Privacy Policy

This Privacy Policy describes how Trackwise (“Trackwise,” “we,” “us,” or “our”) handles information when you use the Trackwise mobile application and the public website at trackwise.one.

Trackwise provides everyday nutrition and fitness tracking. Calorie and activity values shown in the product are estimates and are not medical measurements.

The operator of Trackwise is Trackwise. This policy is effective as of 3 November 2026.

Depending on how you use Trackwise, we may process:

Account credentials and authentication data (for example email address used for sign-in, and authentication tokens managed by our auth provider).

Profile information you provide (such as display name, height, sex, birth date, activity level, preferred units, appearance preferences, language, and optional avatar image URL).

Nutrition and fitness records you create (food entries, custom foods, workouts, workout sets, templates, favorites, goals, onboarding/setup progress, and body measurements).

Optional images you upload (food photos, profile avatars, or custom exercise images) when image upload is configured.

Product lookup requests when you scan barcodes (Trackwise may query Open Food Facts to retrieve product nutrition information).

Technical and diagnostic information needed to operate and improve the service, including device and app version details, performance metrics, crash and error reports, and limited usage events that help us understand feature reliability. This may include data processed by our infrastructure providers and, when enabled, crash-reporting or analytics tooling.

Information collected by app-store platforms (Google Play / Apple) under their own privacy policies when you download or update Trackwise.

We use information to provide and maintain Trackwise features: authentication, syncing your diary and workouts, calculating estimates against your goals, showing progress, and supporting account controls such as export and deletion.

We use diagnostics, crash reports, and limited analytics to keep the app stable, investigate bugs, measure reliability, and improve product quality.

We may use contact details you provide (email or phone) to respond to support or privacy requests.

We do not use your nutrition or workout data to provide medical diagnosis or treatment.

Where the EU GDPR / UK GDPR applies, we rely on one or more of the following legal bases: performance of a contract (providing the account and tracking features you request); legitimate interests (securing the service, preventing abuse, and improving reliability in ways that do not override your rights); and consent where required (for example certain optional processing or device permissions).

Account authentication is provided through Supabase Auth. You may sign in with email and password (including email verification and recovery codes) or with supported social providers such as Google when enabled for your environment.

Profile fields are stored in our database and associated with your authenticated user identity. Access to user-owned profile data is protected with Row Level Security (RLS) so that other users cannot read or modify your private records.

Food diary entries, custom foods, goals, workouts, templates, exercise favorites, and related records are stored in Supabase Postgres and scoped to your account through RLS policies.

Shared catalog content (for example system foods or system exercises) may be readable by authenticated users as part of the product catalog, separate from your private logs.

Barcode scanning may contact Open Food Facts to retrieve product information. Matched products may be saved as foods linked to your account when you confirm and log them.

If image upload is configured, optional photos for foods, avatars, or custom exercises may be uploaded to Cloudinary using an unsigned upload preset operated for Trackwise. The app stores the resulting HTTPS URL with your record.

Client-side size limits apply (currently 1 MB for user image uploads in the mobile app).

Cloudinary processes image files as a service provider for Trackwise. Retention of image objects follows Cloudinary account settings and Trackwise deletion flows when you remove content or delete your account.

Primary application data is stored using Supabase (authentication, Postgres database, and related backend services, including Edge Functions used for sensitive operations such as account deletion).

System exercise images may be served from Supabase Storage. Optional user images may be stored with Cloudinary when configured.

Hosting regions and backups follow the production configuration of these providers for the Trackwise project. Subprocessors currently used to operate the service include Supabase (auth, database, storage, functions), Cloudinary (optional user image hosting), and Open Food Facts (barcode product lookup you initiate). App-store platforms and device OS vendors may also process data under their policies.

We do not sell your personal information.

We share data with service providers only as needed to operate Trackwise (for example auth/database hosting, optional image hosting, diagnostics/crash tooling when enabled, and Open Food Facts lookups you initiate by scanning).

We may disclose information if required by law or to protect the rights, safety, and integrity of users and the service, where legally permitted.

Trackwise does not operate an affiliate or partner-coach marketplace. We do not share your private diary or workout data with third-party coaches through the product.

We retain account and tracking data while your account remains active so the product can sync and display your history.

You may export a backup, delete account data while keeping a login, or delete your account through in-app controls. Account deletion is processed through a server-side delete-account function.

After a verified deletion request, we remove or anonymize active account data from production systems without undue delay. Residual copies in encrypted backups or logs are purged according to provider backup cycles, typically within 30 to 90 days, except where a longer retention is required by law or for security investigations.

We use industry-standard provider protections, including encrypted transport (HTTPS) and database access controls with Row Level Security for user-owned data.

Access to operator tooling is limited to authorized personnel. No method of transmission or storage is 100% secure. Please use a strong password and protect access to your devices.

Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete personal data, and to withdraw consent where processing is consent-based.

Trackwise provides in-app export, data deletion, and account deletion tools to help you exercise these controls. You may also email ha.dh290702@gmail.com (or call 0466522707) to submit a privacy request. We may need to verify your identity before fulfilling certain requests.

European Economic Area and United Kingdom (GDPR / UK GDPR): you may have the rights listed above and the right to lodge a complaint with your local supervisory authority. Where we rely on legitimate interests, you may object to that processing. Where we rely on consent, you may withdraw consent at any time without affecting prior lawful processing.

California and other US state privacy laws (including CCPA/CPRA where applicable): you may have rights to know/access, delete, correct, and opt out of “sale” or “sharing” of personal information as those terms are defined by law. Trackwise does not sell personal information for money. If we use advertising or cross-context analytics that qualify as “sharing” under California law, you may opt out by contacting us. We will not discriminate against you for exercising privacy rights.

We respond to verifiable consumer requests within the timeframes required by applicable law (generally within 30 to 45 days, with permitted extensions when needed).

Trackwise is not directed to children under 13 (or the higher age required in your country, such as 16 in some EU member states where applicable). During setup, safety prompts may route some users toward manual calorie targets rather than automated estimates.

We do not knowingly collect personal information from children below the applicable minimum age. If you believe a child has created an account, contact us and we will take appropriate steps to delete the information.

Your information may be processed in countries where our service providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider’s approved transfer mechanisms.

We may update this Privacy Policy as the product or legal requirements change. The updated version will be posted on this page with a revised effective date.

For material changes, we will provide additional notice where appropriate (for example an in-app notice or email to your account address).

Privacy and data-protection requests for Trackwise:

Operator: Trackwise

Email: ha.dh290702@gmail.com

Phone: 0466522707

Website: https://trackwise.one