Skip to content

Privacy Policy

Last updated October 16, 2026

TrackStack ("we", "us") is operated by Altuzar. This policy explains what we collect when you use the TrackStack website, web app and mobile apps (the "Service"), and what we collect about the visitors of websites that use TrackStack. Questions: hello@trackstack.altuzar.dev.

1. Two kinds of data

Customer data is information about you, the account holder: your email, name, sign-in method, subscription status, onboarding answers and settings. We are the controller of this data.

Visitor analytics data is information our tracking script collects on your websites. You are the controller of it and we process it on your behalf, only to provide the Service to you.

2. What the tracking script collects

  • The page URL, referrer, UTM parameters and custom goal names you choose to send.
  • Browser, operating system, device type and screen width, derived from the user agent.
  • Approximate location (country, region, city and coordinates rounded by our edge provider). IP addresses are used transiently to look up location and are never stored.
  • A random visitor ID and session ID, stored in first-party cookies, or in session storage when cookieless mode is on.

We do not use fingerprinting, do not build cross-site profiles, and do not sell or share visitor data for advertising. Revenue attribution links a payment to a visitor ID only when you pass that ID to your payment provider.

3. What we collect about you

  • Account details: email address, name, and the provider you sign in with (email link, password, Apple or Google).
  • Subscription details from Apple, Google and RevenueCat: product, status and renewal dates. We never receive your card number.
  • Payment provider keys you connect, such as a Stripe restricted key, encrypted at rest with AES-256-GCM.
  • Questions you ask the AI assistant and its answers, kept so you can see your history.
  • Push notification tokens, if you allow notifications.
  • Diagnostics needed to keep the Service working, such as error logs.

4. How we use it

To run the Service, authenticate you, process subscriptions, send sign-in codes and the notifications you turn on, answer support requests, prevent abuse, and meet legal obligations. Our legal bases under GDPR are contract, legitimate interests and, where required, consent.

5. Service providers

We share data only with providers that help us run TrackStack, under agreements that protect it:

  • Convex (database and backend hosting)
  • Netlify (website hosting and edge geolocation)
  • RevenueCat, Apple, Google and Stripe (subscriptions and billing)
  • Resend (sign-in and account emails)
  • Anthropic (answers to questions you ask the AI assistant, using aggregated statistics, not raw visitor records)
  • Expo (push notification delivery)

6. Retention

Visitor analytics data is kept for as long as your plan's retention period (3 years on Starter, 5 years on Growth) or until you delete the site. Customer data is kept while your account is open. When you delete your account in Settings, we delete your sites, analytics data, keys and messages, usually within 30 days, except records we must keep by law.

7. Your rights

Depending on where you live, you can access, correct, export or delete your data, object to or restrict processing, and withdraw consent. California residents have the rights described in the CCPA/CPRA; we do not sell or share personal information as those laws define it. Email us to exercise any right. Website visitors should contact the site owner first; we will help them respond.

8. Security

Data is encrypted in transit with TLS. Secrets are encrypted at rest. Access is limited to the people who need it to operate the Service.

9. International transfers

Our providers may process data in the United States and other countries. Where required we rely on Standard Contractual Clauses or equivalent safeguards.

10. Children

TrackStack is a business tool and is not directed at children under 16. We do not knowingly collect their data.

11. Changes

We will post updates here and, for material changes, email account holders before they take effect.