Privacy Policy

Trackr · Last updated: October 29, 2026

This Privacy Policy describes how the Trackr application collects, uses, stores, and protects your personal data. We take the Brazilian General Data Protection Law (Lei nº 13.709/2018 — LGPD) seriously and want you to understand exactly what happens with your information.

1. Data Controller

The controller of personal data collected by Trackr is Bruno Mota Malaquias de Almeida, an individual established in Lauro de Freitas, Bahia, Brazil.

Contact for privacy matters: trackrfit@gmail.com

2. Data We Collect

2.1 Account data

You can start using Trackr as a guest, without an email address. In that case we create an anonymous identifier to store your workouts. If you later create an account, we collect:

• Display name
• Email address
• Password (stored as a cryptographic hash; never accessible in plain text)

When you create an account, the workouts you recorded as a guest become part of it.

2.2 Strength training data

• Exercises performed, muscle groups, weights, reps, sets
• Rep execution velocity (captured by the Trackr Bluetooth Low Energy hardware sensor)
• Total session duration and timestamp
• Calculated metrics (intensity score, achievements, sets taken to the limit)
• The Trackr sensor used for each exercise (e.g. "Trackr-07") and, from it, the equipment and gym where the exercise was performed

When you tap your phone on a Trackr sensor, the app reads only that sensor's address from the NFC tag. None of your data is written to the sensor or the tag.

2.3 Share card photos

When you share a workout, you can pick a photo from your gallery or take one to use as the card background. That photo is processed only on your device and is not sent to our servers. The finished card leaves your device only if you choose to share it (for example, on Instagram).

2.4 App usage data

• App usage timestamps

2.5 What we do NOT collect

• Geographic location (GPS)
• Phone contacts
• Messages, personal photos, or files from your device (the photo you pick for a share card stays on your device)
• Financial or payment data
• Data from other applications on your device

3. How We Use Your Data

• App functionality: displaying your workout history, calculating progress metrics, syncing data between devices
• Intensity and performance metrics: deriving indicators such as session intensity and achievements from data you generated
• Social features: letting you share workouts to social networks and take part in rankings and challenges with other users
• Partner gyms: producing equipment usage statistics for the gym where the sensor is installed
• Product improvement: understanding which features work well and which need adjustment
• User support: answering questions and resolving technical issues

4. Legal Basis for Processing

We process your personal data under the following legal bases provided by the LGPD (Art. 7):

• Contract performance (Art. 7, V): for account data and workout data necessary for the basic functioning of the service you engaged by installing and using the app.
• Legitimate interest (Art. 7, IX): for aggregated and anonymous analyses to improve the product, without exposing your identity.

5. Third-Party Sharing

We share strictly necessary data with service providers that enable the app to function:

• Supabase Inc. (United States): database and file storage provider. Acts as a data processor under the LGPD. Your data is transmitted over an encrypted connection (HTTPS/TLS) and stored on servers with industry-standard security. Supabase privacy policy: https://supabase.com/privacy

In addition:

• Other Trackr users: your display name and workout metrics may be shown to other users in rankings, challenges, and social features of the app. Your email is never shown.
• Partner gyms: the gym where a sensor is installed may see equipment usage statistics (for example, how many sets and reps were done on each machine), without your name or email.

We do not sell, rent, or transfer your personal data to third parties for marketing purposes.

6. International Data Transfer

Supabase servers are located in the United States. The international transfer of your data is authorized by Art. 33, IX, together with Art. 7, V of the LGPD (necessary for the performance of the contract to use the app). Supabase maintains adequate technical and organizational security measures to protect your data.

7. Data Retention

• While your account is active: we keep all data necessary for the app to function.
• After account deletion: identifiable personal data is deleted within 30 days. Aggregated and anonymized data (without any link to you) may be kept for statistical purposes of product improvement.
• Legal obligations: some data may be retained for longer periods when required by law (for example, minimum records for 6 months under the Brazilian Internet Civil Framework).

8. Your Rights as a Data Subject

The LGPD grants you the following rights (Art. 18):

• Confirm the existence of processing of your data
• Access your data
• Correct incomplete, inaccurate, or outdated data
• Request anonymization, blocking, or deletion of unnecessary or improperly processed data
• Request data portability in a structured format (JSON)
• Request deletion of data processed based on consent
• Obtain information about entities with whom your data is shared
• Be informed about the possibility of not providing consent and its consequences

How to exercise your rights

Within the Trackr app, in your Profile, you'll find direct options to:

• Delete my account: removes your account and all associated data within 30 days
• Export my data: download a JSON file with everything we have collected about you

For other requests, email trackrfit@gmail.com. We respond within 15 days.

9. Data Security

We adopt technical and organizational measures to protect your data:

• Data transmission over encrypted connection (HTTPS/TLS)
• Passwords stored with cryptographic hash (never in plain text)
• Row-Level Security in the database: each user can only modify their own data, and account information (such as email) is not visible to other users
• Local device storage isolated by operating system sandbox

No system is 100% secure. In case of a security incident that may pose a relevant risk to the rights of data subjects, we will notify the Brazilian National Data Protection Authority (ANPD) and affected data subjects as per Art. 48 of the LGPD.

10. Cookies and Analytics

The Trackr app does not use cookies, third-party analytics tools (Google Analytics, Firebase Analytics, etc.), or advertising trackers. We do not build behavioral profiles for advertising purposes.

11. Children and Teenagers

Trackr is intended for users aged 18 and over. We do not intentionally collect data from minors under 18. If you are a legal guardian of a teenager and suspect their data has been collected, contact us at the email above so we can delete it immediately.

We are working on features to include users aged 13 and over with appropriate parental consent under Art. 14 of the LGPD. We will update this policy when those features are available.

12. Changes to This Policy

We may update this Privacy Policy occasionally to reflect changes in the product or legislation. The last update date appears at the top of this document. Relevant changes will be notified in the app itself before taking effect.

13. Contact

Questions, requests, or complaints related to this policy:

• Email: trackrfit@gmail.com
• Data controller: Bruno Mota Malaquias de Almeida
• City: Lauro de Freitas, Bahia, Brazil

If you believe the way we process your data is not in compliance with the LGPD and cannot resolve it through direct contact, you may file a complaint with the Brazilian National Data Protection Authority (ANPD): https://www.gov.br/anpd

→ Terms of Use