Legal

Privacy Policy

Draft for legal review. Written for what Tracky, its website and its servers actually do (checked against the code on 22 October 2026). Have a Romanian lawyer (GDPR) check it, fill in the company details, then remove this box. Text in [brackets] is still open.

Last updated: 29 October 2026

This policy explains what personal data Tracky (the desktop app), trackyapp.gg (the website) and Tracky's servers process, why, for how long, and what you can do about it. We have kept it as short as the facts allow. We don't sell personal data, we don't build advertising profiles, and the website uses no cookies and no analytics.

1. Who is responsible

The controller of your personal data is [company name: to be filled in], a company registered in Romania, registered office [registered office: to be filled in], Trade Register no. [Trade Register number: to be filled in], fiscal code [fiscal code (CUI): to be filled in] ("we", "us"). Contact for anything about your data: support@trackyapp.gg.

When you buy a paid plan, the sale itself is handled by Stripe through its "Link" service, which acts as the merchant of record (you see "Sold through Link" and "LINK.COM*" on your statement). Stripe decides how it uses the payment data it collects and is responsible for it under its own privacy policy (stripe.com/privacy, link.com/privacy).

2. What Tracky keeps on your own PC only

Your settings, profiles, timers, the pictures and sounds you add, your banked ad-free days, the last sponsor ad shown and the "room log" (a text file of what happened in shared rooms, for your own bug reports) are stored on your PC only - in the Windows registry and in %APPDATA%\.Trackyapp. We never receive them. "Delete ALL app data" in Tracky's Settings removes them (the licence activation on that PC stays until you deactivate it).

Tracky does not read anything from the games you play: every timer starts because you clicked it or pressed a hotkey.

3. What we process, why, and for how long

WhenWhatWhy (legal basis)How long
You visit trackyapp.gg Your IP address, browser type and the page you asked for, in the hosting provider's logs (Cloudflare). The site sets no cookies, has no analytics and loads nothing from other companies (fonts included). To deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). As long as the hosting provider keeps its logs [check Cloudflare's current log retention].
You buy a paid plan From Stripe we receive: your email address, the plan, the payment and subscription status and dates, and Stripe's reference numbers. We never see your card or bank details. We then create a licence key for you. To deliver what you bought and to keep it working (contract, Art. 6(1)(b)); to keep business records (legal obligation, Art. 6(1)(c)). While your licence exists, then [5] years for accounting and legal claims [lawyer / accountant to confirm].
You activate Tracky on a PC Your licence key, a random install ID that Tracky creates on that PC (not a hardware fingerprint), and the PC's name as set in Windows (for example "ALEX-PC"), so you can recognise your PCs on the account page. Also when it was activated and last checked. To enforce the device limit of your licence and let you manage your PCs (contract). Until you deactivate that PC (in Tracky or on the account page); the licence record as above.
Tracky checks your licence Your licence key and install ID, sent when Tracky starts and every 2 hours while it runs; your IP address reaches our server. To keep the paid version working and stop unpaid or shared use (contract; legitimate interest). The "last checked" time is updated at most once an hour. IP addresses: only in short-lived rate limits in memory, and in the hosting provider's logs.
You use the account page Your email address, to send you a one-time sign-in link. The link and the session are stored only as a scrambled (hashed) value. Contract. Sign-in links: 20 minutes; sessions: 30 minutes.
We email you Your email address and the email's content (your licence key, a sign-in link). Receipts, invoices and renewal notices come from Stripe / Link, not from us. Contract. As above; the email provider keeps delivery logs [check Resend's retention].
You use shared rooms (paid) The name you choose for rooms; your licence key and install ID (to check that the licence is paid - asked again about once an hour while you are connected); your IP address (for abuse limits; shortened to its first part in logs); the room's timers and its room profile (timer names, layout and settings of the room - no files, pictures or paths); your member number in the room. If the room's owner removes you, your member number and a scrambled (hashed) form of your licence key + install ID are kept with the room so that you have to ask the owner before joining it again. To provide the feature you asked for (contract); to keep it safe (legitimate interest). Rooms exist only in the server's memory: gone when everybody has left (after at most 30 minutes offline) or when the server restarts. A room's member list (signed) is also kept by the Tracky apps of its members, on their PCs. Abuse counters: at most 1 hour.
The free version shows a sponsor's ad Tracky downloads the current ad from our server (your IP address reaches it). When the ad is shown or clicked, Tracky sends only the ad's number and "view" or "click". To stop one address from inflating the numbers, the server keeps a scrambled form of the address in memory until the end of the day. Sponsors get only totals per day. Clicking an ad opens the sponsor's website in your browser; from then on the sponsor's own privacy policy applies. To show the ads that pay for the free version and to count them honestly (legitimate interest). No personalisation, no tracking across sites, nothing stored on your PC for advertising other than the ad itself. Daily totals: kept. The scrambled addresses: until the end of the day, in memory only.
We change a licence by hand (for example after a refund request) A record of what was done, when, the licence key, your email address and the reason. To keep a record of our decisions about your licence (legitimate interest; legal claims). As long as the licence record.
You write to support or apply as a creator Whatever you send us: your email address, name, message, attachments. To answer you (contract or legitimate interest). [2] years after the conversation ends, unless needed longer for a legal claim.
"Check for updates" in Tracky Your IP address reaches our server; nothing else is sent. Legitimate interest. Not stored by us beyond short-lived rate limits.

4. Who else processes it (our service providers)

We use these companies to run Tracky. They process data only on our instructions (as our processors), except Stripe, which is responsible for the payment data it collects:

  • Render - runs our licence server and the shared-rooms server [server region].
  • Neon - hosts the licence database [database region].
  • Resend - sends our emails.
  • Cloudflare - hosts the website and is the network provider in front of our servers.
  • Stripe / Link - payments, as merchant of record (see section 1).
  • [the provider of the support@ mailbox]

Some of them are based in, or reach data from, the United States. Where data leaves the European Economic Area, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses [lawyer: confirm per provider].

We share data with authorities only when the law requires it.

5. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict its use, to receive it in a portable format, and you can object to processing based on our legitimate interest. Write to support@trackyapp.gg from the address you bought with (or with your licence key), so we can check it is you. We answer within one month.

Deleting your data ends your licence's link to you: if you still have a paid plan, tell us whether to cancel it first. Data Stripe holds about your payment is deleted by Stripe / Link on request (support.link.com).

You can also complain to a data protection authority. In Romania: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), www.dataprotection.ro; or the authority of the EU country where you live or work.

6. Children

Tracky is not meant for children under 16, and buying a paid plan requires being of age or a parent's or guardian's consent (see the Terms). We don't knowingly collect data about children under 16; if you think we have, write to us and we will delete it.

7. Security

Connections to our servers are encrypted (HTTPS / WSS). Sign-in links and sessions are stored only as hashes, licence keys never appear in our logs in full, and access to our systems is limited and protected with two-factor login. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

8. Changes

When this policy changes, we update the date at the top. If a change matters for how we use your data, we will also tell you in Tracky or by email before it takes effect.

9. Contact

[company name: to be filled in], [registered office: to be filled in] · support@trackyapp.gg