Privacy policy

Trackoria collects only what the service strictly needs: your account, your works list and your preferences. The app only measures its usage if you accept it. Trackoria shows no ads, does no ad tracking and sells no data.

Your data stays exportable at any time from the app (JSON and CSV), and deleting your account erases it permanently after a 30-day grace period.

Trackoria Software Studio, a French simplified joint-stock company (SAS) with a share capital of €500, Versailles Trade and Companies Register 109 107 359, whose registered office is at 5 rue de Naples, 78150 Le Chesnay, France (full details in the legal notice). Dedicated contact for personal-data matters: [email protected].

Account data: email address, name and username, password (stored hashed), optional avatar and bio, two-factor authentication and privacy settings, date of acceptance of the terms of use.

Sign-in through Google, Discord or Apple, if you choose it: your account identifier with that provider, the email address and name it passes on to us, and the technical sign-in token it issues. With Apple, your name is passed on to us only at the first sign-in, and only if you choose to share it in Apple's sign-in sheet. If you hide your address, Apple gives us a relay address that forwards our emails to yours.

Service content: tracked works, progress, statuses, ratings and reviews, favorites, lists, badges, Trackdle games, the streaming services you declare, followers and followed accounts, activity and reactions, review votes, the members you block, the reports you file (on reviews, profiles or lists, with their reason and, for a profile or a list, the details you add, up to 500 characters), display and notification preferences.

Imports, if you bring your history over from another service: the export file you upload (TV Time, Letterboxd, IMDb, MyAnimeList, Goodreads), of which only the tracking data is read (including titles, identifiers, statuses, ratings, favorites, dates and progress), or the identifier you enter for your Steam or AniList account. The file is stored as is, unread parts included, until it is deleted automatically. We also keep your import history, including the Steam or AniList identifier entered, and the lines that could not be matched to a work, with their tracking data, so you can match them later.

Moderation data: reports about your profile, your lists or your reviews, with their reason and any details, the blocks your account is subject to, and, if action is taken, the note explaining why a review was hidden or the reason for and length of your account's suspension.

Subscription data, if you subscribe to Trackoria+: the plan chosen, the purchasing store, the subscription's status and renewal date, and any payment incidents. Payment data itself stays with Apple and Google.

Technical data: server and infrastructure logs (including IP address) kept for security purposes; if you enable notifications, your device's technical push identifier; and, each time the app starts, the update check, which sends a technical installation identifier, the device's operating system, the app version and, after a failed launch, the log of that error.

Mobile app error reports, sent when a crash or a technical error occurs: a technical description of the error and of the last operations that preceded it (such as requests sent to the server), the app version, the device model and operating system, and a technical installation identifier created by the error-tracking tool. These reports are not linked to your account: no account identifier or username is attached to them. The URLs of the recent requests they contain can, however, include technical identifiers, including your own account's, as well as the text of a search. Email addresses found in the error text are masked before sending.

Website error reports, sent when a page runs into a technical error, by your browser or by the website's server: a technical description of the error and of the last actions that preceded it (pages visited, clicks, requests sent), the address of the page and of the referring page, and the technical information your browser sends (browser, operating system, language, time zone). Your browser sends nothing as long as no error occurs.

Server error reports, produced when an internal error occurs: the request concerned (address, method and content sent), without its headers or cookies, and the internal identifier of the account that sent it. Email addresses found in these reports are masked.

Audience-measurement data, only if you accept it in the app: a pseudonymous identifier specific to your installation of the app and, on iPhone, the identifier Apple assigns on your device to all apps from the same publisher (IDFV), usage events (screens viewed, actions taken, grouped by broad category), a few preferences (language, theme, universe placed first, number of universes chosen), the device's technical characteristics (model, operating system, language, app version) and an approximate location, at most at city level, that Google derives from the device's IP address.

These usage events include the Trackoria+ purchase journey: a purchase being started, completed, cancelled or failing, with the plan chosen and, when it fails, its technical reason, as well as purchase restores. None of this audience-measurement data carries an account identifier, an advertising identifier or entered text.

Support requests: your email address and the content of your message, so we can reply to you and follow up on the request.

Providing the service, meaning creating your account, syncing your list, bringing your history over from another service at your request, keeping the app up to date and sending the notifications you enabled: the legal basis is performance of the contract.

Keeping your Trackoria+ subscription up to date, meaning verifying purchases made on the stores and the subscription's status: the legal basis is performance of the contract.

Offering the social features, meaning showing your profile, reviews and lists to other members according to your privacy settings, and letting you block a member: the legal basis is performance of the contract.

Securing the service, meaning preventing abuse, logging access and enforcing two-factor authentication: the legal basis is legitimate interest.

Detecting and fixing errors in the service, whether app crashes or website and server errors, based on technical error reports: the legal basis is the legitimate interest in keeping the service stable.

Responding to your support requests: the legal basis is the legitimate interest in replying to people who write to us.

Moderating the service, meaning handling reports, hiding a review or suspending an account while informing the person concerned of the reason: the legal basis is the legitimate interest in protecting members and the service and, for illegal content, our obligations under the EU Digital Services Act.

Understanding how the app is used in order to improve it, including the Trackoria+ purchase journey, based on pseudonymous usage statistics, with no account identifier and no entered text: the legal basis is your consent, requested at the end of the guided tour and revocable at any time in Settings › Privacy, with no effect on the service.

Emails are transactional (verification, reset, security alerts, chosen notifications); they contain no open-tracking pixels. No commercial prospecting without prior explicit consent.

Other members, once signed in, see your username (or, failing that, your account name) and your avatar, including in member search and even if your profile is private; that search also matches your account name. Depending on your privacy settings, they also see your profile (bio, sign-up date, follower and following counts, featured work, badges and insignia, including whether you subscribe to Trackoria+), your favorites, your statistics, your Trackdle record, the lists you show on your profile, your followers and the accounts you follow. As long as you share your activity, your followers also see your activity feed, your reviews appear with your rating on work pages, even if your profile is private, and members who view your profile see your status and rating for the works you both track and, if they have Trackoria+, an affinity score based on your ratings and a few of your favorite or top-rated works. Unless you turn it off in Settings › Privacy, those of your followers who have Trackoria+ see your monthly score in the Trackdle ranking. Apart from your avatar file, reachable by anyone who has its address, none of this data is visible without an account: the website publishes no profiles.

Your data is never sold or rented. It is processed only by the technical processors the service requires: Railway (website, API, database, its backups and cache hosting), Cloudflare (delivery and protection network placed in front of the website and public files, through which requests and IP addresses pass, and to which the browser reports failed requests (request address and IP address); R2 storage of avatars, import files while they are processed, and data-export archives; Turnstile anti-bot check on the support form; routing of email received on our contact addresses), Resend (transactional email), RevenueCat (verifying purchases made on the stores and the status of your Trackoria+ subscription, based on an internal account identifier sent for every account signed in on the app, with no payment data whatsoever), Expo (checking for and delivering app updates, and technical relay of push notifications to Apple's and Google's notification services), Google Firebase (in-app audience measurement, only if you accept it), Sentry (error reporting for the server, the website and the mobile app, hosted in the European Union), Discord (internal alerts for our team on a sign-up, a subscription, a report or a block, referring to content by an identifier, with no name or email address) and Have I Been Pwned (checking that a password is not already known to be compromised: only the first five characters of a password fingerprint are sent to it, never the password itself).

Apple and Google receive the push notifications addressed to your device and, if you subscribe to Trackoria+, process the purchase under their own terms. If you choose to sign in through Google, Discord or Apple, that identity provider acts as an independent data controller under its own privacy policy. Work searches, along with the titles of the items you import, are relayed to the catalog services (including TMDB, MyAnimeList, IGDB, Open Library and the BnF) without any account identifier. Work visuals (posters, covers, screenshots, cast photos, streaming-service logos) are loaded by the app directly from these services' image servers, which receive in the process the device's IP address and the image requested, with no account identifier. Likewise, an avatar taken from a Google or Discord account is loaded from that provider's servers by the devices that display it. For an import from Steam or AniList, the identifier you enter is sent to that service (Valve for Steam) so it can read your library or your list.

If you start a trailer in the app, it plays in YouTube's player embedded in the screen. This player, which Trackoria chooses to embed in the app, sends Google, which operates YouTube, data about the playback (including the device's IP address and the video watched). Google then processes this data on its own account, under its own privacy policy. The page hosting this player is served by GitHub Pages, which receives in the process the device's IP address, the id of the video played and the app's language. Trackoria passes no identifier from your account to either of them.

Application data is stored in the European Union. Some processors are established in the United States: any transfer is covered by the European Commission's standard contractual clauses, supplemented where applicable by their Data Privacy Framework certification.

Your account data is kept while the account is active. After a deletion request, a 30-day grace period lets you cancel it by signing in again; once elapsed, the data is permanently deleted.

When an account signed in with Apple is permanently erased, we also ask Apple to revoke the authorization given to Trackoria. If that request fails, the authorization can still be removed on iPhone from Settings › [your name] › Sign in with Apple.

Accounts created during the private beta were carried over as they were when Trackoria opened publicly on 29 September 2026: list, progress, ratings, badges and pioneer status. They can still be deleted at any time from Settings › Security, including an account without a password, which confirms with a code sent by email.

Technical and infrastructure logs, which include your IP address, are kept for at most 90 days for security purposes and then deleted. Error reports are kept for at most 90 days, then deleted. Logs of the actions performed by our administration team are kept for 3 years.

Notifications you have read in the app are deleted after 12 months.

The file uploaded for an import is deleted automatically shortly after its processing ends, as soon as you abandon the import, or about 48 hours after upload if you do not confirm the preview. Your import history and the lines to match, even those matched or dismissed since, are kept for as long as your account exists.

A block lasts until you lift it; a technical trace of the block, which prevents duplicate alerts, is kept for 30 days, even if the block is lifted in the meantime. A report is kept for as long as the reported content or account and the account that filed it exist, then erased with them. The reason for a suspension is removed from your account when it is lifted, at your first sign-in after it expires, or with the account. Moderation decisions and their reason remain recorded in the administration logs, kept for 3 years, including after the account is deleted.

Audience-measurement data is kept for 14 months by the provider, then deleted. Withdrawing your consent immediately stops the collection; data already sent is no longer linked to your installation's pseudonymous identifier, which is reset, and expires in turn. On iPhone, it remains associated with the IDFV, which does not change as long as an app from the same publisher remains installed on the device.

Support requests are kept for 12 months after they are closed, then permanently deleted.

Export archives of your data remain accessible only for as long as their download link is valid, then are deleted from storage.

Database backups allow a restore over a rolling window of about four weeks, then are overwritten.

Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability of your data.

Most of them can be exercised directly in the app: export all of your data (Settings › Export my data: profile, list, reviews, lists, statistics, Trackdle, notifications, activity, imports, blocked members (except those who also blocked you) and reports filed, as JSON or CSV), edit your profile, or delete your account. If you can no longer sign in, the page trackoria.app/en/delete-account explains how to send us your deletion request. For any other request: [email protected].

You can also set directives on what happens to your data after your death (keeping it, erasing it, or passing it on to a person you designate) by writing to [email protected]. Absent any directive from you, your heirs may request the account's closure and the erasure of the data by proving their status.

You may also lodge a complaint with your supervisory authority (in France, the CNIL: cnil.fr).

The website only uses storage strictly required to operate (authentication session, local preferences such as theme or language) and includes no audience-measurement tool; its error reports store nothing on your device. The mobile app only measures its usage if you accept it, on a pseudonymous basis and with no advertising signal, and you can withdraw this consent at any time in Settings › Privacy. Trackoria sets no advertising cookies, neither on the website nor in the app. The app's error-tracking tool keeps a technical installation identifier on the device, used only to group the crash reports of a single installation. The app's update system keeps another one, sent to Expo each time the app starts, used to deliver updates. Trackoria uses neither for audience measurement or advertising, and neither is subject to your consent: we consider them strictly necessary for the app to work properly, within the meaning of Article 82 of the French Data Protection Act (loi Informatique et Libertés). The app's trailer player only loads when you start a video. YouTube may then use its own trackers, which Google operates under its own policy. The website's support form relies on the Cloudflare Turnstile anti-bot check, strictly necessary to protect the service and with no tracking purpose.

Traffic is encrypted (HTTPS), passwords are hashed, two-factor authentication is mandatory to access the service, and known-compromised passwords are rejected at sign-up.

Any substantial change to this policy will be announced in the app or by email before it takes effect, with the update date shown at the top of this page.