Privacy Policy

Traqqo (“we”, “our”, or “us”) operates the Traqqo mobile application (the “App”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our App.

By using Traqqo, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

Information You Provide

• Account Information: Name, email address, and password when you create an account.
• Profile Information: Phone number, profile photo, and biographical details you choose to add.
• Client Data (Trainers): Client names, contact information, session details, and notes you enter about your clients.
• Session Data: Session types, dates, times, durations, and notes.
• Goal Data: Goal titles, descriptions, target values, progress entries, and progress photos.
• Messages: Text, photos and videos you send in the in-app chat. Chat media is stored privately and is visible only to the two participants of that conversation.
• Payment Information: When trainers collect payments from their clients through the App, payment details are processed securely by Stripe. We do not store credit card numbers, bank account numbers, or other sensitive financial information on our servers.
• Bank Details (Trainers): For trainers who choose to display bank transfer details to their clients, account information (e.g., IBAN, account number, sort code) is stored encrypted in our database and shown only to clients linked to that trainer.

Information Collected Automatically

• Device Information: Device type, operating system, and app version.
• Usage Data: App interactions, feature usage, and crash reports to improve the App.
• Push Notification Tokens: To deliver notifications you have opted in to receive.
• Install Source: When you install the App from Google Play, the store may pass us a short tag describing how you found it — for example, which of our ads or links you tapped, or that you found it directly in the store. We record the same kind of tag when you reach sign-up through one of our own links inside the App, such as the "Are you a coach?" link on an invitation. We record it once against your account so we can tell which of our own campaigns and links work. It is stored only in our own database and is never shared with advertising or analytics providers.

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the App’s functionality.
• Enable trainers to manage clients, sessions, goals, and packages.
• Facilitate trainer-to-client payments through our payment provider (Stripe Connect).
• Send push notifications you have opted in to receive (session reminders, goal updates).
• Improve the App’s performance, reliability, and user experience.
• Respond to support requests.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Third-Party Services

We use the following third-party services to operate the App:

• Supabase: Authentication, PostgreSQL database, edge functions, file storage, and realtime sync. Data is hosted in secure data centers operated by Supabase and its infrastructure providers (AWS). See Supabase’s Privacy Policy.
• Stripe (Stripe Connect): Used solely to facilitate payments between trainers and their clients when a trainer chooses to collect payment through the App. We do not currently process subscription payments through Stripe. See Stripe’s Privacy Policy.
• Expo (EAS): App build, distribution, and over-the-air updates. See Expo’s Privacy Policy.
• Expo Push Notification Service / Apple Push Notification Service / Firebase Cloud Messaging: Delivery of push notifications.
• Sentry: Crash and error reporting. Sentry receives technical information about errors (stack trace, device model, OS version, app version) but does not receive your account contents. See Sentry’s Privacy Policy.
• PostHog: Product analytics. PostHog receives pseudonymous event data (e.g., “session_created”). We do not send PostHog the contents of your client data, sessions, goals, or messages. See PostHog’s Privacy Policy.
• Google (Firebase & Google Analytics 4): Website and app analytics. On our marketing website these tags load only after you grant consent (see the Cookies section below). See Google’s Privacy Policy.
• Google Ads (conversion tracking): Measures the effectiveness of our advertising campaigns (e.g., app-download clicks) using Google Consent Mode. Loaded only after you grant marketing consent. See Google’s Privacy Policy.
• Meta (Facebook/Instagram Pixel & Conversions API): Measures conversions from our Meta advertising and helps us reach relevant audiences. The Pixel loads only after you grant marketing consent. See Meta’s Privacy Policy.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services.

When you delete your account:

• Your user profile and authentication data are permanently deleted.
• Session, client, goal, and package data associated with your trainer account are permanently deleted.
• Your profile photo and the progress photos on your journal posts and goal updates are deleted from our file storage.
• Photos you sent in a chat stay with that conversation, so the other participant keeps their history, in the same way your messages do. They are no longer linked to your profile. You can delete an individual message, and the photos on it, from inside the app at any time before deleting your account.
• Payment records processed by Stripe are subject to Stripe’s data retention policies and applicable financial regulations.

We do not currently apply a time limit to chat and journal media: it is kept for as long as the account it belongs to exists. See Delete your account for the full picture.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL).
• Encryption of data at rest at the database and storage layer.
• PostgreSQL Row Level Security (RLS) to enforce per-user and per-trainer access control.
• Secure authentication with Supabase Auth (industry-standard JWT-based sessions, hashed passwords).

While we strive to protect your information, no method of electronic transmission or storage is 100% secure.

6. Push Notifications

Push notifications are opt-in. You can enable or disable notifications at any time through the App’s notification preferences or your device settings. We send notifications for:

• Session reminders.
• Goal updates and milestones.
• Invite notifications.

7. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure: Request deletion of your personal data (account deletion).
• Right to Data Portability: Request a machine-readable copy of your data.
• Right to Object: Object to certain processing of your personal data.
• Right to Restrict Processing: Request limitation of processing of your personal data.

To exercise any of these rights, contact us at info@traqqo.com. We will respond within 30 days.

8. Children’s Privacy

Traqqo is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at info@traqqo.com.

9. Cookies & Website Tracking

Our marketing website uses cookies. Strictly necessary cookies are always active; analytics and marketing cookies are set only after you consent via our cookie banner.

• traqqo_consent: Stores your cookie choice (analytics / marketing) for 12 months. Strictly necessary.
• traqqo_attrib: Stores campaign attribution parameters (e.g. utm_source, gclid, fbclid) for up to 90 days so we can measure which campaign referred you. Set only after you grant consent.
• Google cookies (GA4 & Google Ads): Set by Google’s tags only after consent to measure site usage and ad conversions.
• Meta Pixel cookies: Set by the Meta Pixel only after consent to measure ad conversions.

Withdrawing consent: You can change or withdraw your choice at any time using the “Cookie settings” link in the website footer, which reopens the consent banner. You can also clear the Traqqo cookies in your browser. Withdrawing consent stops further analytics and marketing tags from loading.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice in the App or sending you a notification. Your continued use of the App after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your personal data, contact us at info@traqqo.com.