Draft: not legal advice, pending review. Version: 2026-01-01 Last updated: 2026-10-10

Privacy Policy

Introduction

Trakart ("we," "us") explains here how we collect, use, share, and protect personal information when you use our Service. This Policy supplements our Terms of Service.

Controller

The data controller is Trakart [legal entity and address — placeholder pending incorporation counsel].

For EU/UK users, contact [EU/UK representative — placeholder if required under Article 27 GDPR].

Information we collect

• Account data: email, authentication identifiers (via Supabase), username, display name, bio, profile images, date of terms acceptance.
• Content and activity: posts, comments, likes, follows, shares, reports you file, and related metadata.
• Technical data: device/browser type, IP address, timestamps, cookies and similar technologies (see Cookie Policy).
• Communications: support messages and transactional emails (e.g. account deletion confirmation).
• Safety and moderation: automated classification scores, moderation decisions, evidence logs where required by law.

We do not intentionally collect data from children under 13.

How we use information

| Purpose | Examples | Legal basis (GDPR — draft for counsel) | |---|---|---| | Provide the Service | Hosting, feeds, social features | Contract | | Safety and integrity | Automated moderation, reports, blocks | Legitimate interests / legal obligation | | Improve the Service | Analytics (with consent where required) | Consent / legitimate interests | | Legal compliance | NCMEC reporting, DMCA, law enforcement requests | Legal obligation | | Communications | Security alerts, service updates | Contract / legitimate interests |

Product analytics

We measure how people use key features, such as signing up, publishing a post, adding a CV section, sharing a profile, or sending a credit, so we can find and fix what gets in the way. We use PostHog as our processor, on PostHog Cloud in the EU region (hosted in the European Union, `eu.i.posthog.com`).

• Browser analytics need your consent. PostHog loads and sends events only after you choose Accept all or turn on Analytics in the cookie banner. Until then, nothing is sent to PostHog. You can withdraw consent at any time in cookie settings. We then stop collecting and clear the analytics identifier stored in your browser.
• What is sent from your browser. An event name, such as "signup completed", and a small set of choices that identify nothing about you, for example which kind of section you added or whether a search used filters. Event details never include your name, email address, handle, post text, message text or search terms.
• Identifiers. Before you sign in, PostHog uses a random identifier stored in your browser. After you sign in, it uses your Trakart user ID so that events link to your account. PostHog does not create a person profile for visitors who have not signed in.
• No IP addresses, no session recordings, no automatic click capture. We configure PostHog so that it does not store IP addresses, does not record sessions, and does not automatically capture clicks, page text or input values. Browsers that send a Do Not Track signal are not tracked by PostHog.
• Server-side events. When a post is published or a credit is accepted, our servers send a short event, such as "post published" with the post type, keyed by your user ID. These events contain no personal information beyond that ID. They are sent from our servers, so PostHog sees our server's address, not yours. [Counsel to confirm the lawful basis for these events, which we currently treat as legitimate interests in understanding how the Service is used.]

Lawful basis (GDPR, draft for counsel): consent for browser analytics; legitimate interests for the server-side events described above.

Automated decision-making

We use automated tools (including OpenAI and Sightengine) to flag possible policy violations. Outcomes may include holding content for review, rejection, or removal. You may contact us to request human review where required by law.

Sharing and subprocessors

We use service providers who process data on our instructions, including:

Supabase (auth/database), Cloudflare (storage/CDN), Mux (video), Sightengine and OpenAI (moderation), PostHog (analytics), Sentry (errors), Resend (email), Vercel (frontend hosting), and our API hosting provider (e.g. Fly.io).

We require appropriate contracts and, for international transfers, mechanisms such as Standard Contractual Clauses or the EU–US Data Privacy Framework where applicable. A current subprocessor list is maintained in our compliance documentation and will be linked here before launch.

We do not sell your personal information for money. Sharing for cross-context behavioral advertising is not our current model; if practices change, we will update this Policy and offer opt-out rights required in California and similar laws.

Retention

• Active accounts: for the life of the account unless you delete it.
• Deleted accounts: content is hidden immediately; permanent deletion after a 30-day grace period, unless you restore the account.
• Moderation evidence (child safety): preserved up to one year or longer if required by law.
• Data exports: files stored up to 7 days; download links expire after 24 hours.
• Logs: retained per our infrastructure configuration (target to be published).
• Product analytics events (PostHog): kept for [12 months — retention period to be set in the PostHog project before launch], then deleted.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object, port data, and withdraw consent. In the app: use Download my data and Delete account in settings. By email: contact our privacy address [placeholder].

We respond within timelines required by law (e.g. 30 days under GDPR). See our data subject request procedures for COPPA and complex cases.

Security

We use industry-standard measures including encryption in transit, access controls, and private storage for exports and sensitive evidence. No method is 100% secure.

International transfers

We may process data in the United States and other countries where our providers operate. We implement safeguards as described above.

California privacy rights

California residents may have rights to know, delete, correct, and opt out of sale/sharing. We will provide a "Do Not Sell or Share My Personal Information" link if our analytics or partnerships require it after counsel review.

Changes

We will post updates with a revised "Last updated" date. Material changes may require renewed consent where applicable.

Contact

Privacy inquiries: [privacy@trakart.app — placeholder]

Safety contact (CSAM reports coordination): [safety@trakart.app — placeholder]