Trakabl

Privacy Policy

Version 2.4 · Effective 10 October 2026

Supersedes v2.3.

Trakabl is operated by Trackd Co Pty Ltd (ABN 35 698 405 462). This Privacy Policy explains how Trackd Co Pty Ltd (ACN 698 405 462, ABN 35 698 405 462), an Australian private company based in the Australian Capital Territory, Australia ("Trakabl", "we", "us", "our"), collects, uses, stores, and shares your personal information when you use the Trakabl application (on the web and, when available, as an app for iPhone and Android) and the website at trakabl.app (the "Service"). It forms part of, and should be read with, our Terms of Service and Medical Disclaimer.

Trakabl is available to users worldwide. Depending on where you live, additional rights and protections may apply to you. See Sections 14 (EU and UK), 15 (United States), and 16 (Consumer Health Data).

Two people operate Trakabl, the two founders. Both have administrative access to our systems, within the limits described in Section 6.

1. The sensitivity of your data, and your consent

Trakabl handles health-related information: the substances you track, your doses, the bloodwork images you upload, your body metrics, and your journal notes. Under Australia's Privacy Act 1988 (Cth) this is sensitive information, and in many other places it counts as "special category" or "consumer health" data that gets extra legal protection. We treat all of your protocol, bloodwork, body-metric, journal, and uploaded-image data as sensitive.

The Service cannot work without processing this information, so when you create your account we ask for your explicit, specific consent through a separate consent step, distinct from accepting our Terms of Service. You give this consent by ticking a dedicated box that reads: "I explicitly consent to Trakabl processing my health-related data (compounds, doses, bloodwork, body metrics, photos and journal entries) to provide the Service, as described in the Privacy Policy." We record the version of this policy you consented to, the date and time you did so, and the browser you used (its user agent). You can withdraw this consent at any time, as described in Section 10.

2. Information we collect

Information you give us

Billing information

If you subscribe, we and Stripe each hold part of the picture.

If you subscribe in our iPhone or Android app, Apple or Google takes the payment and holds your payment details under its own terms and privacy policy. We, and RevenueCat on our behalf, receive a record of the purchase: the product, its dates and status, and a transaction identifier. We never receive your card details.

We also tell RevenueCat about subscriptions bought on the web, by sending it your internal user identifier and Stripe's identifier for your subscription, so that it can keep track of your subscription's status wherever you bought it.

We do not connect your billing records to your protocol or health data for any purpose other than knowing whether your account has access.

Information collected automatically

Notifications

If you turn on reminders, we store the push subscription your browser creates for you, which is an address your browser gives us for delivering messages, together with the encryption keys that go with it. When our iPhone and Android apps offer reminders, we will store the notification token the app is given, and the keys used to encrypt messages to it, for the same purpose. We also store the browser and device description your browser sends (your user agent), so you can tell your devices apart when managing notifications, and your device's timezone (for example, "Europe/London"), used only to schedule reminders at the right local time. We do not collect your timezone unless you open your notification settings or turn reminders on. Turning notifications off stops this, and we automatically remove subscriptions that stop working. We also keep a record of which notifications we have sent you and on which day, so that you are not sent the same one twice.

The address your browser gives us identifies which push service your browser vendor uses, which indicates the browser or operating system you are on.

Please read this part carefully. Reminders, and the occasional check-up we send, can name the compound they relate to, for example "Testosterone Enanthate is due", or "Retatrutide is running low". That text can appear on your lock screen and can be read by anyone who can see your device without unlocking it. Reminders are delivered through the push service your browser uses, operated by Google, Apple, or Mozilla depending on your browser. When our apps offer reminders, they will be delivered through Apple's or Google's notification service instead. The content of each message is encrypted so that service cannot read it, but the fact that a message was delivered to your device passes through it. To keep compound names off your lock screen, turn on Hide compound names in your notification settings. If the delivery itself matters to you, leave notifications turned off.

Analytics and advertising

We use PostHog, a product-analytics service, to understand how the app is used: which screens are opened, which steps in a flow are completed, and when a feature is used, for example that a weight was logged or a journal entry was saved, with simple counts such as how many photos were attached. It never receives what you record: your protocol, bloodwork, journal, body-metric, and photo data are never part of analytics. Events are linked to your internal user identifier, never your name or email address. PostHog sets no cookies, does not record your screen, and is set to discard your IP address. With each event it receives the address of the page, with everything after the "?" removed except campaign and onboarding-step tags, and basic device details: browser, operating system, screen size, language, and time zone. When the app hits an error, PostHog also receives a technical error report: the type of error, where in our code it happened, and the page it happened on. We remove the error's message before it is sent, so it cannot carry anything you entered.

We do not use advertising trackers, we do not set advertising cookies, we do not show advertising in the Service, and we do not sell or share your personal information. These commitments are firm and do not depend on which provider we use.

3. How we use your information

We use your information to:

We do not use your health data for advertising, we do not show advertising in the Service, and we do not sell or "share" (as privacy laws such as the CCPA define those terms) your personal information.

The emails you receive from us are sent by our providers: account and security emails (sign-up confirmation and password reset) through Supabase, which sends them using Resend; waitlist emails through Resend; and billing emails such as receipts through Stripe. We send marketing emails, such as news and offers about Trakabl, only if you asked for them (for example by ticking "Send me updates and offers" on the waitlist), and each one has a working unsubscribe link.

4. Legal bases for processing (where the GDPR applies)

Where laws such as the UK or EU GDPR apply, we rely on: performance of our contract with you (to run the Service and to take payment); your explicit consent under Article 9 (for your sensitive health data); our legitimate interests (keeping the Service secure and working, and preventing abuse of free trials); and compliance with legal obligations (including tax and financial records). You can withdraw consent at any time, as described in Section 10.

5. How and where your data is stored

Your data is held with our infrastructure and service providers.

Uploaded files (bloodwork images, journal photos, progress photos, and avatars) are kept in private, access-controlled storage buckets and are only ever served to you through short-lived signed links that expire within a few minutes. Database access is enforced row by row so that one user cannot read another user's data.

All data is encrypted at rest (AES-256) and in transit (TLS), including the database, the storage buckets, and our database backups. We keep encrypted database backups so that we can recover after a failure.

Our service providers

These are our sub-processors: the companies that handle your information on our behalf. We use the following providers to operate the Service. Each acts on our instructions and is bound by a data-processing agreement. They may only use your information to provide their service to us, and we do not sell your personal information to any of them.

These are our only active service providers. If we add another, including a different analytics or an email provider, we will add it to this list before that provider goes live. We treat the addition of a new service provider that handles your sensitive data as a material change (see Section 17).

Other recipients

Five other parties may receive limited information, but only because of a choice you make or because of how the checkout screen is built, and none of them processes your protocol or health data on our behalf:

6. Sharing and disclosure

We do not sell or rent your personal information. We share it only: with the sub-processors listed above, so they can help us run the Service; where we are required to by law or valid legal process; or as part of a business transfer (such as a merger or sale). In a business transfer involving your sensitive health data, we will require the recipient to be bound by privacy protections at least as protective as this policy, and we will take reasonable steps to notify you. If we receive a request for your data from law enforcement or a government agency, we will check that the request is legally valid, disclose only what we are legally compelled to disclose, and, unless the law prohibits us from doing so, take reasonable steps to tell you about the request.

Who at Trakabl can see your data. Our systems are built so that your protocol, bloodwork, journal, body-metric, and photo data is readable only by you. Neither founder can read it through the app. There are three narrow exceptions, all limited to our two founder accounts: the feedback and refund requests you send us through the in-app form (which include your email address and whatever you write), waitlist sign-ups, and billing and subscription records, which we need in order to answer questions about charges. In an emergency, or where the law requires it, we may need direct database access to fix a fault or comply with a legal obligation.

7. Data on your own device

Trakabl stores a working copy of your data on the device you use, in your browser or in our app, so the app stays fast and keeps working when you are offline. This copy includes real health information: the compounds in your protocol, your schedules, the doses you have logged, one-off logs, custom compounds you create, and your onboarding answers, which include your date of birth and sex.

Three things about that copy matter, and we would rather you know them than not:

To remove the on-device copy without deleting your account, or to remove it from a browser or device other than the one you delete your account in, clear the site data for trakabl.app there (and for trackdco.app, if you used the old address), or delete the app from that device if you installed it to your home screen or from an app store. If you share a device with anyone, do this when you have finished.

8. Data retention and deletion

We keep your data while your account is active. If a subscription ends and your account moves to the free plan, we keep it in exactly the same way. Nothing is deleted, hidden, or withheld because you stopped paying, and you can still delete your own data or close your account at any time.

Deleting things inside the app. When you delete a compound or a cycle, it stops appearing in your protocol and no further doses are scheduled for it, but the doses you have already logged are kept, so your history stays intact. The underlying record is marked inactive in our database rather than erased, and it stays there until you delete your account. Deleting an individual logged dose, a journal entry, a body-metric entry, a bloodwork image, or a progress photo removes it permanently, including the underlying file where there is one.

Full account deletion. You can delete your account yourself at any time, on any plan, using the in-app "Delete my account" control. You type DELETE to confirm, and the deletion runs immediately. Your right to delete is absolute: it does not depend on your subscription, on paying us, or on anything else.

When you confirm, the deletion runs there and then. Nothing is queued for a person to process later. We cancel any active subscription you bought on the web first, then remove your uploaded files (bloodwork images, progress photos, journal photos, and avatars) from the private storage they are held in, then cancel your Sign in with Apple if you used it, then delete your login, which removes your records with it. Last, the app clears the working copy in the browser you are deleting from. Each step has to succeed before the next one starts, so a deletion either completes or stops and can be run again. A subscription bought in our iPhone or Android app can only be cancelled by you, in your Apple account or Google Play settings. Deleting your account does not cancel it, so cancel it there first. If you cannot complete it yourself, email us at support@trakabl.app and we will finish it. Records we are required to keep are retained for as long as the law requires, including payment and transaction records, some of which are held by our payment processor rather than by us. Those are listed immediately below.

What deletion does not reach. We would rather be exact about this than reassuring:

9. Security

We take reasonable technical and organisational measures to protect your information, including:

No method of storage or transmission is perfectly secure. Please help protect your account by keeping your password confidential, and see Section 7 for the copy of your data held on your own device.

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the relevant regulator, including the Office of the Australian Information Commissioner under Australia's Notifiable Data Breaches scheme, as required by law, and we will tell you what happened, what data was involved, and what we are doing about it. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach, and affected individuals without undue delay.

10. Your rights

Depending on where you live, you may have rights to access, correct, export (in a portable form), or delete your personal information, to restrict or object to certain processing, and to withdraw consent. You may also have the right to complain to a data-protection regulator.

How to exercise your rights, and how to complain. To exercise any of these rights, or to make a privacy complaint, contact us at support@trakabl.app. We will acknowledge a complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, in Australia you can complain to the Office of the Australian Information Commissioner (OAIC, oaic.gov.au), and elsewhere to your local data-protection regulator.

Getting a copy of your data. The Service does not yet include a self-service export. If you want a copy of your data in a portable, machine-readable form, email support@trakabl.app and we will produce it for you within the time the law allows. A self-service export is planned.

We will honour whatever privacy rights the law of your home country gives you: when you make a request, we will assess it under the law that applies to you and respond as that law requires, even if the right is not listed above. We do not discriminate against you for exercising any privacy right. Because the Service cannot operate without processing the protocol and health-related information you enter, withdrawing your consent to that processing means closing your account. We will explain this to you before acting on such a request.

11. International data transfers

Your account and health data are stored in Australia, in Supabase's Sydney region. The Service is offered worldwide, and some of our providers are companies outside the country you live in, so other information we hold, such as billing records and server logs, may be stored or processed outside it. If you sign in with Google or Apple, turn on reminders, or reach the payment screen, limited information also passes through the providers described in Section 5.

12. Children

Trakabl is for adults only. The Service is not directed to anyone under 18, and we do not knowingly collect personal information from minors. If we learn we have, we will delete it.

13. Cookies and browser storage

We use only cookies that are strictly necessary or functional. We do not use analytics or advertising cookies.

We also use your browser's storage: for the working copy of your data described in Section 7; for small preference flags, such as a dismissed prompt or a calculator setting you chose; and, while a retention offer is open, a short-lived entry that remembers the offer for the tab you have open. Our service worker caches one static image. Our iPhone and Android apps use the device's app storage in the same way and for the same purposes.

If any of this changes, we will update this section and seek consent where required.

14. EU and UK users (GDPR)

If you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR give you the rights set out in Section 10, and in particular: the right of access to your data; the rights to rectification and erasure; the right to restrict or object to processing; the right to data portability; and the right to withdraw consent at any time without affecting processing carried out before withdrawal. Our lawful bases are described in Section 4, and for your health data we rely on your explicit consent under Article 9. You have the right to lodge a complaint with your local supervisory authority. For questions about this policy or our processing, contact us at support@trakabl.app.

15. United States users (including California)

Trakabl is a consumer self-tracking app. We are not a HIPAA-covered entity or business associate, and HIPAA protections do not apply to the information you enter. Your information is instead protected by this policy and by the consumer-privacy laws that apply to you.

If you are a resident of California or another US state with applicable consumer-privacy laws, you may have rights to know what personal information we collect and how we use it, to access and delete it, to correct it, to limit the use and disclosure of sensitive personal information, and to not be discriminated against for exercising these rights. We do not sell or share your personal information (including as those terms are defined under the CCPA and CPRA), and we do not use your sensitive health-related information for any purpose other than providing the Service to you. To exercise any state-law right, contact us at support@trakabl.app; we will verify your request and respond as the law requires.

16. Consumer Health Data (Washington, Nevada, Connecticut, and similar US state laws)

Some US states have consumer-health-data laws, including Washington's My Health My Data Act, Nevada's SB 370, and the Connecticut Data Privacy Act. Where one of those laws applies to you, this section is our consumer health data privacy policy. We also publish it separately, word for word, as our Consumer Health Data Privacy Policy, so that it is easy to find.

What consumer health data we collect. Everything you enter about your own health and your own protocols:

Where it comes from. Directly from you, and from the files you choose to upload. We do not buy consumer health data, obtain it from data brokers, or infer it from anything else.

Why we collect it. Only to provide the Service to you: to record, organise, compute, and display your own data back to you, and to send the reminders you turn on. We do not read or interpret your bloodwork, we do not assess your protocol, and no one at Trakabl reviews what you log.

How it is shared. We do not sell your consumer health data. We do not share it for advertising, and we show no advertising in the Service. We disclose it only to the service providers who help us operate the Service, listed in Section 5 of the Privacy Policy, and where we are required to by law (Section 6 of the Privacy Policy). Our payment processors, including Apple and Google for subscriptions bought in our apps, do not receive it, and our analytics provider, PostHog, receives only usage information and technical error reports, never what you record.

Who can see it. Our systems are built so that your protocol, bloodwork, journal, body-metric, and photo data is readable only by you. Neither founder can read it through the app. In an emergency, or where the law requires it, we may need direct database access to fix a fault or comply with a legal obligation.

The legal basis. We collect and process your consumer health data on the basis of the explicit consent you give when you create your account, through a separate consent step distinct from accepting our Terms of Service. We do not collect or share it beyond what is necessary to provide the Service to you without asking you separately.

Your rights. You have the right to:

To exercise any of these, use the in-app "Delete my account" control or contact us at support@trakabl.app. Deleting your account removes your account data and your uploaded files immediately. Our service providers do not hold separate copies of your health data, and residual copies age out of our encrypted backups on their normal cycle. Records we must keep by law are listed, with reasons, in Section 8 of the Privacy Policy; none of them contain your health data.

Withdrawing your consent means closing your account, because the Service cannot operate without processing this information. We will explain that to you before acting on your request.

You will never be charged a different price, or given a worse service, for exercising any of these rights.

How to reach us, and how to complain. Email support@trakabl.app. We aim to acknowledge complaints within 5 business days and to resolve them within 30 days. If we refuse a request, we will tell you why, and you can ask us to look at it again. If you are still not satisfied, you can complain to your state Attorney General; in Australia, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

17. Changes to this policy

We may update this Privacy Policy from time to time. We'll show you any updated version in the app, and it applies to you once you select "Agree". We will never use your health data for a new purpose without asking for your consent first.

18. Contact

For privacy questions, to exercise your rights, or to make a complaint, contact us at support@trakabl.app.