TrackReels Privacy Policy

Last updated: 1 August 2026

Effective date: 1 August 2026

This policy explains what information TrackReels collects, why we collect it, who we share it with, and what you can do about it. It is written in plain English on purpose. If anything here is unclear, email us at support@trackreels.io and we will explain it.

Read this first if you are under 18, or if you are the parent of someone under 18: section 9 is written for you.

1. Who we are and how to contact us

TrackReels is operated by the independent operator of TrackReels, based in the United Kingdom.

For data protection purposes, we are the data controller of the personal information described in this policy.

Purpose	Contact
Privacy questions, data requests	support@trackreels.io
Parent and guardian requests about a child's account	support@trackreels.io
Safety reports, takedowns, abuse	support@trackreels.io
Postal address	available on request from support@trackreels.io
UK ICO registration number	registration pending
EU representative (Art. 27 UK/EU GDPR), if appointed	not appointed, see section 15

We do not currently have a statutory Data Protection Officer.

2. The short version

Athlete profiles, marks, videos, badges and leaderboard positions are public by default. Search engines can find and index them. That is the point of the product, and it is also the biggest privacy decision you make when you sign up. See section 8.
We do not allow anyone under 13 to create an account or appear on TrackReels as a registered user.
If you are 13 to 17, we require a parent or guardian to consent before your profile goes public. See section 9.
We never see or store your card number. Payments are handled by Stripe.
Uploaded video frames and captions are automatically scanned for safety, including by AI models, before and after they go live.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account and everything in it. See section 15.

3. Scope of this policy

This policy covers the TrackReels website at trackreels.io, all subdomains, the public profile pages at trackreels.io/username, our API, and any email or notifications we send you.

It does not cover: third party sites you reach by clicking a link from TrackReels, the platforms whose videos you embed (YouTube, TikTok, Instagram, Facebook), meet result sites we link out to, or anything a college or coach does with information after they have lawfully seen it on a public profile. Once your mark and video are public, we cannot control who copies, screenshots or republishes them.

4. The information we collect

4.1 Account information (you give this to us)

Username. Public. It forms your profile URL, trackreels.io/username.
Password. Stored only as a salted hash (PBKDF2). We cannot read it.
Account role: athlete, recruiter or coach, or brand.
Full name. Public on your profile.
Email address. Required at sign up and never shown on your profile. We use it for password resets, verification links, safety notices and to confirm who you are when you ask for a copy of your data or ask us to delete it.
Gender or competition category. We use this because track and field results, leaderboards and recruiting are organized by sex or competition category. Depending on where you live, this may be treated as sensitive personal information. See section 4.7.

4.2 Athlete profile information

Graduation year (which effectively tells us and everyone else your approximate age)
State or region
Level (high school, college, professional or club)
Events contested
Height and weight (optional)
Bio text you write
Current or committed college, and college preferences
Profile photo or avatar image
Verification status and subscription plan (Free, Premium, Verified Premium)
Account creation date

4.3 Performance and content

Reels, meaning video you upload to us or a video link you embed from YouTube, TikTok, Instagram or Facebook. Embedded videos are never downloaded or copied by us. We store the link and the platform name.
For every reel, the required fields: date, event, mark or time, and caption.
Optional fields: meet name, placement, wind reading and wind legality, timing method (hand or fully automatic), season, results link, video duration.
Whether a mark is flagged as a personal record.
Automatically derived items: leaderboard rank, national and state ranking badges (for example "TR US #1"), achievements, and personal record history.

Uploaded video files are stored in Cloudflare R2. See section 12.

4.4 Social and messaging data

Follows: who you follow and who follows you, and when.
Reactions to reels, including the emoji used.
Direct messages. We store the conversation, who started it, the message text, and timestamps. Direct messages are not end to end encrypted. We can read them, and we will read them when we investigate a safety report, when we are required to by law, and, where a minor is involved, as described in section 9.
In app notifications and their read status.

4.5 Technical and log data (collected automatically)

IP address, approximate location derived from IP (usually country, region or city level), user agent and browser type, device and operating system, referring page, pages requested, timestamps, and error logs.
A session token issued when you log in. It is stored in your browser's localStorage under the key tr_token, and sent to us with each request to keep you logged in.
Request and security logs generated by Cloudflare, including logs created by bot and abuse protection.
Media access logs when a video or avatar is served from storage.

4.6 Payment data

Subscriptions are processed by Stripe. When you subscribe:

You enter your card details directly into Stripe's payment form. TrackReels never receives or stores your full card number, CVC or expiry date.
We receive and store from Stripe: a customer ID, a subscription ID, the plan you are on, subscription status and renewal date, trial start and end dates, the last four digits and brand of your card, the country of your card, and the outcome of each payment.
Stripe is a separate controller for its own fraud prevention and legal compliance purposes. Its privacy policy is at stripe.com/privacy.
The 1 week free trial requires a payment method. Billing terms are in our Terms of Service.

4.7 Sensitive or special category information

We deliberately keep this to a minimum, but note:

Age. Graduation year plus level tells anyone that most athletes on TrackReels are minors. Under UK GDPR, children's data attracts additional protection.
Gender or competition category. Under UK GDPR this can amount to special category data in some contexts, and under California's CPRA some regulators treat it as sensitive personal information.
Height and weight. Optional, and health adjacent. You can leave these blank, and you can delete them at any time.
Images and video of identifiable people. Your face and body appear in your reels. We do not run facial recognition and we do not create or store biometric identifiers or face templates. See section 10.
We do not ask for and do not want: race or ethnicity, religion, health or injury records, disability status, sexual orientation, political opinions, immigration status, social security numbers, or government ID numbers. Do not put these in a bio, caption or message.

4.8 Information about other people

Race, jump and throw video almost always contains other athletes, officials and spectators, some of them minors. When you upload, you are making a decision about them as well as yourself. You must have the right to post the footage, and you must not post video that was recorded where filming was prohibited. Anyone who appears in a video on TrackReels and did not consent can ask us to remove or blur it at support@trackreels.io, and we will act on that request. See sections 9.6 and 15.

5. Where the information comes from

From you, at signup, when you edit your profile, when you post a reel, and when you message someone.
Automatically from your device and our infrastructure, as described in section 4.5.
From a payment provider, once paid plans are switched on. Billing is not enabled today, no payment provider is connected, and we hold no card or billing data.
From other users, for example when a recruiter messages you, follows you or reports you.
From public sources. We do not scrape or import results from Athletic.net, MileSplit, TFRRS or any other results database. Every mark on TrackReels is entered by the athlete. If you give us a link to a published result, we may open it to check a mark you have claimed.

6. How we use your information

To create and run your account and keep you logged in.
To display your public profile, reels, marks and badges.
To calculate leaderboards, rankings, personal records and achievements.
To let recruiters search and filter athletes by event, mark, graduation year, state, level and category.
To deliver direct messaging and notifications.
To take payment, manage trials, and stop or restore access when a subscription changes.
To moderate content and keep minors safe, including automated scanning (section 10) and human review.
To detect and stop fraud, fake accounts, mark falsification, scraping and abuse.
To fix bugs, measure performance and improve the product.
To send service emails such as password resets, safety notices, billing notices and policy changes.
To send product or marketing emails only where you have opted in, and you can opt out at any time.
To comply with law and to respond to lawful requests, court orders and safeguarding obligations.

We do not use your personal information to train third party AI models, and we do not permit our AI moderation providers to train their models on your content. See section 10.

7. Our legal bases for using your information (UK and EU users)

What we do	Legal basis
Create your account, run the service you signed up for, deliver messaging and profiles	Performance of a contract, UK GDPR Art. 6(1)(b)
Take payment, manage subscriptions	Performance of a contract, Art. 6(1)(b)
Publish an athlete profile, marks and leaderboard position where the athlete is a minor	Consent of the holder of parental responsibility, Art. 6(1)(a), together with Art. 8. See section 9
Security, fraud prevention, abuse detection, product improvement, aggregate analytics	Legitimate interests, Art. 6(1)(f), balanced against your rights. A summary of that balancing test is available on request
Automated safety scanning of media and text	Legitimate interests, Art. 6(1)(f), and our legal and safeguarding obligations
Marketing email, non essential analytics and non essential cookies	Consent, Art. 6(1)(a), withdrawable at any time
Keeping billing and tax records, responding to legal requests	Legal obligation, Art. 6(1)(c)
Publishing gender or category, height and weight, where these are treated as special category data	Explicit consent, Art. 9(2)(a), or manifestly made public by the data subject, Art. 9(2)(e).

8. Public by design: profiles, marks and leaderboards

This is the most important thing to understand about TrackReels.

8.1 What is public

Unless you change it, the following is visible to anyone on the internet without logging in:

Your username and profile URL, trackreels.io/username
Your full name, graduation year, state, level, events, and category
Your height, weight, bio, college and college preferences, if you filled them in
Your avatar
Every reel you post, including the video, date, event, mark, caption, meet, placement and wind
Your personal records, badges, achievements, national and state leaderboard positions, follower and following counts

8.2 What is not public

Your password (we never have it in readable form) and session token
Your email address An email address is required at sign up and is used for account recovery and safety notices
Direct messages, which are visible to you, the other participant, and our moderation and safety staff
Payment details, which we largely do not hold at all
Your IP address and technical logs
Your notifications

8.3 Search engines

Public profiles and leaderboards are designed to be indexed by Google, Bing and other search engines. That means a search for an athlete's name may return their TrackReels profile. It also means that copies can persist in search engine caches, in the Internet Archive, and in screenshots or reposts by third parties after you delete the original. We cannot remove those copies. We can only remove what is on our own systems.

8.4 What you can do about it

Do not use your real full name. You can compete under a name you choose. Recruiters do not need your legal name to evaluate a mark, though many will want it eventually.
Leave optional fields blank. Height, weight, bio, college preferences and avatar are all optional.
Understand that there is no private mode. TrackReels does not currently offer a private, recruiters-only or hidden-from-search profile. Every athlete profile is public and can be indexed by search engines. If that is not what you want, do not create a profile. We will tell you here if that changes.
Delete individual reels at any time. Deleting a reel removes it from leaderboards and rankings.
Delete your whole account, which removes your profile and content from public view. See section 14 for what happens next.
After you have deleted something, you can ask Google and Bing directly to refresh or remove their cached copy. We will help if you email support@trackreels.io, but we cannot guarantee the outcome.

8.5 Minors and public profiles

Because most athletes on TrackReels are minors, a public profile means a minor's name, approximate age, state, image and competition schedule are all discoverable together. This is a real safety consideration, not a formality. That is why the consent process in section 9 exists, and why we recommend that athletes under 18 leave the bio, height and weight blank and avoid posting anything that reveals a school name, home town, training schedule or home address.

9. Children's privacy

This is the section we take most seriously. It is written for athletes under 18 and for their parents and guardians.

9.1 Nobody under 13

TrackReels is not directed to children under 13 and we do not knowingly collect personal information from anyone under 13. Under 13s may not create an account, appear on a leaderboard, upload a reel, or send or receive messages. At sign up we collect graduation year rather than date of birth, so our age check is indirect: a graduation year that would put an athlete under 13 is not accepted. We do not currently run a neutral date of birth age gate.

If we learn that we have collected personal information from a child under 13 without verifiable parental consent, as required by the US Children's Online Privacy Protection Act (COPPA) and its rule at 16 CFR Part 312, we will delete that information as quickly as possible, and in any event within 5 business days. Anyone can report a suspected under 13 account to support@trackreels.io and we will investigate.

Note for parents: COPPA is a US federal law that applies to us because our service reaches children in the United States, even though we are based in the United Kingdom.

9.2 Athletes aged 13 to 17: parental consent

If you are 13 to 17, we require the consent of a parent or legal guardian before your profile becomes public, before you can upload a reel, and before you can send or receive direct messages.

How it works:

At signup, an athlete whose graduation year or date of birth indicates they are under 18 must supply a parent or guardian email address.
We email the parent a description of exactly what will be collected and made public, a link to this policy, and a consent link.
The account stays in a restricted state until the parent confirms. In the restricted state the profile is not published, is not indexed, does not appear on leaderboards, and cannot send or receive messages. There is no separate restricted account state in the product today. Every athlete profile is public, and the protections that apply to under-18 accounts are the messaging gates described in section 13 of the Terms rather than a reduced-visibility mode.
We verify a parent or guardian by correspondence with the email address on the account: a confirmation link, and where needed a signed statement returned by email. We do not currently run card-based or document-based identity checks for parental consent.
We record the date, time, method and IP of the consent, and we keep that record for as long as the account exists plus 3 years.
A parent can withdraw consent at any time. When consent is withdrawn we take the profile out of public view immediately and delete the account and its content in line with section 14.

Some US states now impose their own parental consent, age verification, or design duties for minors, and requirements differ by state. We apply the process above to all athletes under 18 rather than trying to vary it state by state.

9.3 What a parent or guardian can do

If you are the parent or legal guardian of a TrackReels athlete under 18, you have the right to:

Review all personal information we hold about your child, including profile fields, reels, marks, messages, follows, reactions and log data.
Correct anything that is wrong.
Refuse to allow further collection or use, which in practice means we deactivate the account.
Delete your child's account and content.
Withdraw consent at any time, without having to give a reason.
Object to your child's profile being indexed by search engines, or to their appearance on public leaderboards, while keeping the account.
Ask us to preserve and review messages sent to or from your child where you have a safety concern.

You do not have to delete the whole account to exercise most of these. You can ask us to remove just the name, just the photo, just one reel, or just the leaderboard listing.

9.4 How a parent makes a request

Email support@trackreels.io with:

Your name and your relationship to the athlete
The athlete's username or profile URL
What you want us to do: review, correct, restrict, delete, or withdraw consent

We will verify that you are the parent or guardian before we act, using we match the request against the email address on the account, and may ask for a signed statement. We deliberately keep verification proportionate, because demanding heavy ID from a worried parent is its own harm, but we will not hand over a minor's private messages to an unverified requester.

We respond within 7 days and complete the request within 30 days. Deletion requests are actioned immediately in terms of public visibility, even if the backend deletion takes longer. We never make access to TrackReels conditional on a child disclosing more personal information than is reasonably necessary to take part.

9.5 Messaging and minors

On the Free plan, a recruiter must message first. Paid plans let athletes initiate conversations.
Messages involving an account we believe belongs to a minor are subject to automated scanning for grooming, sexual content, threats and contact information harvesting, and to human review when the automated system flags them. See section 10.
Parents can request a copy of their child's message history under section 9.3.
Minors, and their parents, can block a user and report a conversation from inside the product. Reports go to support@trackreels.io and are reviewed within 24 hours.
We will report credible child safety concerns to the appropriate authorities, including the National Center for Missing and Exploited Children (NCMEC) for US matters and the Internet Watch Foundation and the NCA CEOP command for UK matters, and we will preserve the relevant data while doing so.

9.6 Minors' right to remove their own content

If you are a registered user under 18 and you live in California, section 22581 of the California Business and Professions Code gives you the right to remove content you posted. This right applies to everyone under 18 on TrackReels, Californians included. Delete the reel yourself, or email support@trackreels.io. As explained in section 8.3, removal from TrackReels does not remove copies that other people have already made.

9.7 No sale, no targeted advertising involving minors

We do not sell the personal information of any user, and we specifically do not sell or share the personal information of users we know to be under 18, and we do not use it for targeted advertising. If NIL brand features launch, brand access to athlete information will be opt in, will require parental consent for athletes under 18, and this policy will be updated first.

10. Automated moderation and AI

To keep a platform full of minors safe, we scan content automatically.

What is scanned

Still frames extracted from uploaded videos
Avatar and profile images
Captions, bios, meet names, usernames and direct message text

How

We use AI models hosted by Cloudflare on Cloudflare's network (Workers AI), currently including @cf/meta/llama-guard-3-8b for text safety classification, @cf/meta/llama-3.2-11b-vision-instruct and @cf/llava-hf/llava-1.5-7b-hf for describing and assessing images, and @cf/microsoft/resnet-50 for image classification. We may change models.

What we look for: nudity and sexual content, content sexualising a minor, violence, self harm, hate, harassment, illegal drugs, spam, impersonation, and attempts to move a minor to a private channel or extract their location or contact details.

What happens next

Content the system scores as high risk is blocked from publication and queued for human review.
Medium risk content is published but flagged for review.
A human being makes every decision that removes an account or reports something to authorities. You are not banned by a machine alone.
You can appeal any moderation decision by emailing support@trackreels.io. Under UK GDPR Art. 22 you have the right to human review of, and to contest, a decision made solely by automated means that significantly affects you.

Limits we impose on ourselves

We do not run facial recognition, face matching, or any biometric identification, and we do not create or store faceprints, voiceprints or other biometric identifiers.
We do not use your content to train our own or any third party's AI models.
Moderation outputs (scores, labels, the reason for a flag) are retained for 12 months so we can audit our own decisions and defend appeals.

11. Cookies, local storage and analytics

11.1 What we store on your device

Item	Type	Purpose	Lifetime
`tr_token`	Browser localStorage, not a cookie	Keeps you logged in. This is your session token. Anyone with access to it can act as you, so do not use TrackReels on a shared computer without logging out	Until you log out or clear site data. The session also exists as a row on our server. It has no fixed expiry date: it lives until you log out, which deletes it, or until you delete your account.
Cloudflare security cookies, for example `__cf_bm`	Strictly necessary cookie set by Cloudflare	Bot management, DDoS protection, rate limiting	Typically 30 minutes to 24 hours
Local UI preferences	localStorage	Remembering filters, sort order, dismissed banners	Until cleared
No analytics identifier	We do not set one	We do not use a third-party analytics tool	Not applicable

11.2 Analytics

We do not use any third-party analytics product. There is no Google Analytics, no Plausible, no Fathom and no analytics SDK in the site's code.

What we do count is first party and stays in our own database: how many times a profile was viewed, how many times a reel was played, and which paywall prompts were shown. Those rows record which account was viewed and on what day. They do not record your IP address, and we do not store IP addresses in our database at all.

We do not use advertising cookies, retargeting pixels, or cross site tracking, and we do not run advertising SDKs.

11.3 Consent

Strictly necessary items, including your login token and Cloudflare's security cookies, do not require consent because the service will not work without them. Anything non essential, including cookie based analytics if we adopt it, is loaded only after you agree through our consent banner, and you can change your mind at any time via the Cookie preferences link in the footer of every page.

11.4 Embedded videos set their own cookies

This is important. When a reel is an embed from YouTube, TikTok, Instagram or Facebook, your browser connects directly to that platform to play the video. That platform can then set its own cookies, read existing ones, and log your IP address, user agent and the page you were on, whether or not you have an account there. We do not control this and we cannot switch it off for you. We do the following to reduce it:

Embedded players are loaded lazily, so a platform is not contacted until the reel carrying the embed actually comes into view. We do not currently use privacy enhanced embed domains, and we will say so here if that changes.

Their privacy policies apply to what they collect: policies.google.com/privacy for YouTube, tiktok.com/legal/privacy-policy, and privacycenter.instagram.com and facebook.com/privacy/policy for Meta.

11.5 Global Privacy Control

We honor the Global Privacy Control (GPC) browser signal as a valid opt out of sale or sharing under US state privacy laws. We do not respond to legacy Do Not Track headers, because there is no agreed standard for them.

12. Who we share information with

We do not sell your personal information. We share it only as set out below.

Recipient	What they get	Why	Where
Cloudflare, Inc.	Everything: hosting on Workers, the database (D1), video and avatar storage (R2), CDN delivery, security and bot logs, and the AI moderation models described in section 10	This is our entire infrastructure	Global edge network, including the United States
Stripe, Inc. / Stripe Payments Europe	Your name, email, card details entered directly into Stripe, billing country, IP, and subscription events. We never receive your card number	Payment processing, subscription billing, fraud prevention, tax	United States, Ireland
YouTube, TikTok, Instagram, Facebook	Your IP, user agent and the page you were viewing, when an embedded video loads	Playing embedded videos. Set by them, not by us	United States and global
Zoho Mail (SMTP)	Recipient email address, message content	Sending password resets, verification links, safety and account notices	European Union and global
Analytics provider	None. We do not use one	Not applicable	Not applicable
Error monitoring	None. Errors are written to Cloudflare's own Worker logs and are not sent to a third party	Fixing bugs	Cloudflare edge
Other users	Everything described as public in section 8, plus messages you send	The product itself	Anywhere
Law enforcement, regulators, courts, NCMEC	Whatever is legally required or necessary to protect a child	Legal obligation and safeguarding	As applicable
A buyer	Everything, if TrackReels is sold or merged	Business transfer. We will tell you before your data moves to a new controller, and you will be able to delete your account first	As applicable

Our service providers act as processors on our written instructions and may not use your data for their own purposes, except that Stripe and the embedded video platforms act as independent controllers for their own purposes.

13. International data transfers

TrackReels is operated from the United Kingdom. Most of our users are in the United States. Our infrastructure runs on Cloudflare's global edge network, so your data is processed in whichever data centre is closest to you, and it will routinely be processed in the United States.

For UK and EU users, transfers outside the UK or EEA rely on: the UK Government's adequacy regulations where they apply, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses. We rely on the EU to US Data Privacy Framework and the UK Extension where the recipient is certified. Cloudflare and Stripe are both covered by these mechanisms. A copy of the relevant safeguards is available on request from support@trackreels.io. We carry out transfer risk assessments where required.
For US users, your data is also processed in and accessible from the United Kingdom, where UK data protection law applies to us as controller. UK law gives you protections that US law generally does not, so this is not a downgrade.
Cloudflare data localisation. We do not currently use the Cloudflare Data Localisation Suite, and no jurisdictional restriction is applied to our database or media storage.

14. How long we keep information

Data	Retention
Account, profile, reels, marks	For as long as your account is active
After you delete your account	Removed from public view immediately. Erased from our live database within 30 days. Purged from encrypted backups within 90 days
Video files in R2	Deleted with the reel or the account, within 30 days
Direct messages	Kept while both accounts exist. When one party deletes their account the whole conversation is deleted, including the surviving user's own messages, so neither side keeps a copy. This is what the product does today
Server, security and access logs	30 to 90 days
Moderation flags, decisions and appeal records	12 months from the decision
Records of parental consent	Life of the account plus 3 years, because we may need to prove consent was obtained
Safety reports, ban records, and evidence of serious abuse	3 years, or longer where required for a legal claim or a child protection matter, and we may keep a minimal record of a banned user to stop them returning
Billing and tax records	6 years from the end of the relevant financial year, as required by UK tax law
Marketing consent and opt out records	Until you unsubscribe, plus a suppression record kept indefinitely so we do not email you again

Deleted accounts leave behind aggregate, non identifying statistics such as historical leaderboard counts. Those cannot be traced back to you.

15. Your rights and how to use them

15.1 If you are in the UK or EEA

Under UK GDPR and the Data Protection Act 2018 you have the right to: access your data, correct it, erase it, restrict processing, object to processing based on legitimate interests, object to direct marketing at any time (this one is absolute), receive your data in a portable machine readable format, withdraw consent at any time, and not be subject to a solely automated decision with significant effects (see section 10).

15.2 If you are in California

Under the CCPA as amended by the CPRA you have the right to know what we collect, use, disclose and sell, to access it, to correct it, to delete it, to opt out of sale or sharing, to limit the use of sensitive personal information, to data portability, and to not be discriminated against for exercising any of these rights. We will never degrade your service or change your price because you made a privacy request.

Our California disclosures: in the previous 12 months we collected the categories of personal information in section 4, for the purposes in section 6, from the sources in section 5, and disclosed them for a business purpose to the recipients in section 12. We did not sell personal information and we did not share it for cross context behavioral advertising, including for any user under 16.

You can use an authorised agent. We will ask for proof of their authority and for you to verify your own identity.

15.3 If you are in another US state

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida and other states with their own privacy laws have broadly similar rights to access, correct, delete, port, and opt out of targeted advertising, sale and profiling. Several of these states also give you the right to appeal a refused request. If we refuse your request you may appeal by replying to our decision email, and we will respond in writing within 45 days. If we still refuse, you can complain to your state Attorney General.

15.4 How to exercise any of these rights

Email support@trackreels.io from the address on your account, or use Settings, then Delete my account. For a copy of your data, email support@trackreels.io from the address on your account. Tell us what you want and which account it relates to.

We verify identity before acting, usually by emailing the address on file. For deletion of a public profile, or for release of message history, we may ask for more.
We respond within one month for UK and EU requests, and within 45 days for US state requests. We can extend by a further two months (UK and EU) or 45 days (US) for complex requests, and we will tell you if we do.
Requests are free. We may charge a reasonable fee, or refuse, if a request is manifestly unfounded or repetitive, and we will explain why.
Parents acting for a child under 18 should use section 9.4 instead.

15.5 Complaints

If you think we have handled your data badly, please tell us first so we can fix it. You can also complain to a regulator:

UK: Information Commissioner's Office, ico.org.uk/make-a-complaint, helpline 0303 123 1113.
EEA: your national data protection authority.
US: your state Attorney General, or the Federal Trade Commission at ftc.gov for COPPA matters.

16. How we protect your information

All traffic is encrypted in transit with TLS. Data at rest in Cloudflare D1 and R2 is encrypted by Cloudflare.
Passwords are stored only as PBKDF2 hashes with a per user salt. We never store or email plaintext passwords, and we cannot tell you what your password is.
Session tokens are random, opaque and revocable. Logging out invalidates the token.
Administrative access to the production database and storage is limited to the founder only and protected by multi factor authentication.
Cloudflare provides DDoS protection, bot management and rate limiting in front of the whole service.
Uploads are size and type restricted and scanned as described in section 10.
We keep backups Cloudflare replicates the database automatically and encrypts it at rest. Point-in-time recovery lets us restore a recent state, and those recovery points expire in the normal course within 30 days.
No external penetration test or third-party security audit has been carried out. We would rather tell you that than imply one.

No system is perfectly secure. Protect your side of it: use a unique password, log out on shared devices, and never share your login. Tell us immediately at support@trackreels.io if you think your account has been accessed by someone else.

17. If there is a data breach

If personal information is exposed, lost or accessed without authorisation, we will:

Contain the incident and investigate.
Notify the UK ICO within 72 hours of becoming aware, where the breach is likely to pose a risk to people's rights and freedoms.
Notify affected users without undue delay where the breach is likely to result in a high risk to them, describing what happened, what data was involved, what we are doing, and what you should do.
Notify parents or guardians directly where a minor's data is involved.
Notify US state Attorneys General and affected residents as required by the applicable state breach notification statutes, which have their own deadlines.
Keep an internal record of every breach, including ones we decide are not notifiable, and why.

18. Changes to this policy

We will update this policy as TrackReels changes. When we do, we will change the "Last updated" date at the top. For material changes, meaning anything that expands what we collect, changes who we share it with, or changes what is public, we will notify you by email and with an in product notice at least 14 days before the change takes effect, and where the change requires consent we will ask for it rather than assume it. Material changes affecting minors will require fresh parental consent before they apply to that account.

19. Questions

Email support@trackreels.io, or write to available on request from support@trackreels.io.

Parents: support@trackreels.io. We answer parent emails first, before anything else in the queue.