Privacy Policy
Last updated : August 1, 2026
TrackyFactory works locally without an account, but also offers optional online features: account, sync, public profiles, friends, activity feed, reviews and messages. This page describes what is stored, where, and why.
Data stored on your device
Your preferences (language, theme, accessibility), follows, categories, reminders and watch history are stored locally on your device first. If you do not use an account, this data is not associated with an online TrackyFactory profile.
Account and online features
Creating an account is optional. It requires, among other things, an email address, a session identifier and a public/private profile. If sync or social features are enabled, TrackyFactory stores the data required to operate them in its infrastructure: profile, visibility preferences, follows, categories, history, friends, requests, blocks, reviews, activity feed and internal notifications. Chat uses a dedicated service configured by TrackyFactory to transmit conversations and shared media cards.
Network requests
To display content (movies, shows, anime, games, books, sports and esports), the app queries the TrackyFactory Worker, which relays requests to third-party APIs and selected public sports APIs. Authenticated requests may include your session token, a device identifier and the data required for the requested action. As with any web service, the infrastructure may produce temporary technical logs (IP address, timestamp, requested route, errors) for security, diagnostics and abuse prevention.
Third-party services
Displayed content comes from third-party APIs (TMDB, AniList, Jikan, TVMaze, RAWG, IGDB, Trakt, Kitsu, PandaScore, football-data.org, etc.), used in accordance with their terms. TrackyFactory does not sell your personal data to these services.
Sharing, visibility and moderation
Public profiles, reviews, activities and friend-visible data follow your privacy settings when the service reads them. Blocks override friendship and visibility. Social content may be limited, hidden or removed in case of abuse, legal obligation or security issue.
Data deletion
You can delete local data by uninstalling the app or resetting data from the device when the option exists. Logging out removes session tokens from the device. Account deletion, confirmed by email from the security settings, deletes online data associated with the account, including the profile, sync data, relationships, reviews and chat messages.
Controller and contact
TrackyFactory is currently a personal project publicly published by Arouz (github.com/Arouz). Privacy requests can be sent to [email protected]. No data protection officer has been appointed. This public identity is provisional until the activity is formally structured.
Purposes and legal bases
Account, sync, social and chat processing is necessary to provide the requested service. Security, abuse prevention, limited diagnostics and proof of acceptance rely on legitimate interests. Optional push notifications rely on consent, which can be withdrawn in the app or device settings. TrackyFactory does not sell personal data or use behavioural advertising.
Service providers and transfers
Cloudflare hosts the Worker, D1 databases and cache. OVHcloud hosts the authentication, email and chat VPS in France. Brevo sends transactional emails, Expo provides app updates and optional push delivery, and Google provides optional sign-in and app distribution. Some providers may process data outside the EEA under their contractual transfer safeguards.
Retention
Functional data required for an active account is kept for the life of that account and is not deleted merely because the account is inactive. Scheduled maintenance deletes request logs after 7 days, errors after 30 days, expired authentication artefacts after a 30-day grace period, login attempts after 90 days, and obsolete technical sync, notification and push receipts after their documented short periods. Deleted-account operational data is removed from active systems; a minimal deletion receipt may be retained for up to 5 years as evidence, and provider backup rotation remains subject to the applicable hosting policy.
Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction, objection or portability, and withdraw consent at any time by writing to [email protected]. A proportionate identity check may be requested in case of reasonable doubt. We aim to answer within one month. You may also complain to the CNIL at cnil.fr.
Age requirement
Accounts and social features are reserved for people aged 16 or over. Registration asks users to confirm the minimum age without collecting a date of birth. Guest mode and purely local features remain available without an account.
Questions about your data? Contact us at [email protected].