Tracks is a subway-riding app. It needs your location to do its job, so this policy is written to be read rather than skimmed past. Everything below is true of the app as shipped, and most of it is visible in the app itself under Settings › Privacy.
Location
Tracks reads your location only while a trip is running — between the moment you tap Start Trip and the moment you tap End Trip. It does not read your location between rides, and it does not run in the background outside a trip.
It asks for background location access because the subway is underground and your phone will be in your pocket. Without it, the app cannot tell which stations you passed through.
The raw GPS points collected during a ride stay on your phone. They are used to work out your route, then kept for up to one hour after the ride ends so that, if the route came out wrong, you can fix it from the same evidence. After that hour they are never used again, and they are deleted the next time you open Tracks — sooner if you report a wrong route or sign out. That copy is never uploaded and never included in your phone’s backups. The ride’s troubleshooting log keeps a copy on your phone for up to two weeks (see below). What is kept, and backed up to your account, is the ride itself: which stations and lines you rode, when, and how far. Your location is never used for advertising and is never shared with anyone.
Your account
Creating an account stores your email address, the display name and username you choose, and the colors you pick for your card. Your rides, your unlocked stops and your statistics are backed up to that account so they survive a new phone.
Other riders can see your profile and your leaderboard standings — display name, username, card colors, and the statistics the boards are built from. They cannot see your individual rides or your email address.
Accounts, sync and sign-in are provided by Google Firebase (Authentication, Cloud Firestore and App Check). If you sign in with Google or with Apple, that provider tells us your email address and, on the first sign-in only, your name. Signing in with Apple lets you hide your real email address; if you do, we only ever see the relay address Apple gives us.
Your phone number and contacts
Both are optional, and Tracks works fully without either. They exist for one feature: finding friends who are already on Tracks, under Find Friends › From your contacts.
Your own phone number. You can add your number so friends who have it in their contacts can find you. We text you a code to confirm it is yours; the number is then stored with your account by Google Firebase Authentication. It is never shown to other riders, and it is never a way to sign in. Google, which sends the confirmation text, also keeps numbers it verifies to help prevent spam and abuse across its services, under Google’s own privacy policy. To make matching possible, we also keep a one-way scrambled form of it (a SHA-256 hash), which no other rider can read. You can stay hidden without removing the number under Friends › Find me by phone, and you can remove it there at any time; removing it or deleting your account deletes both.
Your contacts. Tracks reads your contacts only when you tap Connect contacts and allow it, and on iPhone you can choose to share only some of them. Only names and phone numbers are read. Names never leave your phone; they are used only to label the list you see. Each phone number is scrambled with the same one-way hash on your phone, and only those hashes are sent to Tracks, once, to check which belong to riders who chose to be findable. Nothing from your contacts is stored, by us or in the app, and the result is forgotten when you close Tracks. To keep anyone from using this to look up phone numbers, each account can only check a limited number of contacts a day.
Invites. If you invite a contact who is not on Tracks yet, the app opens a text message in your own Messages app, addressed to them and pre-filled with a link to your profile. You send it, or not. Tracks never sends messages itself and never invites anyone on your behalf.
Diagnostics and crash reports
When something breaks, Tracks sends a crash report containing what broke, which version of the app you are on, and your account ID so the report can be matched to your account — never where you were. This is handled by Sentry. You can turn it off entirely under Settings › Crash reports; with it off, nothing is collected and nothing is queued for later.
With crash reports on, Tracks also measures its own performance for a sample of sessions: how long the app takes to open and how long each screen takes to load, identified by the screen’s name and linked to your account ID like a crash report. It does not record what you tap, and it never includes where you were. The same switch turns it off.
The app also writes troubleshooting logs for each ride. These logs include the location points recorded during the ride. They live on your phone, are excluded from iCloud and iTunes backups, clear themselves after two weeks, and are deleted when you sign out. They only ever reach us when you send a report through Report a Problem or Wrong Route with its log switched on. The switch starts on, sits directly above the Send button, and the app tells you the log contains your route before you send — and both of those work with it switched off.
Reporting and blocking riders
If you report another rider, we receive the reason you chose, anything you wrote, that rider’s username and account ID, and your account ID, so the report can be reviewed and acted on. Reports are handled through Sentry. The rider you report is not told who reported them.
Who you block is stored privately in your account. Only you can see it, and the rider you block is not told.
Who handles your data
- Google Firebase — accounts, sign-in, sync and App Check, phone number verification (the confirmation text), and the server function that checks hashed contact numbers.
- Sentry — crash reports, performance measurements, and the reports you choose to send.
- Apple and Google — only if you sign in with them.
Each of them processes this data only to provide its service to Tracks, under terms that require them to protect it at least as well as this policy does. Nobody else receives it.
How long things are kept
Your rides, stops, statistics and profile are kept for as long as you have an account, and are deleted when you delete them or your account (below). Location points and troubleshooting logs on your phone are kept as described above. Your phone number and its hash are kept until you remove the number or delete your account; hashed contact numbers are not kept at all. Crash reports and the reports you send are kept only as long as they are needed to investigate and fix the problem, or to act on a report.
What Tracks does not do
- No advertising, and no advertising identifiers.
- No tracking across other apps or websites, and no data brokers.
- Nothing is sold, rented or handed to anyone else.
- No access to your photos, microphone or camera.
- No access to your contacts unless you connect them, and even then nothing from them is stored.
- No text messages sent on your behalf.
Deleting your data
Settings › Clear all my data erases your rides, stops and statistics while keeping your account and your friends.
Settings › Delete my account removes everything: your rides, your stops, your statistics, your profile, your friend connections, your username, your phone number if you added one, and the sign-in identity itself. It is irreversible, and it releases your email address so you could sign up again from scratch. If you signed in with Apple, deleting your account also revokes the app’s Apple sign-in token.
Children
Tracks is not directed at children under 13 and does not knowingly collect information from them.
The website
www.tracks.nyc counts page views with Vercel Web Analytics. It uses no cookies and does not identify you or follow you to other sites. It sees which page was visited, the referring site, and your browser, operating system and country, and nothing about your account or your rides.
Changes
If this policy changes in a way that affects what is collected, the date at the top will change and the change will be described in the app’s release notes.