Privacy Policy

Effective August 14, 2026

This Privacy Policy explains how TrackVis (“we”, “us”) collects, uses, and protects information when you use trackvis.app and related services (the “Service”).

1. Summary

• Your song files are never stored on our servers, in any form — editing, saving as a template, or exporting.
• Photos and videos are not stored while you are simply editing. If you save a scene as a reusable template, its images ARE uploaded and kept on our servers so the template can be reapplied later — see Section 2 below.
• Exported MP4 files are not stored. The file exists on our server only long enough to be converted and downloaded, then it is deleted — see Section 3 below for exactly when.
• We do store your account email, saved layout settings, export usage metadata, and billing records needed to run the Service.
• Payments are processed by Stripe; we do not store full card numbers.
• We record how you use the editor interface to find what is confusing — but never your artwork, your audio, or anything you type.

2. Information we collect

Account information. When you sign in with a magic link, we receive your email address and a user identifier from our auth provider (Supabase).

Layout settings. If you are signed in, we sync your editor preferences (colors, text, wave settings, logo image as encoded data, etc.) so you can restore them on another device.

Saved templates. If you save a scene as a personal template ("My Templates"), its photos and images are uploaded to our storage so the template can be reapplied later — this is the one case where your uploaded visuals are kept on our servers. Song files are never included: a template stores no audio, and applying one later uses whatever track you have loaded at the time.

Export metadata. When you export MP4, we log whether the export succeeded, approximate output size, clip duration, and timestamp — not the video file itself.

Billing information. Stripe provides customer and subscription identifiers, plan status, and payment status. Stripe’s privacy policy applies to payment data: stripe.com/privacy.

Technical data. Our host (Render) and error monitoring (Sentry, if enabled) may process IP addresses, request logs, and error diagnostics to operate and secure the Service.

Product analytics. We use PostHog to understand how the editor is used — for example that a template was applied or an export completed, along with your device type, browser, approximate location derived from IP, and a user identifier. We use this to find where the product is confusing or broken.

Session recordings. PostHog also records how you interact with the editor interface — clicks, scrolling, navigation, and page layout — so we can see where people get stuck. Two limits apply by design:

• Your creative work is not recorded. Your photos, videos, waveform, and the text you place are drawn on a canvas, and canvas content is excluded from recording. The finished design never appears in a recording.
• What you type is not recorded. All form fields are masked, as are uploaded file names — so song titles, artist names, lyrics, and email addresses are not captured.

Recordings are retained for 30 days and then deleted. If you would prefer not to be recorded, email hello@trackvis.app and we will exclude your account.

Local browser storage. The editor also saves settings in your browser (localStorage) for faster loading. You can clear this in your browser settings.

3. Information we do not collect

• Permanent storage of your source audio, in any form
• Permanent storage of your source photos or video, while editing (see Section 2 for the one exception: images inside a saved personal template)
• Permanent storage of exported video files
• Sale of personal information to third-party advertisers

During MP4 conversion, your browser sends a temporary video file to our server for encoding. That file, and the finished MP4, are deleted the moment your download finishes. If a file is exported but never downloaded, it is automatically deleted no later than 30 minutes after conversion.

4. How we use information

• Authenticate you and sync settings across devices
• Enforce export quotas and subscription limits
• Process payments and manage subscriptions via Stripe
• Monitor reliability, prevent abuse, and fix errors
• Understand how the editor is used so we can improve it
• Respond to support requests

5. Legal bases (EEA/UK users)

Where GDPR applies, we process data based on: contract performance (providing the Service), legitimate interests (security, analytics, fraud prevention), and consent where required (e.g. optional communications).

6. Sharing

We share data only with service providers that help us operate the Service:

• Supabase — authentication, database, and storage for saved template images
• Stripe — payments and subscriptions
• Render — application hosting
• Sentry — error reporting (if configured)
• PostHog — product analytics and session recordings

We may disclose information if required by law or to protect rights and safety.

7. Retention

• Account data — kept until you delete your account
• Export logs — deleted when your account is deleted (database cascade)
• Saved template images — kept until you delete the template, or your account (deleting your account removes them too)
• Exported MP4 files — deleted the moment your download finishes, or within 30 minutes if never downloaded
• Session recordings — 30 days, then deleted
• Stripe records — retained by Stripe per their policies and tax/legal requirements
• Server logs — typically rotated by our host within a limited period

We do not currently run automated expiry on inactive accounts; you may delete your account at any time from the Account page.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing.

Delete account: Account → Delete account (cancels active subscriptions when possible, then removes your auth user and app data).

Other requests: contact support. We will respond within a reasonable time as required by law.

9. Security

We use HTTPS, row-level security on user data in our database, and server-side secret keys for privileged operations. No method of transmission or storage is 100% secure.

10. Children

The Service is not directed to children under 13 (or 16 in the EEA where applicable). We do not knowingly collect data from children.

11. International transfers

Our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses offered by providers.

12. Changes

We may update this policy. The “Effective” date above will change when we do. Continued use after updates constitutes notice of the revised policy.

13. Contact

Privacy questions: contact support.