TrackIt Privacy Policy
TrackIt is a food and nutrition diary. This policy explains what the app
collects, why it needs it, who else sees it, and how to get rid of it. It
covers the website at
trackitapp.pro and the TrackIt Android
app (pro.trackitapp.app), which share one account and one
database.
1. Who is responsible
TrackIt is operated by Xplax. If you have a question about this policy, or want your data removed, contact trackitapp.pro@gmail.com.
2. What TrackIt collects
| What | Examples | Why |
|---|---|---|
| Account | Email address, display name, and the username you choose | To sign you in and keep your diary attached to you |
| Health & fitness | Food you log and its calories, macronutrients and micronutrients; weight; body fat and muscle mass if you enter them; water; fasting window; goals; streaks and achievements | This is the product. It is what the app shows you back |
| Photos you choose to scan | A photo of a meal, a receipt, a recipe card or your fridge | Read once to estimate what is in it. Not stored — see section 4 |
| Purchases | Subscription status and renewal dates for TrackIt Pro | To unlock Pro features. Card details never reach TrackIt |
| Diagnostics | Error messages, the first line of the stack trace, and the app version, recorded against your account | To find and fix crashes |
| Referrals | A referral code, and which account referred you | Only if you take part in the affiliate programme |
TrackIt has no advertising and no analytics or tracking SDK. Nothing is collected for advertising, and nothing is sold.
3. What other people can see
TrackIt has public profiles. If you set a username, a limited public copy of your profile is readable by other TrackIt users, containing only:
- your username,
- your logging streak,
- and the achievements you have earned.
Your food diary, your weight and biometrics, your goals and your subscription status are never part of that public copy.
4. Photos
When you scan a meal, a receipt, a recipe or your fridge, the image is resized on your device and sent to Google's Gemini API, which reads it and returns the foods and figures it can identify. TrackIt does not keep the photo. It is not written to our storage or database; only the resulting food entries are saved, and only when you choose to log them.
Illustrative meal images generated by AI for recipe suggestions are cached on our servers. Those are pictures the model draws, not pictures of you.
5. Who your data is shared with
TrackIt uses these services to work. Each sees only what it needs:
- Google Firebase (authentication, database, functions, storage, App Check) — hosts your account and diary.
- Google Gemini API — reads the words you type when logging food, and photos you choose to scan, to estimate nutrition.
- FatSecret and Open Food Facts — food and barcode databases. They receive the food or barcode being looked up, not your identity.
- Stripe — payments on the website. Stripe handles card details; TrackIt never sees them.
- Google Play Billing and RevenueCat — subscriptions in the Android app, and their status.
Data is not sold, rented, or shared with advertisers. It may be disclosed if the law requires it.
6. Where it is kept, and for how long
Your data is stored in Google Cloud (Firestore), in the United States. It is kept for as long as your account exists. Diagnostics are kept only as long as they are useful for fixing faults.
7. Deleting your data
You can delete your account from Settings → Delete Account in the app. This removes your profile, your diary, your goals and your public profile. It cannot be undone.
One thing is kept: if you joined with a friend's invite and received the invite reward, a one-way hash of your email address (a scrambled value that cannot be turned back into the address) is kept so the reward cannot be claimed again by deleting the account and signing up once more. It contains no other information about you.
If you have a Pro subscription, cancel it first — deleting the account does not by itself cancel a subscription billed by Google Play or Stripe.
You can also email trackitapp.pro@gmail.com to ask for a copy of your data or for it to be deleted.
8. Your rights
Depending on where you live — for example under the UK GDPR, the EU GDPR or the CCPA — you may have the right to see the data held about you, correct it, export it, delete it, or object to how it is used. Contact the address above and TrackIt will act on it.
The lawful basis for processing is the contract between you and TrackIt: the app cannot keep a food diary without storing the diary. Where health data is involved, it is processed on the basis of your explicit consent, given by choosing to enter it.
9. Children
TrackIt is not intended for children. Do not use it if you are under 16. Accounts found to belong to children will be deleted.
10. Security
Access is protected by Firebase Authentication and enforced by server-side security rules, so one account cannot read another's diary. App Check is used to make sure requests come from the real app. No system is perfectly secure, and TrackIt cannot promise it is.
11. Changes
If this policy changes materially, the date at the top will change and the app will say so. Continuing to use TrackIt after a change means you accept it.