Privacy Policy for TrackRecord

Last Updated: October 26, 2026

Introduction

TrackRecord ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application TrackRecord (the "App"). Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the App.

Information We Collect

Account Information

• Username: Required to create an account
• Email Address: Required for account creation and communication
• Date of Birth: Asked for when you create an account, to confirm you are at least 13. It is never shown on your profile, never shared with other users, and not used for advertising
• Password: If you create one, stored only as a bcrypt hash
• Sign in with Apple, Google or Facebook: If you sign in with one of these, we receive from that provider a stable account identifier, your email address (with Apple this may be a private relay address), and your first name, which we use once to suggest a username. We never receive your password for those services. If you delete your TrackRecord account, we also ask Apple to revoke the app's access to your Apple ID
• Profile Information: Optional information including bio, avatar, and profile color preferences

Location Data

• Device Location: We collect your device's location data when you grant permission. This is used to:
  • Show you roller coasters and theme parks near your current location
  • Improve location-based search results

Location data is collected only when the App is actively being used and you have granted permission. You can revoke location permissions at any time through your device settings.

User-Generated Content

• Ratings and Reviews: When you rate and review roller coasters, we collect:
  • Your rating (1–5 scale)
  • Written reviews
  • Ride dates and details (wait times, ride count, weather conditions)
  • Tags and preferences (favorites, wishlist items)
• Journal Entries: When you log a park visit, we collect the park, the date, the rides you logged, your written notes and park review, and your presentation choices for that entry (book binding color and material, and any stickers you place)
• Event Attendance and Event Reviews: If you mark an event as one you are going to or have been to, or tag a journal entry as an event night, we store that choice with your account. People you follow can see which events you are going to or have been to; everyone else sees only a count. Ratings and reviews you write for event attractions (mazes, scare zones, shows) are shown to other users with your username, like coaster reviews, and can be reported and removed like any other content
• Photos: If you choose to upload photos, they are stored using Cloudinary, a third-party image hosting service. Photos can be attached to a rating, to a ride page or park review inside a journal entry, or used as a profile picture. Attaching photos to journal pages is a paid feature
• Social Activity: Information about your interactions including:
  • Following/follower relationships
  • Likes and reactions on ratings, reviews and activity feed posts
  • Comments on activity feed posts, including the people you @mention in them. Someone you mention is notified
  • The people you list as having ridden with you on a journal entry. You can only list people you follow; they are notified when the entry is published, are shown on it to anyone who can read it, and can remove themselves at any time
• Lists: If you make a list of coasters, we store its title, description, the coasters on it and any notes you add. A public list is visible to anyone, appears in the activity feed and can be shared by link; a private list is visible only to you
• Rankings: If you rank your coasters head to head, we store the resulting order. It is visible only to you unless you save it as a public list
• Muted accounts: If you mute someone, we store that choice so their posts stay out of your feeds. It is visible only to you; the person you mute is not told
• Yearly summary: So we can show you a summary of your year, we keep a dated record of activity on your account that is not otherwise dated, such as new followers and reactions to your posts. It is used only to build your own summary and is deleted with your account
• Reports and blocks: If you report a review, comment, post or profile, we store the report, the reason and any note you add, and a copy of the reported text so it can be reviewed even if it is later edited. The person you report is not told who reported them. The list of people you have blocked is private to you

Purchases and Subscriptions

TrackRecord offers optional paid subscriptions. We never see or store your payment details. Purchases made in the App are processed by Apple through the App Store; purchases made on the web are processed by Stripe. Both handle your card details directly under their own privacy policies.

• What we store: which plan you hold, whether it is currently active, when it expires, and the transaction identifier Apple or Stripe gives us so we can confirm the purchase is genuine
• What we do not store: card numbers, billing addresses, or any other payment instrument data

Usage Data

• Device Information: Device ID for authentication purposes
• Push Notification Token: Only if you turn on push notifications, we store a token that identifies your device with your account so notifications can be delivered to it, along with your choice of which kinds you want. The token is removed when you turn push notifications off, sign out, or delete your account

Apart from what Google's ad software collects to serve ads (see "Advertising"), the App does not send analytics, automated crash reports or error telemetry to any third-party service. If that changes, this policy will be updated before the change ships.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the App
• Process your account registration and manage your account
• Enable social features (following users, viewing activity feeds)
• Show you personalized content based on your location and preferences
• Respond to your inquiries and provide customer support
• Send you important updates about the App (if you opt in)
• Detect and prevent fraud or abuse, review reports, and enforce our community standards, which can include removing content and suspending accounts
• Comply with legal obligations

How We Share Your Information

Public Information

• Your username, profile information, and public ratings/reviews are visible to other users of the App
• Photos you upload with ratings may be visible to other users if your rating is set to public

Third-Party Services

We use the following third-party services that may have access to your information:

• Cloudinary: For storing and serving user-uploaded photos
• MongoDB: For database hosting (user data, ratings, etc.)
• Railway: For hosting the application servers your device talks to
• Apple: For processing in-app purchases, validating subscription receipts, Sign in with Apple, and delivering push notifications to your device
• Expo: Only if you turn on push notifications, to pass each notification (your device's token and the notification's text) on to Apple or Google for delivery
• Google and Meta (Facebook): Only if you choose to sign in with them, to confirm who you are
• Stripe: For processing subscription payments made on the web
• SendGrid: For sending account emails such as address verification and password resets
• Google AdMob: To show ads to accounts without a paid plan: a banner under the shelves, an ad as a post in the activity feed, and an ad page inside a journal book. See "Advertising" below

These third parties are contractually obligated to protect your information and use it only for the purposes we specify.

Advertising

Accounts without a paid plan see ads served by Google AdMob: a banner under the shelves on a bookshelf, an ad shown as a post after every few posts in the activity feed, and one ad page inside a journal book opened from a shelf or a post. Paid plans have no ads.

• Ads are requested non-personalized: they are not chosen from a profile of you, and the App never asks for permission to track you across other companies' apps and websites, so your device's advertising identifier is not available to Google
• To serve and measure ads, and to prevent fraud, Google's software in the App collects information such as your approximate location (from your IP address), device and diagnostic information, and how you interact with the ads. Google handles this under its own privacy policy: How Google uses information from sites or apps that use its services
• We do not send Google your name, email, profile, ratings, journal or photos
• In the European Economic Area, the UK and Switzerland you are asked for consent before any ad is requested, and you can change your choice at any time under Settings › Ad privacy choices

We Do NOT:

• Sell your personal information to third parties
• Share your email address with other users
• Use the location you share with the App (for nearby coasters) for advertising
• Share your information except as described in this policy

Data Storage and Security

• Your data is stored on secure servers using industry-standard security measures
• Passwords are encrypted using bcrypt hashing
• We use HTTPS encryption for all data transmission
• However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security

Your Rights and Choices

You have the right to:

• Access: Pro members can export a copy of their data from the App. Anyone can request a copy by emailing trackrecord.help@gmail.com, and we will send it within 30 days
• Correction: Update or correct your account information through the App settings
• Deletion: Delete your account at any time from within the App, Settings → Delete Account. This permanently removes your account and the content you authored, including ratings, journal entries, comments, follows, blocks, reports and uploaded photos. It cannot be undone. You can also ask us to do it for you using the contact details below
• Location: Revoke location permissions at any time through your device settings
• Notifications: Push notifications are off until you turn them on. Turn them off, or choose which kinds you receive, in Settings → Notifications
• Privacy Settings: Control the visibility of your ratings and profile through App settings

Children's Privacy

TrackRecord is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. Creating an account requires a date of birth; if it shows the person is under 13, no account is created and nothing they entered is kept, including the date itself. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you delete your account, we will delete or anonymize your personal information, except where we are required to retain it for legal purposes.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. By using the App, you consent to the transfer of your information to these countries.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information we collect
• The right to delete your personal information
• The right to opt-out of the sale of personal information (we do not sell your information)

GDPR Rights (European Users)

If you are located in the European Economic Area (EEA), you have certain data protection rights under the General Data Protection Regulation (GDPR), including:

• The right to access, update, or delete your personal data
• The right to data portability: you can request your data in a portable, machine-readable (JSON) format by emailing trackrecord.help@gmail.com, and we will send it within 30 days. Pro members can also export it from the App
• The right to withdraw consent
• The right to lodge a complaint with a supervisory authority

---

This Privacy Policy is effective as of the date listed above and will remain in effect except with respect to any changes in its provisions in the future.