Track & Travel — Privacy Policy

Effective Date: December 8, 2025

Last Updated: September 24, 2026

NYX KNIGHT, sole proprietor (“we”, “us”, “our”) operates the Track & Travel mobile application (the “App”). This Privacy Policy governs how we collect, use, share, secure, and delete personal data, including under India’s Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, the GDPR (EU/UK), and CCPA/CPRA (California). Contact: track.and.travel.app.support@gmail.com. Address: Hyderabad, Telangana, India.

We minimize data, keep camera OCR on the device, and do not sell personal data for money. Track & Travel provides currency conversion, on-device price-tag scanning, trips and expenses, a world map of saved places, an ad-supported free tier with time-limited credits, and optional premium access. Sign-in and cloud backup are optional.

1. Information We Collect

We collect only what is needed to provide the service. We do not collect biometrics, health records, or payment card data.

- Authentication (optional): email, name, and profile image from Google or Apple sign-in (via Supabase Auth). You can use conversion and scanning without an account.

- Preferences: language and currency selections stored on the device.

- Cloud-sync flag: whether you turned on “Store data on server” (Profile → Account). Default is off.

- Subscription metadata: status (free, active, lifetime, cancelled, expired, or refunded), product identifier (Monthly, Annual, or Lifetime), expiration date for recurring plans (none for Lifetime), RevenueCat customer identifier bound to your account when signed in, store (App Store or Play Store), and related webhook event metadata. Apple and Google process card and wallet payments. We never receive full card numbers.

- Saved locations (local always; cloud only if you enable sync): coordinates you pin (latitude and longitude). We do not store place names as a separate field.

- Trips and expenses (local always; cloud only if you enable sync): trip name, destination country (code, name, flag, currency), budget, expense amount, currency, country, date, category, payment method (cash or card), and optional notes. “Card” here is a category you choose; we do not collect bank or card numbers.

- Device and app data: device model, OS version, app version, connectivity status, and IP address as processed by our backend (Supabase) for rate limiting on public exchange-rate requests and for security and delivery.

- Ads (Google Mobile Ads SDK, with Unity Ads as a mediation partner): advertising and device/instance identifiers, coarse location where the ad SDK obtains it, and interaction events needed to serve rewarded ads. We do not force non-personalized ads only; the SDK may serve personalized ads according to Google, Unity, and your device advertising settings.

- On-device OCR: camera frames and recognized text are processed locally to read prices. Images are not uploaded to our servers.

- Diagnostics: minimal crash or error context and request metadata needed to operate the service. We do not use a third-party analytics or crash-reporting SDK.

We do not collect contacts, messages, photo-library contents (outside the camera used for scanning), precise GPS except when you choose “use my location” to pick a nearby region, or browsing history. Microphone access is not requested.

2. How We Use Data

- Provide conversions, on-device OCR scanning, trips/expenses, and world-map pins.

- Authenticate optional sessions and, if you enable it, sync trips, expenses, and saved locations across devices (Supabase).

- Manage subscriptions and restore purchases (RevenueCat and the app stores).

- Enforce the access model: premium via Monthly, Annual, or Lifetime versus ad-supported free-tier credits (rewarded ads unlock a time-limited window for Trips and World View).

- Fetch and cache USD-based exchange rates (our servers call ExchangeRate-API; the App reads rates from our cache).

- Limit abuse (including IP-based rate limits on the public rates endpoint).

- Maintain security, debug issues, and respond to support or rights requests.

- Comply with legal obligations.

We do not use your trip notes or account email to sell mailing lists.

3. Legal Bases

- DPDP: consent for optional features (sign-in, cloud sync, camera, location, ads); legitimate use for service delivery, fraud prevention, and legal compliance.

- GDPR: contract necessity for core conversion features you request; legitimate interests (security, rate reliability, abuse prevention); consent where required (camera, location, optional account, advertising identifiers); legal obligations.

- CCPA/CPRA: we do not sell personal information for money. Rewarded ads via Google and mediated partners may involve “sharing” of device identifiers for cross-context advertising. You can limit this in device ad settings (for example, Opt out of Ads Personalization on Android or App Tracking / Personalized Ads controls on iOS). We honor Global Privacy Control and similar signals where we receive them and where the ad SDK supports them.

4. Sharing and Processors

No sale of personal data for money. Limited sharing with processors and advertising partners:

- Supabase (processor): authentication, profile metadata, optional cloud copies of trips/expenses/saved locations, subscription status on the profile, anonymized subscription-history rows after account deletion, and operational rate-limit records.

- RevenueCat (processor): subscription and entitlement metadata; no card data. We request deletion of the RevenueCat subscriber record when you delete your account.

- App stores (Google/Apple): billing and receipts per store terms; we do not receive card data.

- Google/Apple OAuth: account email, name, and avatar when you choose to sign in.

- Google Mobile Ads / AdMob and Unity Ads (mediation): rewarded ads for free-tier credits. These partners process advertising identifiers and related signals under their own policies.

- ExchangeRate-API (processor, server-side): our backend fetches public FX rates. This call uses our API credential, not your account email.

- Legal compliance: disclosures only when required by law or court order.

5. Storage, Security, Transfers

- Storage: language, currency, ad-credit timers, exchange-rate cache, and most trip/location data stay on the device (including encrypted local SQLite). Cloud copies exist only if you sign in and enable “Store data on server.” OCR frames remain on-device and are ephemeral.

- Security: TLS in transit; encryption at rest via platform and host services; least-privilege access; MFA for admin. Report issues to track.and.travel.app.support@gmail.com.

- Transfers: processors may process data in the EU, US, or other regions. We rely on Standard Contractual Clauses (GDPR) and DPDP-equivalent safeguards plus encryption where applicable.

6. Retention and Deletion

- Active use: data is kept while needed to provide the service.

- Deletion: if you have an account, delete it in the App (Profile → Account → Delete Account while signed in) or by verified email. Active account data is removed promptly; residual copies in backups or processor systems are cleared within 30 days; irreversible once completed. Subscription-history rows may be retained in anonymized form (account identifier removed) for fraud and accounting integrity.

- Without an account: uninstalling the App removes on-device data. We do not hold a cloud profile for unsigned-in use except aggregated rate-limit and rate-cache records that are not tied to your name.

- Temporary data: OCR artifacts are deleted immediately after a scan; ad-credit state is device-local.

- Legal holds: retained only if lawfully required, then deleted when the obligation ends.

Details are in the Delete Account notice.

7. Your Rights

You may request access, correction, deletion, restriction or objection (where applicable), portability, consent withdrawal, and nominee rights (DPDP). We respond within 30 days (extensions for complex cases). No fee unless requests are excessive.

- How to submit: use in-app deletion (Profile → Account → Delete Account) or email track.and.travel.app.support@gmail.com with subject “Privacy Rights Request - Track & Travel,” and include the account email used for Google or Apple sign-in (or a description of the device if you never signed in).

- Advertising opt-out: use your device advertising settings; premium plans do not show rewarded ads.

8. Children and Age

Because subscriptions, payments, and advertising are involved, the service is intended for adults (18+). Users under 18 require verifiable parental or guardian consent. We do not knowingly collect data from children under 13; if discovered, we delete it.

9. Changes to this Policy

Material changes (for example, new data uses) will be notified at least 30 days in advance via in-app notice or email (if available). Continued use after the effective date means acceptance. Historical versions are available on request.

10. Contact and Grievance

- Email: track.and.travel.app.support@gmail.com

- Address: Hyderabad, Telangana, India

- Escalation: DPDP Board (India), a relevant EU/UK supervisory authority, or the CPPA (California), as applicable.

We design Track & Travel to process as little data as possible while delivering the service.

© 2025–2026 NYX KNIGHT.