This policy explains what personal data TrackJar collects, why, who sees it, how long we keep it and what control you have. We keep it as simple as we can. The short version: we collect only what is needed to run the trackers you choose, we do not sell your data, we do not show ads, and you can download or delete everything yourself at any time.
1. Who we are
TrackJar is run by Viraj Madhushan, Colombo, Sri Lanka (“we”, “us”). We are the controller of your personal data. Contact: viraj.madhu1@gmail.com.
2. What we collect
Account data
- Your name and email address.
- A password hash (we never store your password itself).
- Your settings: timezone, default currency, theme, which trackers you enabled, notification preferences.
- When you verified your email, and which version of the Terms you accepted and when.
What you track
Everything you enter into the trackers you use, which can include:
- Project time: organizations, projects, time entries and descriptions.
- Money: income and expenses with amounts, dates, categories, payers or vendors, invoice references and notes.
- Calories: foods you log, calories, optional protein/carbs/fat, and your daily goal.
- The notifications we send you in the app.
Food and calorie logs can reveal information about your health. We use them only to provide the feature to you. They are never used for profiling, advertising or sharing. You choose what to enter, and you can leave the Calories tracker switched off.
Technical data
- Your IP address, used for a short time to limit repeated sign-in, sign-up and similar requests (abuse protection). These counters are deleted automatically within about an hour.
- Standard server logs kept by our hosting provider for security and troubleshooting.
We do not use analytics, advertising or tracking tools.
3. Why we use it, and our legal basis
- To provide the service you asked for (create your account, store and show your records, send verification and password-reset emails). Basis: performing our contract with you.
- To keep the service secure (rate limiting, preventing abuse, fixing faults). Basis: our legitimate interest in a safe service.
- To send notifications you can control (for example a timer left running). In-app alerts and any emails follow your settings in Settings → Notifications. Account emails such as verification are part of the service.
- To meet legal obligations where they apply.
4. Cookies and local storage
We use one cookie, a strictly necessary sign-in cookie (“tj_session”) that keeps you logged in for up to 30 days. It is essential for the service, so no consent banner is needed. Your browser's local storage may hold small preferences, such as your theme and whether you dismissed the “install app” banner. If you install TrackJar as an app, your browser may keep static files (icons, scripts) for faster loading; we do not cache your personal data for offline use.
5. Who we share data with
We do not sell your data. We use a few service providers (processors) who handle data only on our instructions:
- MongoDB Atlas: database hosting. Your data is stored in: Mumbai, India.
- Vercel: application hosting and delivery.
- Brevo: sends our emails (verification, password reset, notifications you enabled). It receives your email address, name and the message.
We may also disclose data if the law requires it or to protect people's safety or our legal rights.
6. International transfers
Our providers may process data in countries other than yours. Where personal data leaves your region (for example the EEA or UK), we rely on appropriate safeguards such as the providers' standard contractual clauses.
7. How long we keep data
- Your account and tracker data: until you delete it or your account.
- In-app notifications: automatically deleted after 90 days.
- Verification and password-reset tokens: expire within 24 hours and 1 hour.
- Abuse-protection counters: about an hour.
- When you delete your account, your data is removed from our live database immediately. Encrypted backups kept by our database provider can contain it for a limited time (up to 7 days) before they are overwritten.
8. Your rights
Depending on where you live (for example under the GDPR or UK GDPR), you can:
- Access and take your data with you: Settings → Account & data → “Download my data” gives you everything we hold as a JSON file.
- Correct it: you can edit your profile and any record in the app.
- Delete it: Settings → Account & data → “Delete account” permanently deletes your account and all your data.
- Object to or restrict some processing, or withdraw consent where we rely on it, by contacting us.
- Complain to your local data-protection authority.
To use a right we cannot offer in the app, email viraj.madhu1@gmail.com. We will reply within one month.
9. Security
Passwords are stored only as salted hashes. Connections use HTTPS. Each account can only reach its own data, sign-in attempts are rate limited, and sessions end when you change your password. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
10. Children
TrackJar is not for anyone under 16. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
If we change this policy in a way that matters, we will update the date above and tell you in the app or by email. The current version is always at /privacy.
12. Contact
Questions about privacy: viraj.madhu1@gmail.com · Viraj Madhushan, Colombo, Sri Lanka. See also our Terms of Service.