Privacy Policy

Last updated: August 20, 2026

trakd ("we", "our", or "us") operates the trakd mobile application and website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Information We Collect

We collect information in the following ways:

• Account Information: When you create an account, we collect your email address, username, and display name. If you sign in with Apple or Google, we receive your name and email address from the respective provider.
• Profile Photos: If you upload a profile photo, we access your device camera or photo library (with your permission) and store the image on our servers.
• Audio Data: When you start track identification or Record a Set, Trakd captures short sound samples from your microphone while the feature is active. For an immediate result, the sample is transmitted securely to the music-recognition providers named below. Unless you separately choose Keep hunting and notify me after a failed identification, Trakd does not retain the recording after the live request. If you make that choice, Trakd stores the approximately 12-second recording in private Supabase object storage, links it to your account and failed search, and uses it only to retry music identification with ACRCloud, compare repeated opted-in misses, investigate identification quality, and notify you if the track is found. A recording may incidentally include nearby voices; Trakd does not use it to transcribe speech, identify speakers, create voiceprints, infer sensitive traits, advertise, or train unrelated models. If you are offline during Record a Set, samples remain in protected, backup-excluded app storage only until they can sync or expire after 24 hours.
• Approved Broadcast Monitoring Data: Separately from in-app microphone recognition, Trakd may use ACRCloud to monitor a limited set of official public streams or broadcasts for which we have documented a rights-holder or other lawful monitoring basis. ACRCloud analyzes the stream to group recurring unidentified content. Trakd stores derived information such as fingerprints, timestamps, recurrence counts, source references, labels, and review decisions. Trakd does not download or store ACRCloud recording clips by default, and user microphone samples are never used in this monitoring program.
• Optional Venue Location: If you tap Find Nearby Venues while preparing a recorded set, Trakd rounds your current coordinates to an approximate area and sends that approximate location to OpenStreetMap's Overpass service to suggest nearby venue names. If no venue is found, your device's location service uses the same rounded location to suggest an area. Trakd saves only the venue text you choose with your set, not your coordinates.
• Usage Data: We automatically collect information about how you interact with the app, including sets viewed, tracks saved, contributions, and social interactions (follows, likes).
• Device Information: We collect device type, operating system version, and anonymous crash/performance data to improve the app.
• Website Advertising Data: If you choose to allow advertising cookies on our website, the TikTok Pixel may receive page views, the page URL and referring page, browser and device details, IP-derived location, cookie or advertising identifiers, and conversion events that we configure. We do not load the TikTok Pixel before you allow it.
• Spotify Data: If you connect your Spotify account, we access your profile information and the ability to create and modify playlists on your behalf. Your Spotify credentials are stored securely on your device and are never sent to our servers.

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the trakd Service
• Identify music tracks using audio fingerprinting
• With your separate permission, retry a failed identification, compare it with other opted-in misses, and notify you if the track is later found
• Detect recurring unidentified music in approved public or authorized broadcasts so it can be researched and credited
• Personalize your experience and deliver relevant content
• Measure the effectiveness of TikTok advertising and, when you allow it, build or reach advertising audiences
• Send you updates, marketing communications, and other information related to the Service (you may opt out at any time)
• Monitor and fix bugs, crashes, and performance issues
• Respond to your comments, questions, and support requests

Legal Basis for Processing (EEA/UK Users)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contractual Necessity: Processing your account information and usage data is necessary to provide you with the trakd Service as described in our Terms of Service.
• Legitimate Interest: We process device information, crash reports, and usage analytics to improve our Service, detect bugs, and ensure platform security.
• Legitimate Interest or Authorization: We process derived monitoring metadata from selected official public or rights-holder-authorized broadcasts to research recurring unidentified music, improve catalog coverage, and support attribution. We document the source and monitoring basis before activation, limit the program to approved sources, and provide a way for stream operators or rights holders to object.
• Consent: We rely on your consent for marketing communications and microphone access for track identification or Record a Set. Retaining a failed-identification recording requires a separate per-hunt choice; declining does not affect normal live identification. You can withdraw that consent and delete a saved clip from Audio Hunts at any time.
• Website Advertising Consent: We load the TikTok Pixel and its advertising cookies only after you choose Allow. You can decline or withdraw that choice at any time through Privacy choices on the website.

Third-Party Services

We use the following third-party services to operate trakd. Each may receive data as described:

• Supabase: Database hosting, authentication, and private object storage. Your account data and usage data are stored on Supabase infrastructure. If you opt in to Keep hunting and notify me, the retained recording is stored in a separate private bucket with a fixed deletion deadline and is not made public. Supabase Privacy Policy
• ACRCloud: Audio fingerprinting, live and opted-in retry identification, and approved broadcast monitoring. A short audio sample is sent to ACRCloud for live recognition. If you choose Keep hunting and notify me after a miss, the retained recording may be sent again for retry identification until it is found, you delete it, or it expires. This user-audio path is handled separately from broadcast monitoring. For selected official public or rights-holder-authorized streams, ACRCloud may process stream audio and make limited recording excerpts available within its monitoring service so recurring unidentified content can be reviewed. Trakd's default workflow does not request, download, or store those broadcast excerpts; it receives and stores derived metadata only. ACRCloud Privacy Policy
• AudD: Fallback music recognition for the immediate live search. AudD receives the live sound sample only when configured for the identification request; it is not used by Trakd's first retained-audio retry release. AudD Privacy Policy
• OpenStreetMap Overpass: Optional venue lookup. When you request nearby venue suggestions, an approximate rounded location is sent to the Overpass service. OpenStreetMap Foundation Privacy Policy
• Sentry: Error monitoring and crash reporting. We collect anonymous crash reports and performance data (no personally identifiable information) to identify and fix bugs. Sentry Privacy Policy
• Spotify: Music data integration and playlist export. When you connect your Spotify account, we interact with the Spotify API on your behalf. Spotify Privacy Policy
• Apple Music: Music catalog data. We use the Apple Music API to provide track metadata, album artwork, and audio previews. Apple Privacy Policy
• Apple Sign-In: If you sign in with Apple, we receive your name and email address (or Apple's private relay email) as authorized by you. Apple Privacy Policy
• Google Sign-In: If you sign in with Google, we receive your name, email address, and profile photo from your Google account. Google Privacy Policy
• Vercel: Web hosting and serverless functions. Vercel processes web requests to deliver our Service. Vercel Privacy Policy
• Expo: App update delivery. Your device may contact Expo's servers to check for over-the-air updates. Expo Privacy Policy
• TikTok: Advertising measurement on our website. If you choose Allow, the TikTok Pixel receives website and browser data so we can measure campaigns and use TikTok advertising features. TikTok may use cookies and other identifiers under its own terms. TikTok Privacy Policy

RevenueCat

We use RevenueCat to manage in-app subscriptions and purchases. RevenueCat processes your purchase history, subscription status, and a pseudonymous app user ID to manage your subscription. RevenueCat does not receive your name or email address. For more information, see RevenueCat's Privacy Policy.

Advertising Cookies and Your Choices

The TikTok Pixel is optional. On your first visit, you can choose Allow or Decline. If you allow it, we store that choice in your browser and load the Pixel; if you decline, we do not load it. Use the Privacy choices control on the website to change your decision later. Withdrawing consent stops future TikTok Pixel collection from our website, but does not delete data TikTok previously received. You may also contact privacy@trakthat.app with a privacy request.

International Data Transfers

Your data may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from your jurisdiction. When we transfer data outside the European Economic Area, we rely on Standard Contractual Clauses and our service providers' compliance with recognized data protection frameworks to ensure appropriate safeguards are in place.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. An opted-in failed-identification recording is deleted within 24 hours after a verified match, within 24 hours after you delete it or withdraw consent, or no later than 30 days after capture if it remains unresolved. Account deletion also queues linked recordings for deletion within 24 hours. Temporary processing files follow the same or a shorter schedule; inaccessible disaster-recovery copies, if any, expire within 35 days. Limited consent and deletion records without audio may be retained for up to 24 months to document the request and our response. You can delete your account at any time from Settings. Some anonymized or aggregated data may be retained for analytics only when it cannot reasonably identify you. Derived broadcast-monitoring metadata is retained while needed to investigate repeated unknown content, maintain attribution and review history, respond to rights-holder concerns, or meet legal obligations; Trakd does not retain the monitored stream audio or ACRCloud recording clips by default. If an in-app deletion control is unavailable, contact privacy@trakthat.app.

Broadcast Source Requests

If you operate a monitored stream, represent a rights holder, or believe a source should not be included in our approved broadcast-monitoring program, contact privacy@trakthat.app. Please identify the stream and your relationship to it. We will review the request, pause monitoring when appropriate, and work with ACRCloud on deletion or restriction requests that apply to data held within its service.

Data Security

We implement technical and organizational measures including encryption in transit, encryption at rest for retained audio, private storage separated from ordinary analytics, narrowly authorized automated access, and access and deletion logging. Retained recordings and playable links are not placed in analytics, crash reports, support messages, or agent prompts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate data
• The right to request deletion of your data
• The right to restrict processing of your data
• The right to object to processing based on legitimate interest
• The right to data portability
• The right to withdraw consent at any time
• The right to opt out of marketing communications
• The right to lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at privacy@trakthat.app.

Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt-Out of Sale or Sharing: We do not sell personal information for money. Some state laws may treat advertising data sent through the TikTok Pixel as sharing for cross-context behavioral advertising. Decline or withdraw advertising consent through Privacy choices to opt out.
• Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise these rights, contact us at privacy@trakthat.app. We will respond within 45 days.

Browser Privacy Signals: Our Service does not currently respond to the legacy "Do Not Track" signal. When the browser exposes Global Privacy Control, our website treats it as a decision to decline advertising cookies.

Children's Privacy

trakd is not intended for use by children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@trakthat.app. We will take steps to delete such information from our servers.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at:

privacy@trakthat.app