Privacy Policy

This Privacy Policy explains how StackTrack ("we", "us", or "our") collects, uses, and protects your information when you use our mobile application.

1. Introduction

We are committed to protecting your privacy. This policy applies to the StackTrack mobile application for iOS and Android devices.

2. Data Controller

3. Data We Collect

3.1 Data You Provide

• Portfolio data: your precious-metals holdings (metal, weight, quantity, purchase price, acquisition date, dealer, notes)
• Sales data: sales you record for the tax report (date, quantity, proceeds)
• Price alerts and savings goals: the thresholds and targets you set
• Photos and receipts: images you attach to a holding (coin, bar, purchase receipt) as proof of ownership for an insurer. Photos are only ever uploaded when you explicitly attach one, and are stored in Google Cloud Storage under users/{your-id}/attachments/, accessible only to you.
• Storage details: where a holding is kept, serial number, insured value and policy number, if you record them.
• Account data: if you sign in with Apple or Google we receive your email address and, where you allow it, your name. Sign in with Apple lets you use a private relay address instead.

3.2 Automatically Collected Data

• User ID: an identifier linking your data to your account. Without sign-in it is anonymous and device-local.
• Push token: if you enable price alerts we store a Firebase Cloud Messaging token so notifications can reach you.
• Subscription status: whether a StackTrack Pro subscription is active, and purchase and renewal events. We receive no payment details — billing is handled entirely by Apple or Google.
• Usage and diagnostics: anonymous usage statistics (Firebase Analytics) and crash reports (Firebase Crashlytics).
• Device information: device type, OS version and app version.

3.3 Data We Do NOT Collect

• Your payment or card details
• Your location
• Your contacts, calendar, or photos you have not attached yourself
• Bank or brokerage account details

3.4 Data That Never Leaves Your Device

Some features are entirely local. The decoy holdings used by privacy mode and their PINs are stored encrypted on your device only (iOS Keychain or Android Keystore) and are never transmitted to us.

4. Purposes and Legal Bases

Purpose	Legal basis (GDPR)
Providing the app and managing your portfolio	Art. 6(1)(b) – performance of a contract
Syncing between your devices	Art. 6(1)(b) – performance of a contract
Price alerts and push notifications	Art. 6(1)(a) – consent, withdrawable at any time
Generating the German tax report	Art. 6(1)(b) – performance of a contract
Proof of ownership (photos, storage location, serial numbers)	Art. 6(1)(b) – performance of a contract
Processing and validating subscriptions	Art. 6(1)(b) – performance of a contract
Crash reports and debugging	Art. 6(1)(f) – legitimate interest in a working app
Anonymous usage statistics	Art. 6(1)(f) – legitimate interest in improving the product

5. Storage, Location and Security

• Your data is stored in Google Cloud Firestore. That database is currently located in the United States (Google region "nam5").
• Photos and receipts are held in Google Cloud Storage, restricted to your own account by storage rules.
• Server-side processing (price alerts, tax report, premium analysis) runs in Google data centres in Belgium (region "europe-west1").
• All transfers use HTTPS/TLS; data is encrypted at rest.
• Firestore security rules ensure only you can read your data.
• PIN and decoy holdings never leave your device (see 3.4).

6. International Transfers

As described in section 5, your data is stored on servers in the United States and processed by US providers. Google LLC and RevenueCat, Inc. are certified under the EU-U.S. Data Privacy Framework; in addition, the European Commission's Standard Contractual Clauses apply under Art. 46(2)(c) GDPR.

You should be aware that US authorities may under certain conditions request access to data, and that the level of protection may not in every case correspond to that of the GDPR.

7. Third-Party Services

• Firebase / Google Cloud (Google Ireland Ltd. and Google LLC): authentication, database, file storage, push notifications, analytics, crash reporting, server-side processing. Google Privacy Policy
• RevenueCat, Inc.: subscription management and validation. Receives your user ID and the store receipt. RevenueCat Privacy Policy
• Apple App Store / Google Play: payment processing and subscription management. We receive only your subscription status, never payment details.

We use no advertising and no ad networks. StackTrack contains no ads and shares no data for advertising purposes.

8. Retention

• Portfolio, sales, alert and proof-of-ownership data is kept for as long as your account exists.
• After a deletion request, your data is permanently removed from our servers within 30 days.
• Push tokens are removed when you disable notifications or delete the app.
• Crash and usage data expires automatically under Firebase's standard retention (typically no more than 14 months).

9. Your Rights (GDPR)

• Access (Art. 15): a copy of your personal data
• Rectification (Art. 16): correction of inaccurate data
• Erasure (Art. 17): deletion of your personal data
• Restriction (Art. 18) of processing
• Portability (Art. 20): your data in a structured format
• Objection (Art. 21) to processing based on legitimate interests
• Withdrawal of consent (Art. 7(3)), for example for push notifications, with future effect
• Complaint to a supervisory authority (Art. 77). The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information.

10. Deleting Your Data

You can delete your data at any time:

• In the app: Settings → Delete all data
• Individual photos: remove them directly from the holding
• By email: contact us at [email protected]

After a deletion request all your portfolio data is permanently removed from our servers within 30 days. Please cancel any active subscription separately in the App Store or Google Play.

11. Children's Privacy

Our app is not intended for children under 16. We do not knowingly collect personal data from children under 16.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy in the app and updating the "Last updated" date.

13. Contact

For questions or concerns about data processing, contact us at:

Last updated: August 2026