Privacy Policy

How we handle your data — clearly, in plain English.

tr8ck ("we", "us", "our") is committed to protecting your health data. This policy explains what we collect, why, and how you can control it.

1. What we collect

Account data

When you create an account, we collect your email address and the date you joined. We do not require your real name.

Health tracking data

tr8ck stores the health data you log — including weight, sleep, mood, nutrition, exercise, water intake, medication, and other tracked metrics. This data is stored securely and associated with your account.

Usage data

We collect product analytics about how the app is used (which features are opened, session duration, navigation events). This analytics data is tied to your account so we can understand how individual users experience the app and fix problems. It is kept separate from your health logs and is never sold or used for advertising. See the PostHog entry in section 4 for details.

2. How we use your data

• To provide the tr8ck service — storing and displaying your health logs
• To generate AI-powered correlations and insights from your own data
• To send you product updates and reminders (you can opt out at any time)
• To improve the product — analysing account-level usage data (see PostHog in section 4)

We do not sell your personal data. We do not share your health data with advertisers, insurers, or third-party data brokers.

3. Health data (Health Connect & Apple Health)

With your permission, tr8ck reads health data from your device's health platform — Health Connect on Android and Apple Health (HealthKit) on iOS — so you don't have to log everything by hand.

Data types we read

tr8ck requests read-only access to the following data types: steps, active calories burned, weight, exercise (workouts), and sleep. We only request the types relevant to the features you use, and you grant or revoke each permission through Health Connect at any time.

Read and write access

On Android, our Health Connect access is read-only — we never write, modify, or delete your data. On iOS, tr8ck also writes your body weight back to Apple Health when you log or update it in the app; all other health data types are read-only.

How this data is used

Health data read from these platforms is shown to you inside tr8ck, used to populate your logs automatically, and used to generate correlations and AI-powered insights from your own data (see section 4). It is synced to tr8ck's servers (Supabase, see section 5) so your data is available across your devices, and may be processed by our AI subprocessors (Z.ai / GLM models) when you have enabled AI features and given consent.

Retention, selling, and advertising

Health data is retained for as long as your account is active and is deleted when you delete the relevant logs or your account (see section 6). We do not sell health data, and we do not use it for advertising or share it with advertisers, insurers, or data brokers. Data read via Health Connect is handled in line with Google's Health Connect requirements, and data read via HealthKit is handled in line with Apple's HealthKit requirements — health data is never used for advertising or shared with third parties for their own purposes.

4. Third-party AI services

tr8ck uses third-party AI services to power features such as nutrition analysis, blood result extraction, health recommendations, voice logging, and personalised insights. Before these features are activated, we ask for your explicit permission inside the app.

Z.ai (GLM models)

Provider: Z.ai (operated by Zhipu AI)
Purpose: Text and image analysis for nutrition tracking (meal photos, food descriptions), blood test result extraction from lab report images, daily and weekly health recommendations, recipe suggestions, voice command parsing, and in-app chat.
Data sent: Health metrics you have logged (weight, sleep, mood, calories, exercise, GLP-1 medication details, menstrual cycle data), meal photos, blood test images or PDFs, voice transcripts, and your first name for personalisation.
Data protection: Z.ai processes data solely to return results to tr8ck. Data is not retained by Z.ai for training purposes beyond their standard API terms.

OpenAI (Whisper)

Provider: OpenAI, L.L.C. (United States)
Purpose: Transcribing voice recordings into text for voice logging features.
Data sent: Audio recordings captured during voice log sessions, plus a language preference code. No health metrics are included in the transcription request.
Data protection: OpenAI processes audio to return a transcript and does not use API data to train models by default. See OpenAI's Privacy Policy for full details.

PostHog (product analytics)

Provider: PostHog, Inc. (United States)
Purpose: Product analytics — understanding which features are used, session duration, and navigation flows so we can improve the app.
Data sent: Usage and interaction events, plus your account identifier and basic account traits. PostHog runs in identified mode, meaning analytics events are tied to your account rather than anonymous. We do not send your health logs, meal photos, or blood test data to PostHog.
Data protection: Analytics data is used only to improve the product and is never sold or used for advertising. See PostHog's Privacy Policy for full details.

Stripe (payment processing)

Provider: Stripe, Inc. (United States)
Purpose: Processing subscription payments and managing billing.
Data sent: Your email address, payment and billing details you enter at checkout, and subscription status. Card details are handled directly by Stripe — tr8ck never stores your full card number. We do not send your health data to Stripe.
Data protection: Stripe processes payment data as an independent controller for fraud prevention and compliance. See Stripe's Privacy Policy for full details.

Withdrawing AI consent

You can withdraw your consent to AI data sharing at any time from Settings → Privacy → AI Features. If you decline or withdraw consent, AI-powered features will be disabled and no data will be sent to the above providers. Core logging features continue to work without AI.

5. Data storage and security

Your data is stored on secure servers provided by Supabase (based in the EU). All data is encrypted in transit (TLS) and at rest. We use role-based access controls to ensure only your account can access your health data.

International transfers. While your primary data is stored in the EU, some of the subprocessors described in section 4 are based in the United States (PostHog, OpenAI, and Stripe). When data is sent to these providers, it is transferred to and processed in the US under appropriate safeguards (such as Standard Contractual Clauses). PostHog is configured on its US host by default.

6. Your rights (GDPR / CCPA)

• Access — you can export all your data at any time from your account settings
• Deletion — you can delete your account and all associated data at any time
• Correction — you can edit or delete any log entry
• Portability — data exports are available in CSV format
• Objection — you can opt out of non-essential communications at any time

7. Cookies

tr8ck uses a single session cookie to keep you logged in. We do not use advertising cookies or third-party advertising trackers. Our product analytics (PostHog) identify your account but are used only to improve the app, never for advertising.

8. Children

tr8ck is not intended for users under 16 years of age. We do not knowingly collect data from minors.

9. Changes to this policy

We will notify you by email if we make material changes to how we handle your data. The date at the top of this page reflects the last update.

10. Contact

Questions about your data? Email us at privacy@tr8ck.app and we'll respond within 48 hours.

Terms of Service

By using tr8ck, you agree to these terms. tr8ck is provided as-is. We reserve the right to update these terms; significant changes will be communicated via email.

tr8ck is not a medical device and does not provide medical advice. Always consult a qualified healthcare provider before making changes to your health regime.

You retain ownership of all data you log in tr8ck. You may export or delete your data at any time.