Legal

Privacy Policy

Last updated July 29, 2026

TrakPass ("we," "our," or "us") is committed to protecting your privacy. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

We collect information you provide directly and information generated by your use of the app:

• Account information — your name, email address, and password when you create an account.
• Profile information — an optional display name and profile photo.
• Trip and flight data — flight numbers, dates, times, airports, airlines, and any other itinerary details you add or that we extract from your email (with your permission).
• Traveler contacts — names and contact details for travelers you choose to add to the app.
• Email content (optional) — if you connect a Gmail or Outlook account, we access your inbox in read-only mode to find flight confirmation emails. See the section below for full details.
• Location (optional) — approximate device location used only to display your position on the in-app map. We do not store or transmit your location.
• Device information — device type, operating system, and push notification token used to deliver flight alerts to your device.

Email connections (Gmail & Outlook)

When you connect a Gmail or Outlook account, TrakPass requests read-only access to your inbox — specifically the gmail.readonly and Mail.Read scopes. With this access, TrakPass can never send, delete, modify, or label your email.

We use this access only to scan for messages that look like flight confirmations or itineraries. We do not read, store, or transmit the full content of your emails. Only the flight details we extract (airline, flight number, dates, times, airports) are saved to your account — and you review and approve which detected trips to add before anything is saved.

You can disconnect a connected email account at any time from Settings. Disconnecting removes the stored access token from our servers and revokes TrakPass's access directly with Google or Microsoft.

How we use your information

• To provide, operate, and improve TrakPass.
• To send you real-time flight status alerts and notifications you have opted into.
• To allow you to share trip visibility with other TrakPass users you approve.
• To respond to your support requests.
• To detect and prevent fraud or abuse.

We do not sell your personal information to advertisers or other third parties.

Third-party services

TrakPass uses the following third-party services to operate. Each is governed by its own privacy policy:

• Supabase — authentication and secure data storage (supabase.com/privacy).
• FlightAware / AeroDataBox — real-time flight status data. Only flight identifiers (flight number, date) are sent; no personal data.
• Google — OAuth sign-in and Maps / Places API for transit directions (policies.google.com/privacy).
• Microsoft — OAuth sign-in and Exchange email access (privacy.microsoft.com).
• Mapbox — in-app map rendering (mapbox.com/legal/privacy).
• Transit App — nearby transit station data (transitapp.com/privacy).
• Expo (EAS) — push notification delivery (expo.dev/privacy).

Data storage and security

Your data is stored securely on Supabase infrastructure with row-level security enforced at the database level — meaning your data is accessible only to your account. OAuth tokens used to sync email are stored encrypted and are never shared with third parties.

Data retention

We retain your account and trip data for as long as your account is active. You can delete your account and all associated data at any time. Upon deletion, your data is permanently removed from our servers within 30 days.

Deleting your account

You can permanently delete your TrakPass account and all associated data in either of two ways:

• In the app — open TrakPass and go to Settings → Account → Delete Account, then confirm.
• On the web — submit a request at trakpass.app/delete-account, no app or sign-in required.

Deletion removes your account record, profile, trips and flight data, traveler contacts, connected email (Gmail/Outlook) tokens, and push notification tokens. Encrypted backups may hold residual copies for up to 30 days before rolling off automatically. Anonymized usage counts that cannot be linked back to you, and any records we are legally required to keep, may be retained.

Full account deletion instructions and request form →

Children's privacy

TrakPass is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

Your rights

Depending on your location, you may have the right to access, correct, or delete the personal information we hold about you. To exercise these rights, contact us at the address below. We will respond within 30 days.

Changes to this policy

We may update this policy from time to time. When we do, we will update the "last updated" date at the top of this page. Continued use of TrakPass after changes are posted constitutes your acceptance of the revised policy.