Privacy notice
Draft: some details of who runs Tracky are still to follow.
What Tracky keeps about you, why, for how long, and who else handles it. You can read this without an account.
Who is responsible
The controller of your data is:
Dries Ketels
Address to follow
Contact: privacy@driesketels.dev
What we keep, why, and for how long
| What | Why, and on what basis | Kept until |
|---|---|---|
| Your account: email address, name, language, the sign-in methods you linked, and, if Google or Microsoft made your account, the profile photo it gave (for Google, the photo's address) | To provide the service you signed up for (contract) | You delete your account |
| Signed-in sessions: IP address and browser (user agent) | To keep accounts safe (legitimate interest: security) | The session ends, at most 30 days after signing in, or at once if you delete your account |
| Sign-in links and sign-in state: your email address | To sign you in (contract) | The link runs out, after 15 minutes |
| Invitations: the invited person's email address | To invite someone when a board's owner asks (contract) | 30 days after it was accepted or ran out; a withdrawn invitation is deleted at once |
| Records of emails sent: the recipient's address, and the IP address that asked | To limit abuse (legitimate interest) | 7 days, also after you delete your account |
| Request counters for signing in and the demo: IP address | To limit abuse (legitimate interest) | 2 days |
| Demo boards: whatever a visitor typed on them | To let people try Tracky (legitimate interest) | The demo runs out, after 30 days, unless someone keeps the board |
| Boards: the names of the people on them, the chores, and who did what when | To run the board for its owner and members (contract) | The owner deletes the board, or the last account on it is deleted |
| Security logs: account id, a coded form of an email address, IP address | To detect and investigate attacks (legitimate interest: security) | As long as our hosting provider keeps logs for our plan |
| Feedback messages: what you wrote, and your name and email address if you gave them or were signed in | To answer you and improve Tracky (legitimate interest: support). Kept as issues in a private GitHub repository | We close and delete the issue |
| Database backups: all of the above | To recover from failures (legitimate interest) | As long as our hosting provider keeps backups |
Who else handles your data
Tracky uses these services. Each receives only what its part needs.
- Railway: hosts Tracky, its database, backups and logs, so it holds everything above. A company in the United States.
- Resend: sends sign-in links and invitations: it receives the recipient's address and the email itself. A company in the United States.
- Google: only if you choose to sign in with Google: it signs you in and tells Tracky your name, your verified email address and the address of your profile picture. If that sign-in creates your account, Tracky keeps the picture's address with it, but never shows it. A company in the United States.
- Apple: only if you choose to sign in with Apple, once that is available: it signs you in and tells Tracky your email address (or a relay address) and name. A company in the United States.
- Microsoft: only if you choose to sign in with Microsoft: it signs you in and tells Tracky your name and email address, and Tracky fetches your Microsoft profile photo. If that sign-in creates your account, Tracky keeps the photo with it, but never shows it. A company in the United States.
- GitHub: keeps feedback messages as issues in a private repository, and counts requests for features Tracky doesn't have yet (for turned-away work accounts, only the email domain). A company in the United States.
Children
Accounts are for people aged 16 and over. A child can appear on a board only as a name that a parent or another member types in; they have no account, and Tracky keeps nothing else about them.
Your rights
- See and take your data: on your account page, “Download my data” gives you everything about you in one file.
- Erase it: on the same page, “Delete my account”. Boards nobody else has an account on are deleted with it. A board you're the only owner of, while someone else has an account on it, blocks deletion until you make them an owner or delete the board instead. On boards that stay, your entries where you'd ticked something off stay as “Former member”, no longer linked to you; entries with none are removed. Every session ends. Records of emails sent to your address are kept up to 7 days after deletion, to limit abuse.
- Correct it: email the contact above.
- Anything else, such as restricting or objecting to how your data is used, or data the download leaves out, like security logs: email the contact above. We answer within a month.
- You can also complain to the data protection authority in the EU country where you live or work, or where you think something went wrong.
What your browser stores
There is no analytics and no tracking, so there is no cookie banner. Your browser only keeps:
- a sign-in cookie while you are signed in, and one for the few minutes a sign-in with Google, Apple or Microsoft takes;
- a language cookie, if you choose a language, and a display cookie, if you turn on bold display;
- a few notes in local storage: that you skipped the tour on a board, how many sign-in links this browser asked for lately, that you asked for Sign in with Apple, and whether the feedback box was already shown or used.
Last updated 30 September 2026