Track Record — Privacy Policy
Last updated: 1 November 2026
Track Record is a game about visiting transit stations. To do that it needs to know where you are. This policy says what happens to that, in plain terms, because a location app that is vague about location has not earned anything.
The short version
Your location never leaves your phone. Not to us, not to anyone. The app works out which station you are at on the device, and the record of where you have been stays there (and on your Apple Watch, if you use the Watch app).
What does leave your phone is a small scoreboard: an anonymous id, and how many stations you have collected in each mode. Never which stations. Never when. That is what makes the friends board work, and the counts, without your id, make up the Global standings. That is the whole of it.
There are no adverts, no analytics, no tracking, and no third-party SDKs of any kind. Purchases go through Apple, and we never see your payment details or who you are.
What stays on your phone
All of this is stored only on your device, in the app's own storage, and is included in your device backup if you have one:
| What | Why |
|---|---|
| Your location, while the app is watching | To tell which station you are at |
| Motion activity (walking, cycling, in a vehicle) | To tell walking past a station from riding through it |
| Your visit log — which stations, when, and in what state | It is your collection |
| The fix trace: a recording of raw location samples | So a bug you report can be replayed. It records whenever tracking is running — there is no separate switch — and you can see its size and erase it from Settings |
| Settings: tracking mode, visible modes, the face you chose, map theme, app icon | So the app behaves the way you left it |
| Names you give your friends | So you can tell who is who on your board. Only you see them |
| Whether you have Pro, or have left a tip | So what you bought works offline. See Purchases below |
| Performance reports from iOS: launch times, battery and memory use, and the details of any crash | So a problem you report can be found. They contain no location, and only the newest thirty are kept |
None of it is transmitted anywhere by the app, except to your Apple Watch if you have installed the Watch app: it receives how far you are through the city and the last station you reached, so it can show them. If you delete the app, all of it goes with it.
Exports (a spreadsheet or a JSON file of your collection) and share cards (pictures of your progress, which can include your Global standing) are made only when you ask, and go only where you send them.
One honest caveat about "never leaves your phone": if you have iCloud Backup switched on, iOS backs up this app's storage along with every other app's, and that includes the fix trace. That is Apple backing up your device, encrypted, under your own account and your own settings — not us sending anything, and we cannot read it. You can exclude the app in iOS Settings → your name → iCloud → Manage Storage → Backups if you would rather it did not.
Why the app asks for "Always" location
So it can notice you reached a station while the app is closed — which is the normal way anyone uses it. In that mode the app watches only the stations nearest you and wakes when you reach one. It does not follow you continuously unless you press Start. Choosing "While Using" instead works; you will only collect stations with the app open.
You can change or revoke this at any time in iOS Settings, and the app keeps working with what you allow.
What leaves your phone
Two things, both to a database that belongs to this app, hosted on Apple iCloud (CloudKit). Apple processes it on our behalf under their own terms; it is not sold, shared or handed to anyone else.
1. Board rows — how you appear on the friends board
- A rider id: a random identifier the app generates. It is not your name, your Apple ID, your email, or your device id.
- The city, the mode (subway, ferry, and so on), the time window, and a count of stations.
- The two numbers behind the face you picked: a shape and a colour.
That is the whole record. It does not contain which stations you visited, when you visited them, or any coordinate.
2. Friendships
When you add a friend, a row recording the pair of rider ids is stored so the board can show you each other. Nothing else.
The board is friends-only by construction: rows are looked up by rider id, and someone has to have your invite link to hold yours.
How the Global board uses them
The Global side of Stats ("top 12% of riders") is worked out once a day from everyone's board rows. That job reads the counts and publishes only how many riders have each count, per city, mode and window. It publishes no rider ids, and no row of yours. A rider whose rows cannot be honest (more stations than exist, say) is left out of it.
One thing we do not control, and would rather state than leave out. Because the board lives in CloudKit, Apple stamps every row with an identifier of its own, derived from the iCloud account that wrote it. We never send your Apple ID and your rider id is not derived from it — but that stamp means a row is associated with an iCloud account at Apple's level, not only with a random number. It is not shown on the board, it is not part of what we read, and we do not use it for anything.
The one exception, and we would rather be explicit about it
Settings → Help → Contact support opens your own mail app to write to us. It fills in your app version and build, your iOS version, your device model, your short rider id, your tracking mode, your station count and the size of your fix trace, so a bug report can be reproduced. Nothing is sent until you send it.
It offers to attach the performance reports described above, as a file called performance.json. That is on by default, because the reports contain timings and crash details and nothing about where you have been; switch it off on the same screen if you would rather not send them.
It also offers to attach your fix trace — the raw location recording. That is a record of where you have been, so:
- The attachment is off by default, and goes back to off every time you open the screen. It is a decision you make per report, never a setting you set once and forget. The recording happens either way; what this chooses is whether a copy goes anywhere.
- Nothing is uploaded. The file is handed to your mail app, where you can see the attachment and the address before you send, and remove it or cancel.
- If you send it, we use it only to reproduce the problem you reported. It is not used for anything else, and you can ask us to delete it.
If you never touch that toggle, nothing this app does sends your location anywhere.
Purchases
Track Record Pro and the tips are bought through Apple's App Store, and Apple handles the payment. We never receive your card, your name, your email or your Apple Account.
The app asks Apple, on your phone, what your Apple Account has bought, and keeps a note of the answer (Pro or not, tipped or not) so Pro works without a connection. That note is not sent anywhere: it is not on the board and not in anything we can read. Apple gives us sales reports, which are totals by product and country, not a list of who bought what. If you share Pro through Family Sharing, Apple handles that too.
What we never do
- We do not track you across other apps or websites. There is no advertising identifier, no ad network, no analytics SDK, no crash reporting SDK.
- We do not sell or share your data. There is nobody to sell it to and nothing worth selling.
- We do not build a profile of you, and we cannot: we do not hold your locations.
Deleting your data
Settings → Collection → Delete everything erases your collection, your rider id, your friendships and the names you gave them, the face you chose, the fix trace, the performance reports and the app's record of where it last saw you, and deletes your board rows and friendship records from iCloud.
It does not undo purchases. Pro and tips belong to your Apple Account, not to the app, and Settings → Pro → Restore Purchases brings them back.
If the network is unavailable at the time, the app remembers the id it has to erase and retries until it succeeds — the deletion is not forgotten because you were on the subway when you asked for it.
Deleting the app removes everything held on the device. If you delete the app without using Delete everything first, board rows filed under your rider id may remain; write to us and we will remove them.
Children
Track Record is not directed at children and does not knowingly collect anything from them. It has no account system, no messaging, and no user-written content that anyone else can see.
Your rights
You can see everything the app holds about you inside the app, export your collection from Settings, and delete all of it as described above. If you would like a copy of anything filed under your rider id, or want it removed, write to us and we will do it.
Changes
If this policy changes, the date at the top changes with it, and material changes will be noted in the app's release notes.
Who is responsible for your data
Track Record is made by patacognition. The person accountable for privacy, and the address to write to about anything on this page, is:
Privacy contact, patacognition
trackrecord@patacognition.tech
Contact
trackrecord@patacognition.tech