TrackTrack Privacy Policy

Last updated: 2026-11-02

Scope. This Privacy Policy describes how the TrackTrack application ("TrackTrack", "we", "us") collects, uses, stores, and protects personal data when a Shopify merchant installs and uses TrackTrack. It applies to the merchant (our direct customer) and to the merchant's own end customers whose data flows into TrackTrack through the Shopify API. TrackTrack is operated by a single business owner and a development function; there are no other staff.

1. Who is responsible

For the personal data of a merchant's end customers, the merchant is the data controller and TrackTrack is the data processor acting on the merchant's documented instructions (see the accompanying Data Processing Agreement, data_processing_agreement.md). For data about the merchant's own account and store, TrackTrack acts as controller.

Contact for any privacy request or question:

Email: contact@tracktrackapp.com
Application: https://app.tracktrackapp.com

2. What data we collect

TrackTrack collects only the data needed to deliver profit/revenue analysis, decision-memory, and merchant-initiated customer re-engagement for the merchant's own store. We practice data minimization: we request the narrowest Shopify scopes that our features actually call, and we do not collect data we do not use.

2.1 Data accessed through Shopify (controlled by the merchant)

Orders (read_orders, read_all_orders): order line items, totals, currency, timestamps, fulfillment and refund status.
Products & inventory (read_products, read_inventory): product titles, variants, prices, inventory levels.
Customers (read_customers): customer email address, first/last name, and where present, shipping/billing address and order history. This is Protected Customer Data (Level 2) under Shopify's policy. We access it to match orders to customers for profit/CRM analysis and to enable the merchant's own re-engagement emails to their own customers.
Shopify Payments payouts (read_shopify_payments_payouts): payout amounts and timing, used for cash/margin reconciliation. No card or full financial-instrument data is accessed or stored.

2.2 Advertising data (where the merchant connects it)

Aggregated ad spend and performance from Meta / Google for the merchant's own ad accounts. This is campaign-level spend/performance data, not end-customer personal data.

2.3 Merchant account data

Shop domain, Shopify OAuth offline access token, install/uninstall timestamps, and merchant-created content inside TrackTrack (decision cards, notes).

2.4 Optional iOS Feed notifications

With iOS notification permission, TrackTrack stores an app-scoped installation identifier and APNs delivery token linked to the signed-in account. New Feed items and updates from every currently accessible store are enabled by default; account-level notification switches and iOS notification settings control delivery. Apple Push Notification service receives the token, store name and displayed Feed notification content. This delivery adapter does not generate a new AI assessment, access advertising identifiers or track activity across apps.

We do not collect special-category data (health, biometrics, etc.), and we do not knowingly collect data about children.

3. How we use the data and why (legal basis)

Purpose	Data used	Legal basis (GDPR Art. 6)
Profit / revenue / margin analysis	Orders, products, payouts, ad spend	Performance of contract; legitimate interest of merchant
Decision memory (recording and reviewing business decisions)	Aggregated order/ad metrics	Performance of contract
Merchant-initiated re-engagement emails to the merchant's own customers	Customer email, name, order history	Processor acting on controller (merchant) instructions; merchant is responsible for lawful basis/consent of their customers
Operating, securing, and supporting the service	Shop domain, token, logs	Legitimate interest

We use personal data only for the purposes above (purpose limitation). We do not use it for advertising to the merchant's customers on our own behalf, for profiling beyond the merchant's analytics, or for any purpose unrelated to serving that specific merchant's store.

4. We never sell data

TrackTrack does not sell, rent, or trade personal data, and never shares it with third parties for their own purposes. Personal data is used solely to provide the service to the merchant whose store it came from. The only external parties involved are the sub-processors listed in Section 5, each of which processes data strictly to support our service.

5. Sub-processors

Sub-processor	Role	Data shared
Apple Push Notification service (APNs)	Delivers optional iOS Feed alerts	APNs device token, store name and displayed Feed notification content
Shopify	Source of merchant/customer data; platform	Data originates here; we read via authorized API
Cloud infrastructure provider	Hosts the TrackTrack application and database	All stored data resides on secure cloud infrastructure
OpenRouter / underlying LLM providers	Generate decision analysis text and draft re-engagement email copy	Only non-identifying, aggregated analytical context (e.g. metric summaries, decision descriptions). We do not send customer email lists, names, or address data into the LLM for analytics. When drafting an email, only the minimal fields needed for that draft are used, and no customer database is uploaded.

We do not add new sub-processors that handle personal data without updating this policy. Merchants may request the current sub-processor list at any time.

6. Data retention

We retain data only as long as needed to provide the service. See data_retention_policy.md for the full schedule. Key commitments:

On app uninstall, Shopify sends a shop/redact request (approximately 48 hours after uninstall). On receipt we delete that shop's personal data within 48 hours.
On a customers/redact request, we delete the identified customer's personal data after receipt.
On a customers/data_request, we compile the personal data we hold on that customer and provide it to the merchant to fulfill the data-subject request.

Push delivery metadata is retained for up to 30 days. Turning off Feed notifications, or revoking iOS permission, removes the delivery address when the app next observes the change. Signing out prevents further delivery for that session. Delivery addresses for abandoned sessions expire after 90 days; account deletion removes push addresses and account delivery metadata synchronously. Previously delivered notifications may remain on the device under iOS controls.

We do not retain personal data beyond a clear business need.

7. Where data is stored and how it is protected

All data is stored on secure cloud infrastructure, in a SQLite database (with a Postgres backend available as an alternative). Protection measures (full detail in security_overview.md):

In transit: all traffic is encrypted with TLS via Let's Encrypt (certificates auto-renew). (Implemented.)
At rest: application-layer encryption of PII fields (email, name, address) and encrypted database backups. (In progress.)
Access control: access is limited to the business owner and the development function only — the smallest possible footprint — protected by strong passwords. Access to personal data is logged. (Access logging: in progress.)
Environment isolation: production (port 8090), a separate staging environment (port 8091), and a separate Shopify development store are kept apart; production data is not used in test environments.

8. International transfers

Data is hosted in the EU. Where a sub-processor (e.g. an LLM provider) may process data outside the EU, only non-identifying aggregated context is sent, and we rely on the sub-processor's standard contractual clauses / equivalent safeguards.

9. Your rights

End customers (data subjects) have the right to access, rectify, erase, restrict, and port their personal data, and to object to processing, under GDPR; and the rights to know, delete, correct, and opt out of "sale" (we do not sell) under CCPA/CPRA. Because the merchant is the controller, end-customer requests should be directed to the merchant. TrackTrack will assist the merchant in fulfilling these requests, including through the Shopify customers/data_request and customers/redact flows.

Merchants may request access to, correction of, or deletion of their data, and may uninstall the app at any time to trigger deletion (Section 6).

To exercise any right, contact contact@tracktrackapp.com. We respond within the timeframes required by applicable law (without undue delay, and within one month under GDPR).

10. Changes to this policy

We will update this policy as our practices evolve and revise the "Last updated" date. Items marked (in progress) reflect controls being actively implemented; we will update their status here as they are completed rather than overstating current capability.

11. Contact

TrackTrack — contact@tracktrackapp.com — https://app.tracktrackapp.com