Privacy Policy

Last updated: August 18, 2026

Overview

TrackTag is a privacy-first application that helps you add GPS location data to your photos. All processing happens locally on your device. We do not collect, store, or transmit your personal data to any servers.

Data Collection

We do not collect any data. TrackTag processes all information entirely on your device.

Photo Library Access

TrackTag requests access to your photo library for the following purposes:

• Read access: To read photo timestamps (EXIF data) for matching with GPS tracks
• Write access: To update photo metadata with GPS coordinates

Your photos never leave your device. No photo data is uploaded, analyzed, or shared with any third parties.

GPS Track Data

When you import GPX files or connect to Strava:

• GPX files are processed entirely on your device
• Track data is stored locally using SwiftData (Apple's local database framework)
• No GPS track information is sent to external servers (except when fetching from Strava)

Strava Integration

When you choose to connect your Strava account:

What We Request

• Read-only access to your Strava activities
• Activity GPS track data (coordinates and timestamps)
• Activity metadata (name, date, type)

How Tokens Are Stored

• OAuth access tokens are stored securely in your device's Keychain
• Tokens are never transmitted to our servers (we don't have servers)
• Communication happens directly between TrackTag and Strava's API

Revoking Access

You can revoke TrackTag's access to Strava at any time:

1. Go to Strava Settings → My Apps
2. Find "TrackTag" in the list
3. Click "Revoke Access"

Data Storage

All data is stored locally on your device using:

• SwiftData: For GPX track metadata and matching history
• Keychain: For secure storage of Strava OAuth tokens
• Photos Library: For photo location metadata (standard EXIF format)

No cloud storage. No remote servers. No data leaves your device except when authenticating with Strava.

Third-Party Services

Strava API

If you connect to Strava, TrackTag communicates directly with Strava's servers to:

• Authenticate your account (OAuth 2.0)
• Fetch your activity list
• Download GPS track data for selected activities

This communication is governed by Strava's Privacy Policy.

No Analytics or Tracking

TrackTag does not use:

• Analytics services (Google Analytics, etc.)
• Crash reporting services
• Advertising networks
• User behavior tracking

Your Rights

Data Deletion

To delete all data associated with TrackTag:

• Delete the TrackTag app from your device
• Revoke Strava access (if connected) at strava.com/settings/apps

Since all data is stored locally, deleting the app removes all associated data.

Data Portability

Your photo location data is stored in standard EXIF format, readable by any photo application. GPS tracks can be exported as GPX files (standard format).

Children's Privacy

TrackTag does not knowingly collect information from children under 13. The app is designed for general audiences and does not require age verification.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of TrackTag after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy or TrackTag's privacy practices:

Email: dan@danj.org.uk

Legal Basis (GDPR)

For users in the European Economic Area:

• Legal basis: Legitimate interest (providing geotagging functionality)
• Data controller: Dan Jackson (individual developer)
• Data processing: All processing occurs locally on your device
• Right to erasure: Delete the app to remove all data