Privacy Policy
1. Who we are
Trackexa is business software for Australian tradies. Trackexa is run by Joel Walters, a sole trader trading as Trackexa (ABN 83 919 535 607), based in Cairns, Queensland, Australia. In this policy, "Trackexa", "we", "us" and "our" means Joel Walters trading as Trackexa.
This policy explains what personal information we collect through trackexa.com and the Trackexa app, why we collect it, who we share it with, where it is stored, and how you can access, correct or delete it.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and this policy describes how we do that.
Contact us about privacy: joel@trackexa.com. Trackexa, Cairns QLD, Australia.
2. The information we collect
2.1 Information you give us
Account details. Your first name, last name, email address, phone number (optional), your trade or type of business, and your password. We never see your password. It is stored by our sign-in provider as a one-way scrambled code (a hash).
Google sign-in. If you sign in with Google, Google gives us your name, email address and profile picture.
Business profile and branding. Your business name, ABN, licence number, business email, phone and address, payment terms, the bank account details you choose to show on your invoices, your business logo and your profile photo.
Information about your customers. The names, addresses, phone numbers and email addresses of your customers, and job details, that you enter into quotes, invoices, jobs and tasks. See section 4 for how we handle this.
Quotes, invoices and receipts. Quotes, deposit and final invoices, line items, prices, GST, payment status, job photos you add to quotes, and photos or PDFs of receipts you attach to job costs. Receipts can show supplier details and part of a card number, so only upload what you need.
Jobs, time and profit information. Jobs, scheduled dates, hours you log, job costs and materials, notes and to-do tasks, and the profit and profit-per-hour figures Trackexa works out from them.
Goals and targets. The monthly income goal and profit-per-hour target you set.
Support messages. What you tell us when you email us for help. The Help section in the app is a set of written guides. Reading them does not send us any information beyond normal usage data (section 2.2).
2.2 Information we collect automatically
Usage information. How many quotes, invoices, jobs and tasks you have created, how many times you have logged in, and a simple engagement score worked out from those counts. We also record events such as signing up, logging in, creating your first quote and paying for a subscription.
Notifications. Trackexa creates in-app notifications and insights from your own data (for example a reminder about an unpaid invoice or a note that you hit your income goal). These are stored with your account. We do not send push notifications or SMS.
Device and technical information. Your IP address, browser and device type, pages and screens viewed, approximate location (city or region, worked out from your IP address) and the date and time of each visit. Our hosting provider keeps server logs of requests, and some logs include your email address.
How you found us. The website or campaign link you arrived from, including campaign tags and advertising click codes. See section 5.
Cookies and browser storage. See section 6.
2.3 Billing information
Payments are handled by Stripe. When you start a subscription, you enter your card details directly with Stripe. We never see or store your full card number. We receive and store your Stripe customer number, subscription status, trial end date, renewal date and plan. We send Stripe your email address, your Trackexa account number and the "how you found us" information in section 5.
2.4 Pilots, feedback and invitations
Pilots, feedback and invitations. If you take part in a Trackexa pilot, give us feedback or reply to one of our invitations (by email, text message or social media), we keep your name, your contact details, your messages and your feedback. We use them only to run the pilot, reply to you and improve Trackexa. We won't add you to our marketing emails unless you agree, and any invitation we send tells you how to stop hearing from us. We delete pilot records within 6 months after the pilot ends, unless you create a Trackexa account, in which case we handle your details as described in the rest of this policy. We won't publish your feedback, your name or anything that identifies you without your permission.
3. How we use your information
We use personal information to:
- create and run your account and give you the Trackexa features you use, such as quotes, invoices, jobs, scheduling, receipts, reports, goals and notifications
- process your subscription and free trial through Stripe, and work out whether your account has access
- add jobs to your Google Calendar when you ask us to (section 7)
- send you service emails, such as password reset and security emails
- send you tips and onboarding emails during your trial, and product emails (section 9)
- answer your support requests
- understand how people use our website and app and which marketing brings people to Trackexa (section 5)
- keep Trackexa secure, prevent misuse and fix problems
- meet our legal obligations, such as tax record keeping.
We do not sell personal information. We do not use your data or your customers' data to show you advertising.
4. Information about your customers
When you add your customers' details into Trackexa, you are in control of that information. We store and use it only to provide Trackexa to you, for example to put it on your quotes and invoices, show it in your jobs and schedule, and add it to your Google Calendar events if you choose to.
We do not contact your customers, use their details for our own marketing, or share them, except with the service providers in section 8 who help us run Trackexa, or where the law requires.
You are responsible for:
- having a lawful reason and, where needed, your customers' permission to store their details in Trackexa and to add them to your Google Calendar
- telling your customers how you handle their information, if the law requires you to
- answering your customers' requests to access, correct or delete their information. You can edit or delete customer details in your quotes, invoices, jobs and tasks at any time.
If one of your customers contacts us about their information, we will refer them to you, and we will help you respond where we can.
5. Analytics and marketing measurement
We use Google Analytics 4, provided by Google, on trackexa.com and in the Trackexa app.
What Google Analytics collects. Pages and screens viewed, buttons clicked (for example "start free trial" buttons and social media links), events such as signing up, logging in, activating your account, creating a quote and paying for a subscription, your device and browser type, approximate location (city or region), and how you arrived (for example a search engine, social media or a campaign link). Google Analytics sets cookies (such as _ga) to recognise your browser.
Free tools on our website. Our free tools, the job return calculator and the Smoko Challenge, work out your results in your browser. On the Smoko Challenge page, Google Analytics also records the steps you take, such as starting and finishing the challenge, whether your guess on the example jobs was right, opening and finishing "Check my own jobs", tapping to share the challenge and tapping to start a trial, along with which edition you played and, if you came from one of our invitations, which kind of invitation it was. We never record the prices, costs, hours, job names or guesses you type into "Check my own jobs" or the calculator. They are not saved, are not sent to us or to Google Analytics, and are gone when you close or refresh the page.
Google Analytics is linked to your account. Google Analytics is not anonymous for signed-in users. When you are signed in, we save your Google Analytics browser identifier (client ID) against your Trackexa account. When a subscription payment is made, our server sends Google Analytics a record of the payment (amount and currency) together with your Trackexa account number (as the Google Analytics user ID) and your browser identifier. We do not send your name, email address or phone number to Google Analytics. Because this information is linked to your account, we treat it as personal information.
Campaign tags and advertising click codes. If you arrive at our website through a link that contains campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content), a referral code (ref or source), or an advertising click code from Google (gclid), Meta/Facebook (fbclid) or Microsoft (msclkid), we save these and the date in your browser for up to 90 days. If the link doesn't say which ad or post it came from (no utm_content), we save the first page you landed on in its place. We save the page address only, never anything typed into the page. If you arrive from another website without campaign tags, we record the kind of site that sent you (for example a search engine such as Google, an AI assistant such as ChatGPT, or the name of another website, but not your search terms or the full web address) and the first page you landed on. If you type our address in directly, nothing is saved. When you click to start a trial, our website passes this information to the sign-up page, together with any campaign tags or referral code in the page address at that moment. The Trackexa app keeps its own record in your browser for up to 90 days: the campaign tags, the click codes above and TikTok click codes (ttclid), the first app page you opened and the date. If the app already has a record from an earlier visit, it keeps that one. If you create an account, we copy the app's record into your Trackexa account record, and into your customer record with Stripe when you set up payment. Referral codes are not copied to your account. We use this "first-touch" information to understand which marketing leads to sign-ups and subscriptions. We do not currently send it back to advertising platforms.
How to opt out.
- Install Google's opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
- Block or delete cookies and site data for trackexa.com in your browser settings. If you clear site data in the app, you will be signed out.
- Clear site data for trackexa.com in your browser (or use a private window) before you click to sign up, and no first-touch information will be passed to your account. Blocking local storage for trackexa.com stops it being saved at all.
- Email joel@trackexa.com and ask us to delete the first-touch information on your account and Stripe record, or to ask Google to delete analytics data linked to your account.
6. Cookies and browser storage
We use cookies and your browser's local storage and session storage. Trackexa does not use advertising cookies.
| Name | Set by | Why | How long |
|---|---|---|---|
_ga, _ga_* | Google Analytics | Recognise your browser for analytics | Up to 2 years |
sb-* | Supabase (Trackexa sign-in) | Keep you signed in | Until you sign out |
google_calendar_access_token, google_calendar_token_expiry, google_calendar_permission_granted | Trackexa | Let Trackexa add events to your Google Calendar, if you connected it | Access key expires after about 1 hour. Cleared when you sign out |
trackexa_first_touch | Trackexa website (trackexa.com) | Remember the campaign link, referral code, click code or type of site you first arrived from and, if the link didn't name the ad or post, your first landing page, so we can tell which marketing leads to sign-ups | 90 days |
trackexa_ft_attribution | Trackexa | Remember the campaign link and click code you first arrived from | 90 days |
Other trackexa_*, ga4_* and display preference items | Trackexa | Remember app settings and draft schedules, and avoid counting the same event twice | Until cleared or you sign out |
| YouTube cookies | Google (YouTube) | Play videos embedded on our Videos page | Set by YouTube |
Our website also loads fonts from Google Fonts, and the app loads a PDF-making library from Cloudflare's cdnjs service. These services receive your IP address and browser details when the files load.
7. Google sign-in and Google Calendar
Google sign-in. If you sign in with Google, we receive your name, email address and profile picture from Google (permissions: openid, email, profile). We use these only to create and secure your Trackexa account.
Google Calendar is optional. If you connect Google Calendar, you give Trackexa permission to create events in your Google Calendar (permission: https://www.googleapis.com/auth/calendar.events`).
What we send to Google Calendar. Trackexa only creates events, and only when you choose to schedule a job into your calendar. Each event is added to your main calendar and contains:
- event title: the customer's address and name
- location: the customer's address
- description: the customer's address, name and phone number, the job title and the job description from your quote
- the date, start time and finish time you chose.
What we do not do. Trackexa does not read, store, change or delete any events in your Google Calendar, including the events it created. The connection is one-way. Changes you make in Google Calendar do not come back into Trackexa, and changes in Trackexa do not update events already added.
Where the access key is kept. The Google access key is kept only in your browser, not on our servers. It expires after about an hour, and it is removed when you sign out of Trackexa.
How to disconnect. At the moment there is no disconnect button in Trackexa. To remove Trackexa's access, go to https://myaccount.google.com/permissions, choose Trackexa and remove access. Signing out of Trackexa also removes the access key from your browser. Disconnecting does not delete events already added to your calendar. You can delete those in Google Calendar.
Google API Services User Data Policy. Trackexa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular, we use Google user data only to provide the sign-in and calendar features you asked for. We do not use it for advertising, we do not sell it, we do not use it to train artificial intelligence models, and we do not allow people to read it unless you ask us to, it is needed for security or to comply with the law.
8. Who we share information with and where it is stored
We share personal information only with the service providers below, who help us run Trackexa, and where the law requires or allows it (for example to a court or government agency, or to protect someone's safety). Our service providers may use the information only to provide their services to us.
| Provider | What they do for us | Information involved | Where it may be stored or accessed |
|---|---|---|---|
| Supabase Inc. | Database, sign-in, file storage for receipts and images | All account, business and customer data, receipts, notifications, goals, usage counts, first-touch information | Sydney, Australia (data storage), with support and service access from the United States and other countries |
| Vercel Inc. | Hosts trackexa.com and the app servers that handle billing, email sign-up and analytics | Requests, IP addresses, account number, email address in server logs | United States |
| Stripe | Card payments and subscription management | Name, email address, card details (held by Stripe only), billing history, account number, first-touch information | United States, Ireland and other countries |
| Loops (Loops.so) | Sends onboarding, tips and product emails | First and last name, email address, account number, sign-up source, usage counts and engagement score | United States |
| Google LLC | Google sign-in, Google Calendar (if you connect it), Google Analytics, Google Fonts, YouTube videos on our website | As described in sections 5, 6 and 7 | United States and other countries |
| Cloudflare Inc. | Delivers a code library the app uses to make PDFs | IP address and browser details | Global network, including Australia and the United States |
Overseas disclosure. Some of these providers store or access information outside Australia, mainly in the United States, and Stripe also in Ireland. Google and Cloudflare may process information in other countries where they operate. We use established providers that have their own security and privacy commitments, and we remain responsible for how our providers handle your information.
People who can see your information. Joel Walters can see account details (name, email, phone, trade, sign-up and trial dates, subscription status and usage counts) through our admin tools, to support users and run the business. We do not look at your quotes, invoices, jobs, customer details or receipts unless you ask us to help with something, or it is needed for security or to comply with the law.
9. Emails and direct marketing
Service emails. We send emails you need to use Trackexa, such as password reset and account security emails. You cannot unsubscribe from these while you have an account.
Trial tips and product emails. When you sign up, we add your name and email address to our email provider, Loops, and send you a short series of emails with tips on getting set up and using Trackexa. Some of these emails are chosen automatically based on how much you have used Trackexa. For example, if you have not created a quote yet, we may send a "need a hand?" email. These emails are sent by Trackexa (Joel Walters, ABN 83 919 535 607).
Unsubscribing. Every tips, product or marketing email includes an unsubscribe link. You can also email joel@trackexa.com and ask to stop. We act on unsubscribe requests within 5 business days. Unsubscribing does not stop service emails.
We never send marketing to your customers.
10. How we protect your information
- Information is encrypted in transit (HTTPS) and stored by our database provider, which encrypts data at rest.
- Database access rules are designed so each account can only see its own records, and receipts are kept in private storage that only your account can open.
- Passwords are stored as one-way hashes. Card details are held by Stripe, not by us.
- Admin tools are limited to a small list of accounts we control.
No system is completely secure, and there are improvements we are still making (for example to how some browser-based keys and third-party code libraries are handled). Please use a strong, unique password and sign out on shared devices. If we become aware of a data breach that is likely to cause you serious harm, we will tell you as soon as practicable and explain what you can do, and we will notify the Office of the Australian Information Commissioner where required.
11. How long we keep information and deleting your account
While your account is open we keep your information so you can use Trackexa.
Deleting individual records. You can delete quotes, invoices, jobs, tasks and receipts yourself in the app at any time.
Deleting your account. There is not yet a "delete my account" button in Trackexa. To close and delete your account, email joel@trackexa.com from the email address on your account. We will confirm it is you, cancel any subscription, and then within 30 days:
- delete your Trackexa account and the information stored with it, including your profile, quotes, invoices, jobs, customer details, tasks, receipts, goals, notifications, usage counts and first-touch information
- delete your contact record from Loops
- delete the first-touch information from your Stripe customer record, and ask Stripe to delete your customer record where it is not needed for our records
- ask Google to delete Google Analytics data linked to your Trackexa account number.
What we cannot delete or must keep.
- Stripe must keep payment records to meet its own legal obligations, under its own privacy policy.
- We keep records of the subscription payments you made to us (date, amount, invoice details) for 5 years, as Australian tax law requires.
- Events already added to your Google Calendar stay there until you delete them. Emails we have already sent stay in your inbox.
- Google Analytics keeps event data for the retention period set in our Analytics account, after which Google deletes it.
- Backups are kept by our hosting provider for a limited period and deleted on their normal cycle.
If you cancel or your trial ends. Cancelling your subscription does not delete your account or data. Your data is kept so you can come back. If you want it deleted, email us as above.
12. Accessing, downloading and correcting your information
In the app. You can view and edit your information in Trackexa at any time. You can update your name, phone number and trade in Account Settings, and your business details in your business profile.
Downloading your data. You can download your monthly income, invoice register and BAS supporting figures as CSV files from Business insights, download any quote or invoice as a PDF, and download any receipt you have uploaded. There is not yet a single "export everything" option. For a full copy of the personal information we hold about you, email joel@trackexa.com and we will send it within 30 days.
Corrections. Your sign-in email address cannot be changed in the app. To change it, or to correct anything else, email joel@trackexa.com and we will fix it within 30 days or tell you why we cannot.
We may need to confirm your identity first. We do not charge for access or correction requests. If we refuse a request, we will tell you why in writing and how to complain.
13. Automated decisions
Trackexa automatically works out figures such as profit per hour, income goal progress, overdue invoices and how quickly you get paid, and shows you notifications and insights about them. We also use simple rules based on your usage counts to choose which tips email to send you. These are information and suggestions for you only.
We do not use computer programs to make decisions about you that could significantly affect your rights or interests. Access to Trackexa is based only on your free trial and Stripe subscription status.
14. Complaints
If you have a concern about how we have handled your personal information, please email joel@trackexa.com with the details. We will acknowledge your complaint within 7 days and aim to respond within 30 days.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992. You can also contact us about emails under the Spam Act, or the Australian Communications and Media Authority (ACMA) at www.acma.gov.au.
15. Children
Trackexa is a business tool for adults. It is not meant for anyone under 18, and we do not knowingly collect information about children, other than details a tradie may enter about a customer.
16. Changes to this policy
We may update this policy when Trackexa changes. We will change the "Last updated" date at the top and, for important changes, tell you by email or in the app before they take effect. The current version is always at trackexa.com/privacy-policy.