, and a full copy of your data (Account → Export my data) are self-service today, in Account settings. For anything else, contact us using the details in "Who we are" above.
You can also lodge a complaint with the data protection supervisory authority in your country of residence at any time.
You must meet the age of digital consent in your country (commonly 16, though some countries set it as low as 13) to use it yourself, or have a parent or guardian's consent if you don't.
Access to your data is enforced row-by-row at the database level, so — outside of the supporter sharing you explicitly grant — only you can read or change your own data. Data is encrypted in transit.
This is version 2026-08-08 of this policy. If we make a change material enough to affect what you agreed to, we'll ask you to review and re-accept it the next time you open the app.