Privacy Policy for Tracker Pull

Introduction

Tracker Pull ("we," "our," or "us") operates the Tracker Pull mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

Please read this Privacy Policy carefully. By using the App, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Information You Provide

Tracker Pull does not require user registration or authentication. We do not directly collect any personally identifiable information from users through the App interface.

Automatically Collected Information

When you use the App, our backend API automatically collects certain technical and usage information for analytics purposes:

API Analytics Data

Our server automatically logs the following information when the App communicates with our API:

• Request Information:
  • HTTP method (GET, POST, etc.)
  • API endpoint accessed
  • Response status code
  • Response time (milliseconds)
• Technical Information:
  • User agent string (identifies app version and platform)
  • Platform type (iOS, Android, Mobile Web, or Web)
  • App version (via X-App-Version header)
• Anonymous Identifiers:
  • Hashed IP address (one-way SHA-256 hash; the raw IP is never stored)
  • Session hash (pseudonymized session identifier that rotates every 24 hours)
• Event-Related Data:
  • Event IDs, date IDs, track IDs, and class IDs you view
  • These relate to tractor pull events and do not contain personal information

Locally Stored Data

The App stores the following information locally on your device using IndexedDB and localStorage:

IndexedDB Storage

• Cached API Responses: Tractor pull event data, schedules, and results for offline viewing
• Retry Queue: Failed API requests queued for retry when connection is restored
• Metadata: App-specific settings and configuration

localStorage

• Theme Preference: Your light/dark mode selection (stored as "mttpa-theme-preference")

This data never leaves your device and is not transmitted to our servers.

How We Use Your Information

We use the collected information for the following purposes:

1. Service Operation: To provide live tractor pull results and event information
2. Performance Monitoring: To measure API response times and identify slow endpoints
3. Usage Analytics: To understand which features are most popular and which events receive the most views
4. Technical Improvement: To detect errors, crashes, and optimize the user experience
5. Offline Functionality: To cache data locally for viewing without internet connection

Data Retention

• API Analytics: Server-side analytics logs (hashed IP addresses, daily session hashes, and request metadata) are retained for up to 30 months to support multi-year operational analysis of recurring annual events. No personal data is stored. After this period, logs are deleted or further aggregated.
• Crash & Error Reports: Diagnostic events captured by Sentry on our API are retained according to Sentry's default retention (typically 90 days) and contain no user-identifiable information.
• Local Cache: Cached data on your device is automatically cleaned when expired or when you clear the app's data
• Theme Preference: Stored on your device until you clear app data or uninstall the app

Data Sharing and Disclosure

We do NOT sell, trade, or rent your information to third parties.

We may share anonymized, aggregated analytics data (e.g., "1,000 users viewed Event X") but never individual user information.

We may disclose information if required by law or to protect our rights, property, or safety.

Third-Party Services

Backend API

The App connects to a custom Laravel-based API server to retrieve tractor pull event data. This server is operated by Tracker Pull and is subject to this Privacy Policy.

Capacitor Plugins

The App uses the following Capacitor plugins:

• @capacitor/app: For app lifecycle management
• @capacitor/network: To detect online/offline status
• @capacitor/status-bar: For status bar styling
• capacitor-plugin-safe-area: For screen layout

These plugins operate locally on your device and do not transmit data to third parties.

Infrastructure & Sub-Processors

We rely on the following infrastructure providers to operate the service. These providers process data on our behalf and do not use it for their own purposes:

• HostPapa: Hosting for our marketing website and supporting services.
• DigitalOcean: Hosting for the Tracker Pull API and its analytics database.
• Backblaze B2: Content delivery and object storage for event-related images served by the App. No user-identifiable data is stored here.
• Sentry: Server-side crash and error monitoring for the API. Sentry receives stack traces, request paths, and runtime diagnostics, but the App itself does not embed a Sentry client and no end-user identifiers are sent.

At the network level, these providers (DigitalOcean for API requests, Backblaze B2 for image requests, HostPapa for the marketing site) briefly process unhashed IP addresses in order to route network traffic and deliver responses. We do not retain IP addresses in unhashed form, and these providers' standard request logs are subject to their own retention policies.

No Other Third-Party Services

We do NOT use:

• Google Analytics or Firebase Analytics
• Facebook SDK or social media trackers
• Advertising networks
• Client-side crash reporting (e.g. Crashlytics) embedded in the App
• Push notification services

Children's Privacy

The App is neither directed to nor designed for children under 13 and does not knowingly collect personal information from them. The App requires no account, login, name, email, or other identifying input from any user, so we have no mechanism by which a child could submit personal information through the App.

Because all analytics data is pseudonymized at the point of collection (one-way SHA-256 hashed IP addresses and daily-rotating session hashes that are not tied to any account or device), we have no practical means to determine which records, if any, originated from a particular individual — including a child. As a result, we cannot identify, isolate, or delete records belonging to a specific user on request. If a parent or guardian believes a child has been using the App and wishes to stop further data collection, uninstalling the App immediately and permanently ends all collection from that device. Questions can be directed to support@trackerpull.ca.

Security

We implement reasonable security measures to protect your information:

• HTTPS Only: All API communication uses encrypted HTTPS connections
• Hashed IP Addresses: IP addresses are hashed using SHA-256 before storage
• Local-Only Storage: Theme preferences and cached data remain on your device
• No Authentication Required: No passwords or credentials to secure

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Your Privacy Rights

Why individual data requests cannot be fulfilled

Our analytics data is pseudonymized at the point of collection. IP addresses are transformed using a one-way SHA-256 hash before storage and we retain no original values. Session identifiers reset daily and are not tied to any account or device identifier. Because no lookup table or reverse mapping is maintained, we have no practical means to locate, attribute, or delete a record belonging to a specific individual.

This means that the standard rights to access, correct, or delete personal data — as defined under PIPEDA and similar frameworks — cannot be exercised on an individual-record basis, because we have no way to attribute any specific record to a specific user. Where we are able to address such a request without re-identifying users or expanding our data collection, we will do so.

What you can do

• Opt-Out: Uninstalling the App immediately and permanently stops all data collection. No data is collected when the App is not in use.
• Contact Us: If you have questions about our data practices, reach us at support@trackerpull.ca. We will confirm what categories of data exist in our systems and explain why individual records cannot be attributed to you.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be effective when posted to this page. We will update the "Last Updated" date at the top of this policy.

We encourage you to review this Privacy Policy periodically for any changes.

Geographic Scope

This App is primarily intended for users in Canada and is operated in accordance with Canadian privacy law (PIPEDA). Users accessing the App from outside Canada — including in the European Economic Area, the United Kingdom, and the United States — may contact us at support@trackerpull.ca with privacy questions, and we will respond consistent with the principles set out in this policy. By using the App from outside Canada you acknowledge that data may be processed on servers located in Canada or the United States.

Technical Details for App Store Review

For transparency with app store reviewers:

Data Collected

Data NOT Collected

• Name, email, phone number, or address
• Precise location or GPS coordinates
• Photos, videos, or contacts
• Device identifiers (IDFA, Android ID, etc.)
• Payment or financial information
• Health or fitness data
• Browsing history or search history

Compliance

• PIPEDA (Canada): This app complies with Canadian privacy laws
• App Store Privacy Nutrition Labels: See data collection table above
• Google Play Data Safety: See data collection table above