Privacy Policy
Waffle Tracker is run by Cory Ray Lund ("we", "us"). This policy explains what information the Waffle Tracker website and app collect, how it's used, who it's shared with, and the choices you have. Questions go to support@waffletracker.com.
The short version
- We collect what you type into the app, plus the minimum needed to run it.
- We don't sell your information, show ads, or track you across other apps or websites.
- Your data is private to your account unless you choose to share it with a friend or group.
- You can delete your account and its data at any time from Settings.
What we collect
Account information. Your email address, your password (stored only as a one-way hash, never in readable form), an optional display name, and the friend code the app assigns you.
Your shipping info. If you add it in Settings: your address and phone number.
What you enter. Debts, shipments, amounts, notes, tracking numbers, reminders, photos you attach, group records, and the Profiles you create for other people, which can include their names, shipping addresses and phone numbers.
Billing. Payments are handled by Stripe. We never see or store your full card number. We keep your Stripe customer and subscription IDs and the dates your access runs through.
Support emails. Messages you send to our support address, and our replies.
Notifications. If you turn on notifications, we store the delivery address your device or browser gives us so we can send them.
Technical information. Our hosting provider records standard server logs (such as IP address, time and page requested), and we use your IP address briefly to limit repeated login attempts. We use two cookies: one that keeps you logged in (it lasts up to 30 days) and one that remembers how you like your cards sorted. We don't use analytics or advertising cookies.
How we use it
- To run the app: show your records, send the notifications and emails you've asked for, and look up package tracking status.
- To handle your subscription and free trial.
- To answer support requests.
- To keep the service secure, like limiting login attempts and investigating abuse.
Who can see your information
Friends you add. A friend sees your display name (or your email if you haven't set one). When they accept your friend request, your shipping info, if you've added it, is copied into the Profile they keep for you. They also see the items you choose to share with them, photos in an item's shared photo slots, and contact cards you send them.
Groups you join. Other admins in a group see your name and the amounts you hold or have pending in that group. They don't see the person, tracking or notes on your group cards.
Apps you connect. If you create an API token in Settings, any app you give it to can read and add Profiles and debts in your account until you revoke the token.
Service providers. We use these companies to run Waffle Tracker. Each receives only what it needs for its job:
- Render hosts the app and its database.
- Stripe processes subscription payments.
- Cloudflare stores the photos you attach.
- Resend sends and receives our emails, like password resets and support replies.
- Geoapify receives the address text you type, to suggest matching addresses.
- Ship24 receives tracking numbers, to look up delivery status.
- Apple, Google or Mozilla, depending on your device or browser, deliver push notifications. They receive the notification's text.
Legal reasons. We may disclose information if the law requires it, or to protect the rights and safety of our users, the public or us.
We don't sell or rent your information to anyone.
Information about other people
Profiles you create can hold other people's names, addresses and phone numbers. Only add information you have a right to use, such as an address someone gave you so you could ship to them. That information stays private to your account unless you send it to a friend as a contact card.
How long we keep it, and deleting it
We keep your information while your account exists. You can delete your account at any time under Settings → Account Info → Delete my account. That permanently deletes your account, your records, Profiles and photos, and cancels any subscription. Some things remain after deletion:
- Items you shared with friends stay on their side as their own personal entries.
- Support emails, which we keep as a record of the conversation.
- Payment records Stripe is required to keep.
- Copies in routine backups, until those backups are replaced (within a year).
Your choices and rights
- View and edit your information in the app at any time.
- Turn notifications on or off in Settings.
- Email support@waffletracker.com for a copy of your data, or with any other privacy request. We'll respond within 30 days.
Depending on where you live, you may have other rights over your personal information, such as the right to know what we hold, correct it, or have it deleted. Contact us to use them. We won't treat you differently for doing so.
Security
All traffic is encrypted in transit, passwords are hashed, and photos are stored privately and shown only through short-lived links. No system is perfectly secure, so please use a strong password that you don't use anywhere else.
Children
Waffle Tracker is for adults 18 and over. We don't knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. For significant changes, we'll let you know in the app or by email before they take effect.
Contact
Cory Ray Lund
support@waffletracker.com