Privacy Policy — Let It Track

1. Overview

Let It Track is a personal health and wellness tracking platform. This Privacy Policy explains what information we collect, how it is stored and used, and your rights regarding your data.

We are committed to transparency about our data practices. Let It Track uses a local-first architecture for personal tracking data, meaning your daily tracking stays on your device.

Last updated: August 2026

2. Information We Collect

2.1 Account Information (Server-Side)

When you create an account, we collect and store the following on our servers:

Name — your display name
Email address — used for login, OTP verification and account communication
Phone number — optional, used for account-related communication
Password — stored as a secure hash (never stored in plain text)
Account type — General User or Coach

2.2 Personal Tracking Data (Local Device Storage)

Your daily personal tracking data is stored locally on your device using browser storage (localStorage and IndexedDB). This includes:

Water intake logs
Nutrition and meal tracking entries
Supplement and habit tracking
Sleep records
Weight entries
Daily progress summaries
Personal plan configuration
Meal photos and progress photos
Display name and profile preferences
Reminder configurations

This tracking data stays on your device. It is not automatically uploaded to our servers. If you clear your browser data or switch devices without exporting a backup, this data cannot be recovered.

2.3 Club/Coach Sync Data (Server-Side, Opt-In)

If you join a Coach's Club, a limited set of your tracking information may be synced to the server so your Coach can view your shared progress. This includes:

Daily summary scores (balance score, category completion counts)
Water intake totals
Nutrition, meal, supplement, sleep and weight completion status

You control which categories are shared through granular sharing settings for each Club. You can stop sharing at any time, and you can request permanent deletion of all server-stored tracking data.

Photos are never uploaded to the server. Meal and progress photos remain in your browser's local storage only.

2.4 Subscription & Payment Information (Server-Side)

Subscription plan, status, billing cycle and dates
Payment records including amounts and transaction status
UPI transaction ID (UTR) submitted for payment verification
Payment screenshots (if optionally uploaded for verification)

2.5 Web Push Notifications (Server-Side, Opt-In)

If you enable reminders, your browser's push notification subscription endpoint is stored on the server to deliver scheduled reminders. You can disable reminders at any time.

2.6 Coach Access Requests (Server-Side)

If you request Coach Access, your request is stored on the server for administrator review.

3. How Your Information Is Used

Account management — creating, authenticating and managing your account
OTP verification — sending one-time passwords for login security
Subscription management — tracking your subscription status, billing and payments
Coach/Club functionality — syncing selected progress data with your Coach, delivering assigned plans
Push notifications — delivering reminders you have configured (only if enabled)
Payment verification — verifying UPI payments and activating subscriptions
Platform administration — managing users, subscriptions and platform settings

4. Where Your Data Is Stored

Local Device Storage

Your personal tracking data is stored locally in your web browser using localStorage and IndexedDB. This data never leaves your device unless you explicitly choose to sync it by joining a Club.

Server Storage

Account, subscription, payment, Club membership and selected sync data are stored on our servers in a MySQL/MariaDB database hosted on our infrastructure.

Payment Screenshots

Payment screenshots are stored in a protected server directory. They are not publicly accessible and can only be accessed by authorized administrators for payment verification purposes.

5. Cookies & Similar Technologies

Let It Track uses HTTP-only session cookies for authentication. These cookies:

Are necessary for login and session management
Are not used for advertising or analytics
Cannot be accessed by JavaScript
Are deleted when your session expires or you log out

We do not use third-party cookies, tracking cookies, or advertising cookies.

6. Data Sharing

We do not sell your personal information to third parties.

Coach/Club Sharing

If you join a Club, the sharing settings you configure determine what information your Coach can see. You control these settings and can change them at any time.

Third-Party Services

The following third-party services may process limited data to provide functionality:

Razorpay — payment processing (when enabled by the administrator)
Google Fonts — font delivery for the web interface

These services are subject to their own privacy policies.

7. Security

Passwords are stored as secure hashes and never in plain text
Login requires email, password and a mandatory one-time password (OTP)
Session cookies are HTTP-only and cannot be accessed by JavaScript
Payment screenshots are stored in a protected directory not accessible via direct browser URL
Upload directories are configured to prevent PHP execution
Admin, Coach and Member sessions are role-isolated

While we implement reasonable security measures, no method of electronic transmission or storage is 100% secure. We encourage you to use strong, unique passwords and keep your account credentials confidential.

8. Data Retention

Account data — retained as long as your account is active
Session data — expires automatically based on session configuration
Subscription/payment records — retained for billing and audit purposes
Club sync data — retained while you are an active Club member; deleted when you leave a Club or request deletion
Push notification subscriptions — deleted when you disable reminders
Payment screenshots — retained for a limited period for payment verification, then removed

9. Your Rights

Access — you can view your account information through the app
Export — you can export your local tracking data at any time through Settings
Deletion — you can delete all your local tracking data through Settings. You can also request deletion of your server account by contacting support
Control — you choose what to share with your Coach or Club through granular sharing settings
Purge — you can permanently delete all server-stored tracking data for your account at any time

10. Children's Privacy

Let It Track is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will remove it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected on this page with an updated date. We encourage you to review this page periodically.

12. Contact Us

If you have questions about this Privacy Policy or your data, please contact us through the Contact page or visit cubiczo.com.