Effective date: July 13, 2026 Last updated: July 13, 2026 Version: 1.0
This Privacy Policy describes how ShotTrack ("we," "our," "the app") handles your information when you use the ShotTrack mobile application. ShotTrack is operated by Nauman Khan, located at Islamabad, Pakistan. You can reach us at privacy@shottrack.app.
If you are a Washington resident, please also see our Consumer Health Data Privacy Policy, which is required by Washington's My Health My Data Act and applies in addition to this Policy.
1. Information we collect
Information you provide directly:
Account information: email address (when you create an account)
Profile information: chosen display name, persona type, dosing schedule, current weight, goal weight, target pace
Medication information: which GLP-1 medications you track, doses, schedules, pen inventory
Injection logs: dates, times, dose amounts, injection sites, and notes you choose to add
Quest progress: which guided setup steps you've completed
Information collected automatically:
App usage data: which features you use, how often, screen flows. We use this to understand how the app is performing and to improve it.
Device information: device type, operating system version, app version, language, time zone
An internal user identifier (a randomly-generated UUID) used to link your activity to your account
Information we do NOT collect:
Real names (unless you choose to enter one as your display name)
Phone numbers
Date of birth (we ask you to confirm you are 18 or over, but do not store your date of birth)
Precise location (we do not collect GPS data)
Browsing history outside ShotTrack
Photos, contacts, or other device data we don't need
Health data from Apple Health or Google Health Connect (this integration is not enabled in v1)
2. How we use your information
We use the information you provide to:
Provide the core features of the app: logging doses, calculating adherence, showing your medication-level chart, recommending injection-site rotation, and similar features you actively use
Sync your data across your devices when you have an account
Send you transactional emails: email verification, password reset (if you use email + password sign-in)
Improve the app: understand which features are used, find bugs, prioritize what to build
Respond to your support requests and privacy inquiries
We do NOT use your information to:
Sell or rent it to third parties
Show you advertisements (ShotTrack contains no ads)
Build profiles for advertising networks
Train AI models
Share with insurance companies, employers, or healthcare providers (you can export your own data and choose to share it; we never share on your behalf)
3. How we share your information
We use a small number of third-party service providers to operate the app. We share information with these providers only as needed to provide the service. We do not sell your information to anyone.
Our service providers:
Supabase — hosts your account and synced data. Located in the United States. supabase.com/privacy
PostHog — receives product analytics events tagged with your internal user identifier (never your name or email). Located in the United States. posthog.com/privacy
RevenueCat — manages subscriptions if you choose to subscribe. Receives a subscription identifier. Located in the United States. revenuecat.com/privacy
OneSignal — handles push notifications if you opt in. Receives a device-specific push token. Located in the United States. onesignal.com/privacy_policy
Loops — sends transactional emails (verification, password reset). Receives the email address used for account sign-in. Located in the United States. loops.so/privacy
Apple and Google — if you use Sign in with Apple or Continue with Google, those providers handle the authentication. They receive only what's necessary to confirm your identity to ShotTrack.
We may also disclose information if required by law (a valid subpoena, court order, or similar legal process) or if necessary to protect against fraud or security threats. We will notify you when legally permitted to do so.
4. Where your data lives and how we protect it
Your synced data is stored on Supabase servers in the United States. Even though ShotTrack is operated from Pakistan, the data infrastructure is US-based.
We protect your data through:
Row-level security: the database enforces that you can only access your own data
Encryption in transit: all communication between the app and our servers uses HTTPS (TLS)
Encryption at rest: Supabase encrypts stored data
Limited access: only Nauman (the developer) has administrative access; no employees or contractors have access to user data
Authentication: account access requires sign-in with credentials we don't see (Supabase manages authentication)
No system is perfectly secure. We do our best to protect your data, but we cannot guarantee absolute security. You can help by using a strong, unique password and not sharing your account.
5. Your choices and rights
You can control your information in several ways.
In the app, at any time:
Edit: change your profile, schedule, medications, or other data through Settings
Export: download a copy of your data through Settings → Account → Export my data. The export is a JSON file you can save or share.
Delete an injection log: swipe to delete from the Log screen
Delete your account: Settings → Account → Delete account. This permanently deletes your account and all your data within seconds.
Sign out: Settings → Account → Sign out. This removes your data from this device but keeps it in your account.
We respond to privacy requests within 45 days. We may need to verify your identity by replying from the email on your account. We do not charge for these requests.
State-specific rights. Depending on where you live in the United States, you may have additional rights:
California (CCPA/CPRA): right to know, delete, correct, and limit use of sensitive personal information; right to opt out of "sale" or "sharing" (we do neither). California residents can exercise these rights using the methods above.
Colorado, Connecticut, Virginia, Utah, Texas, and other states with comprehensive privacy laws: rights to access, correct, delete, and port your data; rights to opt out of certain processing. Use the methods above.
We do not discriminate against you for exercising your rights.
Authorized agents. If you'd like an authorized agent to make a request on your behalf, email privacy@shottrack.app with documentation showing the agent's authority to act for you.
6. How long we keep your data
Active accounts: we keep your data as long as your account is active.
After you delete your account: we delete your data immediately. We retain a small audit record (a hash of your account, timestamp, no personal information) for 90 days for security and abuse-prevention purposes.
Local-only users: data stored on your device is deleted when you delete the app.
Inactive accounts: if you don't use ShotTrack for two years, we may delete your account after notice to your registered email.
ShotTrack is not intended for users under 18. The app requires you to confirm you are 18 or older when you first use it. We do not knowingly collect information from children under 13 (which would be subject to COPPA in the United States) or from minors aged 13–17. If we learn we have collected information from a person under 18, we will delete it.
If you believe we have collected information from a child under 18, please email privacy@shottrack.app.
8. International users
ShotTrack is intended for users in the United States. The app is available worldwide on the App Store and Google Play, but the privacy practices described in this policy are written for US users.
If you are outside the United States, by using ShotTrack you understand that your data will be stored and processed in the United States, and that US privacy laws (which may be different from those in your country) will apply.
We do not currently support data subject rights specific to GDPR (European Union), UK GDPR, LGPD (Brazil), or other non-US privacy frameworks at v1. If you are a resident of one of these regions and want to exercise your rights, email privacy@shottrack.app and we will respond as best we can.
9. Changes to this policy
We may update this Privacy Policy from time to time. When we do:
We will update the "Last updated" date at the top of the policy
For significant changes (new third-party recipients, new categories of data collected, new uses of your data), we will notify you in the app and ask you to review the updated policy
For minor changes (clarifications, typo fixes), we will update the policy without separate notice
If you continue using ShotTrack after a change, you accept the updated policy. If you do not accept it, you can delete your account.
You can always see the current version at https://shottrack.app/privacy.
This Privacy Policy is governed by the laws of Pakistan. Any disputes will be resolved in the courts of Pakistan, except where applicable law (such as Washington's My Health My Data Act) requires otherwise.