Sign-in and sessions
In the documented test environment, Google sign-in uses Supabase Auth. Supabase verifies your identity and provides Platform with an external identifier to link to your account. The website maintains the session with session and request-protection cookies.
Sign-in with a one-time code by email is also planned. In that flow, your address would be used to send and verify the code.
Account and preferences
The profile design includes an optional display name and language and theme preferences. The website remembers your choices in local browser storage; the design also provides for associating them with your profile.
The cookies and browser storage page describes the specific browser mechanisms, including how long each preference remains stored.
TrackTidy Desktop and licences
TrackTidy Desktop activation is planned to link your account to the installations you authorize. The flow includes a temporary code, an installation identifier, a public device key, the name you choose, and the Windows and TrackTidy versions. These details would be used to verify the installation and manage the licence.
Purchases and messages
Stripe Checkout and Customer Portal are planned for payments, subscriptions and invoices. Stripe would process the payment; Platform would receive the confirmation and references needed to link it to your account and the corresponding access.
Planned transactional emails include sign-in codes, security notices, and account and purchase updates. Resend is the initial remote provider planned.
Security and service providers
Technical records of sign-ins, sessions, activations and incidents may include an IP address, browser, app version, date, outcome, and account or device identifiers, depending on their purpose.
For Staging, the documentation identifies Cloudflare for the website, Railway for the API and PostgreSQL, and Supabase Auth with Google for sign-in. Stripe and Resend are planned for payments and transactional email.
Your rights
You can request access, rectification, erasure, restriction of processing and data portability, and object where the law provides for it. If processing is based on consent, you can withdraw it for the future. You can also lodge a complaint with the competent data protection authority.