Privacy Policy

Personal Information

• Account information (email address, password, and username)
• "Violation" data (points on the face mesh where your hand crossed your selected facial boundary along with timestamps)
• "Streak" data (the amount of time that occurs between violations)
• Total Time Tracked (the total amount of time you were tracking your face/hands)
• Usage data and preferences
• Achievement and badge progress

Video and Camera Data

Our application uses your device's camera for real-time behavioral tracking. Important privacy guarantees:

• All video processing happens exclusively on your local device
• No video is ever stored, saved, or transmitted to our servers or any third parties
• No images are ever captured, stored, or transmitted
• The video stream never leaves your device and is accessible only to you
• Only the specific data points mentioned above (violations, streaks, etc.) are saved
• No facial recognition or biometric scanning is performed

Cookies and Tracking

We use cookies and similar tracking technologies to track activity on our Service and hold certain information. Cookies are files with a small amount of data that may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

We use Google Analytics to help us understand how our users use the Service. The information generated about your use of the Service (including your IP address) will be transmitted to and stored by Google.

We use the collected information for:

• Providing and improving our services
• Generating progress reports and analytics
• Personalizing your experience
• Communicating with you about your account, including sending alerts and notifications
• Processing transactions and managing your subscription
• Developing new features and functionality
• Ensuring the security and integrity of our services
• Creating anonymized, aggregated data for service improvement

Legal Basis for Processing (For EEA Users)

If you are located in the European Economic Area (EEA), our legal basis for collecting and using your personal information depends on the specific information concerned and the context in which we collect it. We generally rely on:

• Consent (e.g., when you agree to our processing your data for a specific purpose)
• Contract performance (e.g., processing necessary to provide you with our services)
• Legitimate interests (e.g., improving our services)
• Legal obligations (e.g., to comply with applicable laws)

You have the right to withdraw consent at any time.

We may share your information with:

• Service providers who help us deliver our services (e.g., hosting, database, analytics)
• Legal and regulatory authorities, when required by law
• Professional advisors such as lawyers, auditors, and insurers, where necessary
• A potential buyer in the event of a sale, merger, or acquisition of our business

We do not sell, rent, or trade your personal information with third parties for their marketing purposes.

We employ a comprehensive security infrastructure using Firebase and Google Cloud services:

Encryption and Data Protection

• Advanced AES-256-GCM server-side encryption for all sensitive data
• End-to-end encryption for data transmission

Access Control and Authentication

• Firebase App Check protection against unauthorized access
• Strict database security rules with authentication checks
• CSRF protection for all sensitive operations
• Automatic session management with secure timeout handling

Application Security

• Strict Content Security Policy (CSP) headers
• Input validation and sanitization on both client and server side
• Rate limiting on all sensitive operations
• Secure WebSocket connections for real-time data

Monitoring and Compliance

• Regular security audits and vulnerability assessments
• Automated security violation monitoring and alerts
• Comprehensive audit logging for security events
• Continuous monitoring of access patterns and potential threats

While we implement safeguards designed to protect your information, no security system is impenetrable and due to the inherent nature of the Internet, we cannot guarantee that information, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion by others.

You have the right to:

• Access your personal data
• Rectification - request correction of your data if it's inaccurate
• Erasure - request deletion of your data in certain circumstances
• Restrict processing - limit how we use your data in certain circumstances
• Data portability - request your data in a structured, machine-readable format
• Object - contest our processing of your data in certain circumstances
• Withdraw consent at any time where we rely on consent as our legal basis

To exercise any of these rights, please contact us at info@trictrak.com. We will respond to your request within 30 days.

If you are in the European Union, you also have the right to lodge a complaint with a supervisory authority if you believe we have processed your personal information in a manner inconsistent with your privacy rights.