Privacy Policy

Last updated: 18 October 2026. This notice explains how the MyTracksy web app and installable PWA, and the MyTracksy phone apps for Android and iPhone (MyTracksy Personal, Cashflow and Wealth, and MyTracksy Work for professionals), handle personal data. It does not certify that a customer’s own professional workflow is legally compliant.

Who is responsible

MyTracksy is operated by SafeNet Creations, No. 354 Stanley Road, Jaffna 40000, Sri Lanka, which is the controller of your account, billing, security, and support data. Professionals and businesses who record information about their own clients, patients, students, or staff inside MyTracksy remain responsible for that information; MyTracksy processes it on their instructions to provide the service. Privacy requests: info@mytracksy.com.

Data the product handles

Account and profile data such as email, display name, profession, verification fields, preferences, and profile media.
Financial and operational records you enter, including transactions, invoices, schedules, client or patient records, notes, documents, and profession-specific workflow data.
Clinic-to-doctor appointment requests, which may contain patient name, phone, age, reason, date, and time.
Subscription, payment-attempt, security, abuse-prevention, audit, usage, and diagnostic records needed to operate and protect the service.

The MyTracksy phone apps (Personal, Cashflow, Wealth)

On your phone first. Your records, budgets, bills, goals and settings are kept in a database on your phone. You can use the app without an account. If you sign in (Google, Apple, or your phone number with a one-time code), your records, profile and purchases are synced to your MyTracksy account in Firebase (Google Cloud) so they can be restored on a new phone; the sign-in method gives us your name, email address or phone number. You can delete the account and every synced record from inside the app (You → Delete account) or through the data deletion page.
Google Drive backup is optional and writes a backup file to your own Google Drive, under your control; we do not keep a copy.
Bank SMS. On any phone you can paste a bank or wallet message and only that message is read. On Android you can also switch on automatic reading: the app then asks for the SMS permission and reads only messages from banks and wallets (a first scan of the last 30 days, then new bank messages while the app is open) to turn them into records. Other messages are ignored; the app never sends, forwards or deletes SMS, and does not upload your inbox. Messages are read on your phone. Only when the on-device reader cannot understand a bank message is that message’s text sent to Google Gemini to be read; it is used for that one request and is not stored by us. The record made from a message keeps a short copy of its text (up to 300 characters) so you can see where the record came from; that copy stays with the record on your phone and, if you are signed in, in your account, and is deleted with the record. Versions of the app distributed through Google Play may ship without the SMS permission until Google approves it; pasting works in every version.
Voice. A voice entry is a recording of up to 8 seconds made only while you hold the microphone button. It is sent to our server function and to Google Gemini to be understood, the resulting record is saved on your phone, and the recording is not kept after the result.
Receipts, bills, LankaQR and bank statements. A receipt photo or a statement file you choose is sent to Google Gemini to extract the amounts and is not stored by us; LankaQR codes are decoded on your phone. The record it produces stays on your phone (and in your account if you sign in).
Assistant and weekly coach. To answer a question or write your Sunday note, a summary of your spending (categories, totals, merchants and goals — never sign-in details or card numbers) is sent to Google Gemini; the reply is shown to you and the summary is not stored by us.
Purchases and identifiers. Subscriptions and AI packs are sold through Google Play Billing (Android) or the App Store (iPhone), which handle payment details; we never see card numbers. RevenueCat manages entitlements and receives the purchase token, product identifier and a random app-user identifier (your account identifier when you sign in). Firebase App Check (Google Play Integrity) attests your device when the app talks to our servers. The phone apps carry no advertising identifier, no advertising SDK and no third-party analytics or crash-reporting SDK.
Phone permissions. Microphone (voice entry, only while you hold the button), camera (receipts and LankaQR), photos (only the receipt you pick), notifications (bill, budget and goal reminders, optional), fingerprint or face unlock (app lock, verified on your phone only) and, on Android only when you switch on automatic bank-SMS reading, SMS. The phone apps do not request your location, contacts or call logs.

MyTracksy Work (phone app for professionals)

Same account as the website. MyTracksy Work signs you in to your MyTracksy account (email, Google, Apple, or your phone number with a one-time code) and works on the same records as your web workspace. Your profession, income and expense entries, categories and, for doctors, channeling sessions (hospital, date, number of patients, amounts expected and received, and whether the WHT/AIT certificate was collected) are saved to your account in Firebase (Google Cloud). Entries you add offline wait on your phone until they sync. The app asks only for the number of patients, never their names or details. The sample data (“Look around first”) saves nothing to your account.
Purchases and identifiers. Pro plans are sold through Google Play Billing (Android) or the App Store (iPhone), which handle payment details; we never see card numbers. RevenueCat manages the entitlement and receives the purchase token, product identifier and your account identifier. Firebase App Check (Google Play Integrity on Android, App Attest on iPhone) attests your device when the app talks to our servers. MyTracksy Work has no AI features and carries no advertising identifier, no advertising SDK and no third-party analytics or crash-reporting SDK.
Phone permissions. Fingerprint or face unlock only (app lock, verified on your phone). MyTracksy Work does not ask for the microphone, camera, photos, SMS, notifications, location, contacts or call logs.
Deleting your account. In the app, More → Delete my account deletes your income, expenses, categories, channeling sessions and sign-in straight away; your profile, plan and billing history are removed by our team within 30 days, except records the law requires us to keep. You can also use the data deletion page.

Where data is stored

Some profession records are local-first and remain in the browser’s IndexedDB on that device.
Selected signed-in records are stored in account-scoped Firebase services. Static PWA caches do not intentionally store authenticated Firestore responses.
Information sent to payment, AI, messaging, map, or other integrations is processed by those providers as needed for the feature the user starts.
Optional Firebase Analytics is off by default. A visitor may opt in for that browser through the Privacy choices control and may withdraw the choice there. Advertising storage and personalization remain disabled.

Purposes

Data is used to authenticate accounts, provide the requested workspace and reports, synchronize enabled records, process user-started AI or payment features, send requested notifications, prevent abuse, investigate failures, and support customers.

Retention and deletion

MyTracksy attempts to remove the signed-out account’s local IndexedDB and local-storage records from that browser. If cleanup fails, the app warns the user to clear the site’s browser data before sharing the device.
Raw recordings waiting in the active on-device audio queue are removed at app startup once they reach 24 hours, regardless of upload state. A successful upload removes the local copy immediately. The voice-processing worker requests deletion of its cloud source object after every processing outcome and retries when that cleanup fails.
New AI voice-note derivatives do not store the raw transcript or the model’s patient-identifier field. The application applies a separate name-minimization pass to summaries, tasks, and tags, marks copied briefing identity as withheld, and adds a 30-day expiresAt field to processed notes and action items. App restore and briefing code ignore expired derivatives. These application controls do not physically delete Firestore documents by themselves: TTL policies for the clinical_notes and action_items collection groups must be enabled and verified with the provider before automatic cloud deletion can be relied on.
Rejected clinic appointment requests erase patient identity fields immediately through the protected server endpoint. Accepted or pending cloud requests carry a 365-day expiry field; automatic Firestore TTL deletion must be enabled and verified operationally before it can be relied on.
In the phone apps, voice recordings, receipt photos, statement files and bank messages sent for reading are used for that request only and are not retained by us (apart from the short message copy kept with a record made from a bank SMS, described above); records you delete in the app are removed from your phone and, if you are signed in, from your account. Deleting the account in MyTracksy Personal removes your synced records, profile and sign-in immediately; MyTracksy Work deletion is described in its section above.
Other cloud records remain while the account or relevant workflow is active, until the user deletes them where the product supports deletion, or until a verified deletion request is completed. Limited billing, security, or audit evidence may be retained where reasonably necessary or legally required.

Payments and service providers

PayHere (Sri Lanka) processes card and online payments on behalf of SafeNet Creations. Card numbers are entered on PayHere’s pages and are never stored by MyTracksy; we keep only the order reference, amount, status, and, for saved-card features you enable, a masked card summary (card type and last four digits).
Google Firebase / Google Cloud hosts authentication, the database, file storage, and server functions. Data is stored in Google Cloud regions that may include Mumbai (asia-south1) and the United States.
Resend delivers account emails such as verification, approval, billing, and pilot notices from mytracksy.com addresses.
Meta WhatsApp Business Platform delivers WhatsApp notifications you opt in to, and receives the phone number and message content needed to deliver them.
Google Play Billing and the Apple App Store process phone-app subscriptions and AI packs under their own terms; RevenueCat (United States) manages those entitlements as described in the phone apps section.
AI providers (OpenAI, Google Gemini) receive only the text, image or audio you submit when you start an AI feature (in the phone apps: Google Gemini only); profession AI features minimize identifiers before sending.
Google Maps is used for user-entered addresses in schedule and traffic features.

These providers may process data outside Sri Lanka. We use each provider only for the feature that needs it and under its published data-processing terms.

Device permissions, cookies, and local storage

MyTracksy does not request your location, contacts, or call logs. The web app does not request SMS or your photo library; the Android app asks for SMS access only if you switch on automatic bank-SMS reading, and the phone apps open your photos only when you pick a receipt (see the phone apps section above).
Camera access is used only when you tap to scan a receipt, document or LankaQR code, and microphone access only when you tap or hold to record a voice note. Notifications and biometric unlock are optional and switched on by you in Settings.
The app uses essential browser storage (IndexedDB and local storage) to keep your records available offline and to remember sign-in and preferences. Analytics cookies and identifiers are off unless you opt in through the Privacy choices control; no advertising cookies are used.

Security and access

MyTracksy uses Firebase Authentication, account-scoped database and storage rules, server-authoritative payment and medical endpoints, and a device privacy-lock option. No internet service or local device storage can be guaranteed completely secure. Users should protect their sign-in method, device, exports, and recovery channels.

Professional and minor data

Clinics, doctors, tutors, firms, and other workspace operators decide what client, patient, student, or employee data to enter. They must have an appropriate basis and authority, provide any required notice, limit access, and avoid entering data that is not necessary. Parent or guardian authority must be confirmed where a tutor records a minor’s contact data.

Your choices and requests

You may ask for information about your account data or request correction, export, or deletion where applicable. We may need to verify the requester’s identity and clarify whether the request concerns the MyTracksy account or records controlled by a professional using MyTracksy.

Contact

For a privacy request, billing question, or refund-related request, email info@mytracksy.com or WhatsApp 070 373 6555. Sri Lanka’s official sources include the Data Protection Authority and the Personal Data Protection Act, No. 9 of 2022.

Changes

We may update this notice when product behavior, providers, or applicable requirements change. The date above identifies the published version.