Privacy Policy

What we collect

• Account information: name, email address, a hashed password (we never store your password itself), and an optional gender field. Gender is used only to decide whether the period-tracking feature is shown to your account — it isn't used for anything else.
• Activity and plan data: the activities you create (name, optional description/icon), your daily done/skipped logs for them, and any plans you group activities into.
• Expense data: amounts, categories, optional notes, and dates for expenses you log.
• Period-tracking data, if you use that feature: cycle start/end dates and any notes you add. This is health-related data — we treat it with the same handling as everything else described here, but we call it out separately because of its sensitivity.
• Registration requests: if you request access, we temporarily store your name, email, a hashed password, and gender until a superadmin approves or rejects the request (see “How accounts are created” below).

How accounts are created

mytrax doesn't have open self-signup. New accounts start as a registration request that a superadmin manually reviews and approves or rejects — this is why a new signup shows “request submitted, awaiting approval” rather than immediate access. We mention this here because it directly affects when your account information moves from a pending request into an actual account record.

Where it's stored

All of the above is stored in a MongoDB Atlas database (a cloud-hosted, managed database service), accessed only through mytrax's own backend API. We don't use a separate analytics database or data warehouse — the data described above is the only data mytrax holds about you.

Who can see it

Only you can see your own activities, plans, expenses, and period-tracking data through the normal app. The exception: superadmins (the people who run this app) have a read-only admin view that can look up any account's dashboard, activities, and plans — this is used for support and for approving/rejecting registration requests, not for any other purpose. Superadmins cannot edit or delete another user's activity/plan/expense data through that view.

Third parties

We do not sell your data, and we do not share it with third parties for advertising or marketing. The one exception is transactional email: we use Resend to send account-related emails (registration approval/rejection notices). Resend processes your name and email address solely to deliver those messages on our behalf.

Data retention & deletion

We keep your data for as long as your account exists. You can permanently delete your account and everything associated with it at any time:

• In the mobile app: More → Delete my account. You'll be asked to re-enter your password and confirm — this is a safeguard against accidental deletion, since the action is immediate and irreversible.
• Deleting your account removes your user record along with every activity, activity log, plan, expense, and period cycle tied to it. This is a hard delete, not a soft-delete or anonymization — once confirmed, the data is gone from our database, not just hidden from the app.

Children's privacy

mytrax is not directed at children, and we don't knowingly collect data from anyone under 13.

Changes to this policy

If what mytrax collects or how it's used changes, this page will be updated and the “Last updated” date above will reflect that.

Contact

Questions about this policy or a data deletion request that isn't working as expected: [add a support email here].