Privacy policy

TrajectIt is run by H&E Ltd, the controller of your personal data. It is a company registered in England and Wales (company number 16161118). You can contact us about anything in this policy at [email protected].

• Account details: your name, email address, time zone and a hashed password. If you set up two-factor authentication or passkeys, we store the data needed to make them work.
• Your content: trackers, items, fields, notes, actions, activity history and any files you upload.
• Sharing: the email addresses of people you invite to a tracker, and the roles you give them.
• Technical data: your IP address, browser type and the time of requests, kept in server logs and in your session for security and to fix errors.
• Usage analytics: a record of the actions you take in the app, such as signing up, creating, changing or deleting a tracker or item, sharing a tracker or turning on a public link. Each record carries your internal user ID, the time, and general details such as a tracker template name, how many fields changed, a role or whether a file was attached. It does not include the names, notes, file contents or other content you enter, or your name or email address.
• Error reports: when something breaks, we receive the error message and the technical trace of where it happened, linked to your user ID. Error messages can occasionally include small pieces of the data being handled at the time, such as an email address or an item title. We use these only to find and fix faults.

• To create your account, run the service and send the emails you need (verification, password resets, invitations and reminder digests). Basis: contract.
• To keep the service secure, prevent abuse and fix faults. Basis: legitimate interests.
• To understand how the product is used, find and fix errors, and improve it, using the usage analytics and error reports described above. Basis: legitimate interests. We keep this to a minimum and you can object (see below).
• To meet legal obligations. Basis: legal obligation.

We do not sell your data and we do not use it for advertising. We only send marketing email if you separately ask for it.

We use these providers to run TrajectIt. Each processes data only on our instructions.

• Laravel (Laravel Forge managed servers): hosts the application and database.
• Cloudflare R2: stores files you upload.
• Resend: delivers the emails we send.
• PostHog (EU region): receives usage analytics, error reports and technical logs. These are sent from our servers in the background, not from your browser.
• Laravel Nightwatch: application monitoring and error reporting, which records technical data such as request URLs, IP addresses and signed-in user IDs.

If you make a tracker public, anyone with its link can see the content you chose to show, without signing in. If you share a tracker with other people, they see the content and your name according to the role you give them. We may also disclose data where the law requires.

Some providers may process data outside the UK and European Economic Area, including in the United States. Where they do, we rely on adequacy decisions or standard contractual clauses and equivalent safeguards.

TrajectIt only sets cookies that are strictly necessary to run the service or that remember a choice you made in the interface, so we do not show a cookie banner. Our analytics runs on our servers, so it sets no cookies or local storage in your browser.

If we ever add cookies that are not essential, we will ask for your consent first and update this page.

• Your account and content are kept until you delete them. Deleting your account removes your trackers, items and uploaded files straight away. Encrypted backups may hold copies for a short period before they expire.
• Server logs are kept for a limited period for security and debugging, then deleted.
• Usage analytics, error reports and logs held by our analytics provider are kept only as long as they are useful for improving and fixing the product, and removed on request.

You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. You can delete your account yourself in settings. For anything else, including a copy of your data in a portable format, email [email protected] and we will respond within one month.

If you are unhappy with how we handle your data, you can complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.

Passwords are hashed, traffic is encrypted in transit and access to production systems is restricted. If a breach affects your data we will tell you and the relevant authority as the law requires.

TrajectIt is not for anyone under 16. We do not knowingly collect data from children. If you think a child has signed up, email us and we will delete the account.

We will update this page if our practices change and change the date at the top. For significant changes we will also tell you by email or in the app.