1. Information We Collect
- User-provided data: habits, tasks, reminders, alarms, finance entries, timer sessions, notes, and preferences — all stored locally on your device.
- Device information: model, OS version, and usage logs used for crash reporting and performance improvement.
- Notification data: schedules and configurations for reminders and alarms, stored locally.
- Statistics and progress data: habit completion history, streak counts, task goal progress — stored locally on your device.
- Merchant memory: if you use the Finance Tracker, the app stores merchant-to-category mappings locally to auto-fill categories on future entries.
- SMS data (optional): bank and UPI transaction messages, only when you explicitly use the "Import from SMS" feature. See Section 3.
- Email address (optional): if you use the Splits (expense-sharing) feature, we collect your email address to create an account and sign you in via a one-time code. This is stored on our servers (Supabase), not on-device. See Sections 5 and 11.
2. How We Use Information
- Core functionality: habit tracking, task management, reminders, alarms, timers (focus, stopwatch, workout, interval), finance tracking, and progress visualisation.
- Notifications and alarms: delivering reminders and alarm alerts at the times you configure, including on the lock screen.
- Reliability: anonymised crash reports and analytics to diagnose issues and improve the app.
- App updates: checking for and applying over-the-air (OTA) updates via Expo's update service. See Section 6.
3. SMS Data and the Finance Tracker
The Finance Tracker is a core feature of XTrack. If you choose to use "Import from SMS", the app will request the READ_SMS permission to automatically detect and import bank and UPI transactions from your inbox.
- What we read: only financial SMS messages from banks and UPI services (transaction alerts, payment confirmations).
- Why we read it: to automatically create finance entries without manual input, saving you time and reducing errors.
- On-device only: SMS data is processed entirely on your device. It is never uploaded to any server, shared with third parties, or stored outside the app.
- User-controlled: SMS is read only when you explicitly tap "Import from SMS" and grant the permission. You can revoke it any time in device Settings → Apps → XTrack → Permissions → SMS.
- No background monitoring: the app does not monitor incoming SMS or read messages in the background.
4. Device Permissions Explained
- POST_NOTIFICATIONS: to deliver habit reminders and alarm notifications.
- SCHEDULE_EXACT_ALARM / USE_EXACT_ALARM: to fire alarms at the precise time you set.
- USE_FULL_SCREEN_INTENT / SYSTEM_ALERT_WINDOW: to display alarm alerts as a full-screen overlay, including on the lock screen, so you don't miss an alarm.
- RECEIVE_BOOT_COMPLETED: to restore your alarm and reminder schedules automatically after a device restart.
- WAKE_LOCK: to keep the screen on during active timer sessions (focus timer, workout timer, stopwatch) when you have the keep-awake option enabled.
- MODIFY_AUDIO_SETTINGS / VIBRATE: to play alarm sounds at the volume you configure and trigger vibration for notifications.
- INTERNET: to check for and download over-the-air app updates. No personal data is sent.
- READ_SMS: only for the Finance Tracker SMS import feature. See Section 3.
- RECORD_AUDIO: declared by the expo-audio library included in the app. XTrack does not actively record audio.
- READ_EXTERNAL_STORAGE / WRITE_EXTERNAL_STORAGE: used by the app framework for accessing bundled sound assets. No personal files are read or written.
5. Data Storage
- Habits, finance entries, timers, alarms, and notes are stored locally on your device using AsyncStorage (a standard Android local storage mechanism), and are never synced to external servers.
- Splits account data: if you sign in for the Splits feature, your email address, group memberships, and shared expense records are stored on our backend (Supabase), encrypted in transit (HTTPS/TLS), so they can be shared with other members of your expense-splitting group.
- Uninstalling the app permanently deletes all locally stored data. Your Splits account is not deleted by uninstalling — see Section 11.
6. Over-the-Air (OTA) Updates
XTrack uses Expo's update service to deliver app improvements without requiring a full Play Store download. When the app checks for updates, it contacts Expo's servers (expo.dev). Only anonymous update metadata is exchanged — no personal data, habits, or finance information is transmitted. You can review Expo's privacy practices at their website.
7. Alarm Overlay and Lock Screen Display
To ensure alarms are visible even when your screen is off or you are using another app, XTrack uses Android's full-screen intent and draw-over-other-apps capabilities. This means an alarm screen may appear over your lock screen or current app when an alarm fires. No data from other apps is accessed through this mechanism.
8. Data Sharing
- No sale of data: we do not sell personal information.
- Limited sharing: anonymised crash/analytics data may be shared with trusted service providers (e.g. Expo) solely to maintain app quality. Splits account data (email, group membership, shared expenses) is processed by our backend provider (Supabase) solely to operate the Splits feature, and is visible to other members of the same expense-splitting group.
- SMS data: never sold, shared, or transferred to any third party under any circumstance.
- No advertising networks: XTrack does not use advertising SDKs or share data with advertisers.
9. Children's Privacy
XTrack is not directed to children under 13. If under 13, parental consent is required. We comply with applicable child privacy laws.
10. Security
Data stored on your device is protected by your device's own security (screen lock, encryption). App updates are delivered over encrypted HTTPS connections. No method is 100% secure.
11. Your Rights
- Delete all local data: clear app storage via device Settings → Apps → XTrack → Storage → Clear Data, or simply uninstall the app.
- Delete your Splits account: see our Account Deletion page to remove your email and account data from our servers.
- Revoke SMS permission: device Settings → Apps → XTrack → Permissions → SMS → Deny.
- Revoke notification permission: device Settings → Apps → XTrack → Notifications.
- Revoke alarm overlay: device Settings → Apps → XTrack → Display over other apps.
12. Changes to This Policy
We may update this policy. Changes will be posted here with an updated effective date. Continued use of the app constitutes acceptance of the updated policy.
13. Contact
Email: xternix.dev@gmail.com