- Effective
- October 1, 2026
- Version
- 2.3
What personal data Traxsy collects, why, where it is stored, who can see it, and the rights you have — including under the EU and UK GDPR, the California Consumer Privacy Act, Brazil's LGPD and Canada's PIPEDA, where those laws apply to you.
1. Introduction
[Legal name of the developer — must match the App Store seller] ("Traxsy", "we", "our", "us") makes the Traxsy app for iPhone, with its Apple Watch companion app, and runs the website at traxsyapp.com (together, the "Service"). This policy explains how we handle personal data when you use the Service.
Much of what you log in Traxsy is health information, so this policy is specific: what we collect, where it is kept, who can see it, and how to export or delete it.
2. Who we are
The controller responsible for your personal data is:
[Legal name of the developer — must match the App Store seller]
[Postal address]
Email: privacy@traxsyapp.com
Use this email address for any privacy question or request, including the rights described in Section 11.
3. Definitions
- Personal data: any information relating to an identified or identifiable person (Art. 4(1) GDPR).
- Health data: personal data about your physical or mental health. It is "special category" data under Art. 9 GDPR, and most of what you log in Traxsy is health data.
- Processing: anything done with personal data, such as collecting, storing, using or deleting it.
- Controller: the organisation that decides why and how personal data is processed.
- Processor: a provider that processes personal data on the controller's behalf and under its instructions.
4. Data we collect
4.1 Information you give us
- Account: your email address, how you sign in (email and password, an email sign-in link, Sign in with Apple or Google Sign-In) and an account ID. If you use a password, our authentication provider stores it only in hashed form; we never see it. If you continue without an account, the app creates an anonymous account with an ID but no email address, and your records still sync to our backend.
- Profile: a display name and the details you choose to enter, such as age, sex, height, starting, current and target weight, activity level, the medicines you take, and whether Maintenance Mode or a custom schedule is switched on.
- Health data you log: doses (medicine, amount, date and time, injection site, pain score and notes), Pen Split records, weight, daily calories and protein, side-effect scores for nausea, fatigue and appetite, and daily notes. You can also log body measurements, water intake, and mood, energy and digestion scores; these stay on your iPhone (see 4.4).
- Preferences: the layout of your Dashboard, Body and Results screens.
- Messages: emails you send us, and our replies.
4.2 Information collected automatically
- Server logs: when the app connects to our backend, our hosting provider records standard request information, such as your IP address, the time of the request and app and operating-system version, for security and troubleshooting. We don't use it to build a profile of you.
- No analytics or advertising SDKs: the app contains no third-party analytics, crash-reporting, advertising or attribution SDKs, and it does not track you across other companies' apps or websites.
- Apple diagnostics: if you have chosen to share analytics with app developers in your iPhone's settings, Apple may give us crash reports and aggregated statistics that do not identify you.
- Reminders: dose reminders are scheduled on your iPhone by iOS. Traxsy doesn't use a push-notification service, and reminder content isn't sent to our servers.
4.3 Information from Apple and Google
- App Store: Apple processes all payments. The app checks your purchase status with Apple on your device (StoreKit), and our backend may keep a record of your Traxsy Pro access (plan, status and dates). We never receive your card or bank details.
- Sign in with Apple: if you use it, your name (if you choose to share it), your email address or an Apple private-relay address, and a unique identifier.
- Google Sign-In: if you use it, your basic Google profile (name, email address and profile picture link) and a unique identifier. We don't receive your Google password or access to other Google data.
4.4 What stays on your iPhone, and what syncs
- On your iPhone: everything you log is stored in the app on your iPhone, protected by iOS data protection. Your sign-in session is kept in the iOS Keychain.
- Synced to our backend: your account, profile, doses, Pen Split records, weight, daily calories, protein, side-effect scores and notes, and your screen layouts sync to our backend, hosted by Supabase, so they can be restored when you sign in again.
- iPhone only: body measurements, water intake, and mood, energy and digestion scores are not sent to our servers.
- Apple Watch: the Watch app receives a summary from your iPhone (estimated medication level, next dose and recent history) and can log an injection, which is passed to your iPhone.
- No iCloud: Traxsy does not use iCloud or CloudKit to store or sync your data. If you use iCloud Backup, iOS may include the app's data in your device backup, which Apple keeps under your Apple Account; we can't access it. Some pre-release test builds could copy data to your private iCloud account; if you used one, you can delete that copy in iOS Settings → [your name] → iCloud → Manage Account Storage.
5. Legal bases (GDPR and UK GDPR)
We rely on these legal bases:
- Contract (Art. 6(1)(b)): to provide the Service you signed up for: your account, sync, charts, reminders and, if you buy it, Traxsy Pro.
- Legitimate interests (Art. 6(1)(f)): to keep the Service secure, prevent abuse, fix problems and answer your messages. We weigh these interests against your rights.
- Legal obligation (Art. 6(1)(c)): when the law requires us to keep or disclose information.
- Permissions you give: for example, iOS asks before Traxsy can show reminder notifications. You can withdraw a permission at any time in your iPhone's Settings.
Health data (Art. 9): we process the health information you log only to provide the tracking features you use. You decide what to log, and you can delete any entry, or your whole account, at any time.
6. How we use your data
- To create and run your account, sign you in, and sync your records so they can be restored.
- To provide the app's features: dose and injection-site logging, charts, the estimated medication level, reminders, the Apple Watch app, Traxsy Pro features and data export.
- To send account emails: sign-in links, confirmations and password resets.
- To answer your messages and investigate problems you report.
- To keep the Service secure and prevent fraud and abuse.
- To meet our legal obligations.
We don't send marketing emails and we don't show ads. We don't sell your data and don't use it to train AI models.
8. International transfers
Our providers, including Supabase, may store or process your data outside your country, including in the United States, where data protection law may differ from yours. To ask where our backend stores your data and which safeguards apply to a transfer, email privacy@traxsyapp.com.
9. Retention and deletion
- Account and profile: until you delete your account.
- Health logs: until you delete the entry or your account.
- Data on your iPhone: until you delete it in the app, delete your account or remove the app.
- Server logs: kept by our hosting providers for a limited period under their own retention schedules.
- Emails with us: kept for as long as we need them to handle your request and any follow-up, then deleted.
- Purchases: Apple keeps the billing records for App Store purchases; we don't receive them. Any record of your Traxsy Pro access is deleted with your account.
Deleting your account: in the app, go to Settings → Privacy & Legal → Delete account. Your records are deleted from our live database immediately; the app then erases the Traxsy data on your iPhone and signs you out. Copies in our hosting provider's backups are removed as those backups expire.
10. Security
We protect your data with measures including:
- Encryption in transit: the app talks to our backend over HTTPS (TLS).
- Encryption at rest: data on our backend is encrypted at rest by our hosting provider. On your iPhone, iOS data protection protects the app's data and your sign-in session is stored in the Keychain.
- Access control: database row-level security limits each account to its own records. Authorised Traxsy staff can view account records through an internal admin tool, as described in Section 7.1.
- Reporting a vulnerability: email privacy@traxsyapp.com.
- Breaches: if a personal data breach occurs, we will notify the supervisory authority and affected users where the law requires (GDPR Arts. 33–34).
No method of storing or sending data is completely secure.
11. Your rights
If you are in the EU/EEA, the UK or a place with similar laws, you have the right to:
- Access (Art. 15): get a copy of your data. In the app: Settings → Data & Export → Download all my data.
- Rectification (Art. 16): correct inaccurate data — edit the entry in the app, or ask us.
- Erasure (Art. 17): in the app, Settings → Privacy & Legal → Delete account, or ask us.
- Restriction (Art. 18): ask us to limit how we process your data.
- Portability (Art. 20): export a CSV of your injections or a JSON backup in Settings → Data & Export.
- Object (Art. 21): to processing based on our legitimate interests.
- Withdraw consent (Art. 7(3)): where we rely on your consent, at any time, without affecting processing before you withdrew it.
- Complain (Art. 77): to a supervisory authority (see Section 16).
To exercise a right, email privacy@traxsyapp.com. We respond within one month (GDPR Art. 12(3)); for complex requests this can be extended by up to two further months, and we'll tell you if it is. We may need to confirm that the account is yours before we act.
12. California and other US states
If the California Consumer Privacy Act (as amended by the CPRA) or a similar US state law applies to you, you may have the right to know what personal information we collect and to access, correct and delete it, and to limit the use of sensitive personal information. We won't discriminate against you for using these rights. We do not sell or share personal information as the CCPA defines those terms, and we use sensitive personal information only to provide the Service. To make a request, email privacy@traxsyapp.com.
14. Children
Traxsy is not directed to children, and you must be at least 16 to use it (see the Terms & Conditions). If you believe a child has given us personal data, email privacy@traxsyapp.com and we will delete it.
15. Automated decisions
Traxsy does not make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). Calculations in the app, such as the estimated medication level or BMI, are estimates for your own reference.
16. Complaints
You can complain to a data protection supervisory authority. In the EU, find yours at edpb.europa.eu; in the UK, contact the Information Commissioner's Office (ICO). We'd welcome the chance to address your concern first at privacy@traxsyapp.com.
17. Changes to this policy
We may update this policy. We'll publish the new version on this page and change the effective date at the top. If a change materially affects how we use personal data you have already given us, we'll tell you before it applies. Earlier versions are available on request.
18. Contact
- Privacy questions and requests: privacy@traxsyapp.com
- App support: support@traxsyapp.com
- Post: [Postal address]
All contact options are on the Contact page.