Privacy Policy

Last updated: 8 September 2026. This notice explains how the current MyTracksy web app and installable PWA handle personal data. It does not certify that a customer’s own professional workflow is legally compliant.

Who is responsible

MyTracksy is operated by SafeNet Creations, No. 354 Stanley Road, Jaffna 40000, Sri Lanka, which is the controller of your account, billing, security, and support data. Professionals and businesses who record information about their own clients, patients, students, or staff inside MyTracksy remain responsible for that information; MyTracksy processes it on their instructions to provide the service. Privacy requests: info@mytracksy.com.

Data the product handles

Account and profile data such as email, display name, profession, verification fields, preferences, and profile media.
Financial and operational records you enter, including transactions, invoices, schedules, client or patient records, notes, documents, and profession-specific workflow data.
Clinic-to-doctor appointment requests, which may contain patient name, phone, age, reason, date, and time.
Subscription, payment-attempt, security, abuse-prevention, audit, usage, and diagnostic records needed to operate and protect the service.

Where data is stored

Some profession records are local-first and remain in the browser’s IndexedDB on that device.
Selected signed-in records are stored in account-scoped Firebase services. Static PWA caches do not intentionally store authenticated Firestore responses.
Information sent to payment, AI, messaging, map, or other integrations is processed by those providers as needed for the feature the user starts.
Optional Firebase Analytics is off by default. A visitor may opt in for that browser through the Privacy choices control and may withdraw the choice there. Advertising storage and personalization remain disabled.

Purposes

Data is used to authenticate accounts, provide the requested workspace and reports, synchronize enabled records, process user-started AI or payment features, send requested notifications, prevent abuse, investigate failures, and support customers.

Retention and deletion

MyTracksy attempts to remove the signed-out account’s local IndexedDB and local-storage records from that browser. If cleanup fails, the app warns the user to clear the site’s browser data before sharing the device.
Raw recordings waiting in the active on-device audio queue are removed at app startup once they reach 24 hours, regardless of upload state. A successful upload removes the local copy immediately. The voice-processing worker requests deletion of its cloud source object after every processing outcome and retries when that cleanup fails.
New AI voice-note derivatives do not store the raw transcript or the model’s patient-identifier field. The application applies a separate name-minimization pass to summaries, tasks, and tags, marks copied briefing identity as withheld, and adds a 30-day expiresAt field to processed notes and action items. App restore and briefing code ignore expired derivatives. These application controls do not physically delete Firestore documents by themselves: TTL policies for the clinical_notes and action_items collection groups must be enabled and verified with the provider before automatic cloud deletion can be relied on.
Rejected clinic appointment requests erase patient identity fields immediately through the protected server endpoint. Accepted or pending cloud requests carry a 365-day expiry field; automatic Firestore TTL deletion must be enabled and verified operationally before it can be relied on.
Other cloud records remain while the account or relevant workflow is active, until the user deletes them where the product supports deletion, or until a verified deletion request is completed. Limited billing, security, or audit evidence may be retained where reasonably necessary or legally required.

Payments and service providers

PayHere (Sri Lanka) processes card and online payments on behalf of SafeNet Creations. Card numbers are entered on PayHere’s pages and are never stored by MyTracksy; we keep only the order reference, amount, status, and, for saved-card features you enable, a masked card summary (card type and last four digits).
Google Firebase / Google Cloud hosts authentication, the database, file storage, and server functions. Data is stored in Google Cloud regions that may include Mumbai (asia-south1) and the United States.
Resend delivers account emails such as verification, approval, billing, and pilot notices from mytracksy.com addresses.
Meta WhatsApp Business Platform delivers WhatsApp notifications you opt in to, and receives the phone number and message content needed to deliver them.
AI providers (OpenAI, Google Gemini) receive only the text or audio you submit when you start an AI feature; profession AI features minimize identifiers before sending.
Google Maps is used for user-entered addresses in schedule and traffic features.

These providers may process data outside Sri Lanka. We use each provider only for the feature that needs it and under its published data-processing terms.

Device permissions, cookies, and local storage

MyTracksy does not request your location, contacts, SMS, call logs, or photo library.
Camera access is used only when you tap to scan a receipt or document, and microphone access only when you tap to record a voice note. Notifications and biometric unlock are optional and switched on by you in Settings.
The app uses essential browser storage (IndexedDB and local storage) to keep your records available offline and to remember sign-in and preferences. Analytics cookies and identifiers are off unless you opt in through the Privacy choices control; no advertising cookies are used.

Security and access

MyTracksy uses Firebase Authentication, account-scoped database and storage rules, server-authoritative payment and medical endpoints, and a device privacy-lock option. No internet service or local device storage can be guaranteed completely secure. Users should protect their sign-in method, device, exports, and recovery channels.

Professional and minor data

Clinics, doctors, tutors, firms, and other workspace operators decide what client, patient, student, or employee data to enter. They must have an appropriate basis and authority, provide any required notice, limit access, and avoid entering data that is not necessary. Parent or guardian authority must be confirmed where a tutor records a minor’s contact data.

Your choices and requests

You may ask for information about your account data or request correction, export, or deletion where applicable. We may need to verify the requester’s identity and clarify whether the request concerns the MyTracksy account or records controlled by a professional using MyTracksy.

Contact

For a privacy request, billing question, or refund-related request, email info@mytracksy.com or WhatsApp 070 373 6555. Sri Lanka’s official sources include the Data Protection Authority and the Personal Data Protection Act, No. 9 of 2022.

Changes

We may update this notice when product behavior, providers, or applicable requirements change. The date above identifies the published version.