Privacy Policy

1. Introduction

GoldTrack is operated by Epik LLC dba Anchor Apps ("we," "our," or "us"), which is responsible for your information under this policy. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website goldtrack.io (the "Site").

2. Information We Collect

2.1 Automatically Collected Information

When you visit the Site, we automatically collect certain information about your device, including:

• IP address
• Browser type and version
• Operating system
• Pages visited and time spent on pages
• Referring website addresses
• Device information (mobile vs desktop)

2.2 Local Storage

We use browser local storage to save preferences on your device, such as your theme (light or dark), currency, weight units, which announcements you have dismissed, and whether you have already been asked for feedback on our redesign. These preferences are kept on your device and are not stored with your account. Your currency is also kept in a cookie (gt_currency, see Cookies) so pages load in it. Until you choose a currency, prices show in your country's currency where we support it. The country is estimated from your IP address by our network provider, Cloudflare, and is not stored for this. Your price alerts and portfolio are stored on our servers with your account.

2.3 Account Information

Core features like viewing real-time precious metals prices and charts are available without an account. However, some features require registration:

• Price Alerts: Requires account to create and manage alerts
• Portfolio Tracking: Requires account to track your holdings
• Newsletter: You can subscribe with just your email address (no account needed). When you create an account on the website, you can tick a box to get our weekly newsletter too. We only subscribe you if you tick it. Every issue has an unsubscribe link.
• Design feedback: If you rate our redesign, we store your rating, any comment, which parts of the classic design you liked (if you tell us), the page you were on and, if you are signed in, your user ID. No account is needed.

When you create an account, we collect your email address and authentication information through our identity provider (Clerk). We do not store passwords directly.

2.4 Activity Information

When you use certain features, we log activity information for security and service improvement purposes:

• Account actions (sign up, login, logout)
• Portfolio changes (adding, updating, or removing holdings)
• Alert creation and triggers
• Poll votes and newsletter subscriptions
• IP address and user agent (browser/device information)
• Timestamp of the activity

This information helps us detect unauthorized access, improve our services, and maintain security.

2.5 Contact and Support Requests

If you use our contact form or ask for support, we receive your name, email address and message, and, if you are signed in, your user ID. We use them to answer you. The request is stored in our database with our other email records (see Data Retention) and sent to our support inbox, which is run by our email hosting provider. Messages in the support inbox are kept as long as we need them to answer and follow up on your request.

3. How We Use Your Information and Legal Basis

We use the collected information to:

• Provide and maintain our Site
• Create and manage your account
• Send you price alert notifications (if you opt in)
• Track your portfolio holdings (if you use portfolio features)
• Improve and personalize user experience
• Analyze Site usage and trends
• Detect and prevent technical issues
• Comply with legal obligations

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and Switzerland, we process your information based on the following legal grounds:

• Contract: We process your email and account information to provide account services you have requested, including price alerts and portfolio tracking.
• Legitimate Interest: We process technical information, such as server logs and error reports, to keep the Site secure and working, and count visits without cookies when analytics are not allowed (see Section 4.1).
• Consent: In the EEA, the UK and Switzerland, we ask for your consent before using analytics cookies and session recording (see Section 4.1) and analytics in the mobile app (see Section 4.9), and Google asks for your consent before using cookies for personalised ads. You can withdraw consent at any time under "Your Privacy Choices" in the site footer, or in the app's Settings.
• Legal Obligation: We process data when required to comply with applicable laws and regulations.

4. Third-Party Services

4.1 Product Analytics (PostHog)

We use PostHog, a product analytics service hosted in the United States, to understand how the Site is used and to fix problems. When analytics are on, PostHog records page views, clicks and other interactions, and may record your session (a replay of how you moved through the pages). Text you type into form fields is masked and never recorded. If you are signed in, this activity is linked to your GoldTrack account ID. We do not send your name or email address to PostHog. Some account events, such as creating an alert, are sent from our servers, and only when analytics are allowed for you. Subscription billing events are recorded without being linked to you.

If you are in the EEA, the UK or Switzerland, analytics cookies and session recording stay off unless you allow them. Elsewhere they are on by default.

If you have not allowed analytics, or you turn them off, we still count page views and clicks in cookieless mode: nothing is stored on your device, no session is recorded and nothing is linked to your account. PostHog tells visits apart with a hash of your IP address and browser details that it resets every day, so visits on different days cannot be connected. These events include your country, as estimated by Cloudflare from your IP address, but not a more precise location. We do this on the basis of our legitimate interest in knowing how the Site is used. If your browser sends a Global Privacy Control signal and you have not allowed analytics, we do not use PostHog at all.

You can change your choice at any time under "Your Privacy Choices" in the site footer. See PostHog's Privacy Policy.

4.2 Advertising

We display advertisements on the Site through the following advertising partners:

Google AdSense

Google AdSense uses cookies and web beacons to serve ads based on your prior visits to our Site or other websites.

Data Collected by Google AdSense:

• Information about your visits to this and other websites
• Device and browser information
• IP address (may be used to estimate general location)
• Ad interactions (impressions, clicks)

How to Opt-Out:

• Visit Google Ads Settings to manage your ad personalization preferences
• Visit aboutads.info to opt out of interest-based advertising
• Use browser privacy settings or ad-blocking extensions

For more information, see How Google uses information from sites that use our services.

4.3 Email Delivery

We use email delivery providers to send newsletters and account emails, including price alerts, welcome emails and support emails. Your email address and the content of the email are shared with them:

• Your email address is shared with our email delivery providers so they can deliver the email
• Email content includes your alert details or newsletter content
• Delivery status is recorded, and for the newsletter, engagement data (opens, clicks) may be tracked
• The unsubscribe link in the newsletter and in marketing emails stops both. Price alerts and account emails are managed in your account settings.
• A record of each email and app notification we send (recipient, type and content) is kept in our database for up to 90 days

4.4 Error and Performance Monitoring

If analytics are allowed for you (see Section 4.1), technical details of errors on the Site (browser, operating system, page and error message) are sent to PostHog so we can fix them. Our servers also keep their own logs on our hosting infrastructure; these may include IP addresses and request details. Server logs are retained for up to 90 days.

4.5 Authentication (Clerk)

We use Clerk for user authentication and account management. You can create an account using email or Google sign-in:

Email Sign-Up:

• Your email address is collected and verified
• Passwords are hashed by Clerk and never stored in plain text
• Authentication tokens are stored securely

Google Sign-In:

• We receive your email address and basic profile information (name, profile picture) from Google
• We do not receive or store your Google password
• You can revoke GoldTrack's access to your Google account at any time via your Google Account settings

For more information, see Clerk's Privacy Policy.

4.6 Payment Processing (Stripe)

Paid subscriptions are processed through Stripe, a PCI-DSS compliant payment processor. New paid plans are currently paused; this section applies to existing subscribers. When you subscribe:

• We do NOT store your credit card details. All payment information is handled directly by Stripe.
• Stripe collects your payment card number, expiration date, and security code
• We keep only Stripe's reference numbers for your customer record, subscription and payments
• Billing address may be collected for tax purposes
• Transaction history is retained for accounting and legal compliance

Data Retention: We retain billing records for 6 years as required for tax and accounting purposes. Your payment history can be accessed through the Stripe customer portal.

For more information about how Stripe processes your data, see Stripe's Privacy Policy.

4.7 Hosting and Infrastructure

The Site, its database and its cache run on servers rented from Hetzner Online GmbH in Germany. Cloudflare provides our content delivery network and security proxy, so it processes your IP address and request data, and our encrypted database backups are stored with Cloudflare R2. Our cache temporarily stores IP addresses to limit abusive traffic (rate limiting).

4.8 Mobile Push Notifications

If you use the GoldTrack mobile app and turn on notifications, we store a push token for your device and send price alerts through the Expo push notification service, which delivers them through Apple or Google. Push tokens are deleted when you delete your account.

4.9 Mobile App Analytics

The GoldTrack mobile app also uses PostHog. When analytics are on, it records which screens you open, when the app is opened and closed, and actions such as creating an account, an alert or a holding, along with your device model, operating system, app version, language and region. It never sends prices, quantities or amounts. If you are signed in, this activity is linked to your GoldTrack account ID.

If your device region is in the EEA, the UK or Switzerland, or is not set, the app asks before collecting anything. Elsewhere analytics are on by default. You can turn them off at any time with "Share usage analytics" in the app's Settings, and the app then discards the identifier it used. The app does not record sessions and has no cookieless mode: when analytics are off, it sends nothing to PostHog.

When you create an account in the Android app, we record the campaign of the link you installed the app from, if there was one, so we know which links bring people to GoldTrack.

4.10 Mobile App Advertising

From version 1.3.0, the app shows ads from Google AdMob on the Markets screen and on metal pages. To show and measure these ads, Google receives your device’s advertising identifier (if your device allows it), your IP address (used to estimate general location), device and app information, and your interactions with ads. Accounts with an ad-free plan see no ads, and the app does not start Google’s ad service for them.

In the EEA, the UK and Switzerland, Google’s consent message asks before any ads are personalised. On iPhone, the app asks for permission to track before Google can use your advertising identifier. If you decline either one, you may still see ads that are not personalised. You can change your choice at any time with "Privacy options" in the app’s More tab (shown where a choice is required), in your device’s settings (Tracking on iPhone, Ads on Android), or in Google Ads Settings. See how Google uses information from apps that use its services.

5. Cookies and Tracking Technologies

We use cookies and similar technologies, such as local storage. Essential cookies are needed for the Site to work. We use analytics cookies only as described in Section 4.1. In the EEA, the UK and Switzerland, that means only after you allow them. Google AdSense sets advertising cookies for visitors who see ads, and in those regions Google asks for your consent first. You can change your analytics choice under "Your Privacy Choices" in the footer, and you can block or delete cookies in your browser settings.

Types of cookies we use:

• Essential cookies (needed for the Site to work): sign-in session cookies set by our authentication provider, Clerk; gt_consent, which stores your analytics choice (6 months); gt_ui_bucket and gt_ui_override, set by the redesign rollout, which we now only delete; gt_theme_default, which carries a classic-design choice over to the Classic dark theme and is removed once read (up to 1 year); gt_auth_bucket, which keeps you on the same version of our sign-in loading while we roll out a faster one (1 year); gt_auth_override, which our team uses to test that change (1 year); gt_redesign, which remembers whether you rated or closed the redesign notice, so it is not shown again (1 year); gt_currency, which remembers the currency you chose so prices show in it when the page loads (1 year).
• Analytics (PostHog): a cookie and a local storage entry whose names start with ph_, used to recognise returning browsers and sessions (up to 1 year). See Section 4.1.
• Advertising (Google AdSense): used for ad personalisation, frequency capping and measuring ads, for visitors who see ads. Paid subscribers on ad-free plans do not get ad cookies from us.

Your Cookie Choices

You can control and manage cookies in several ways:

• Browser Settings: Most browsers allow you to refuse or accept cookies. Instructions are usually found in the "Help," "Tools," or "Edit" menu.
• Third-Party Opt-Out: Visit aboutads.info or youronlinechoices.eu (for EU users)

6. Data Security

We implement appropriate technical and organizational security measures to protect your information. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain information for the following periods:

• Account Data: Retained until you delete your account. When you delete your account, your email, profile information, price alerts, portfolio data and the records of emails and notifications we sent you are permanently removed within 30 days. We keep your email address on the deletion request for up to 30 days, only to finish removing you from our service providers, and then erase it. We also ask our analytics provider (PostHog) to delete your profile, events and session recordings, and our email provider to delete your contact record, unless you are still subscribed to our newsletter.
• Billing History: Retained for 6 years after account deletion for tax and legal compliance. Your user ID is removed from these records, so in our database they are no longer linked to your account. They keep Stripe's payment reference numbers, and Stripe keeps its own records (see Section 4.6).
• Activity Logs: Activity logs store your user ID, IP address and browser details and, for most events, your email address. They are deleted after 30 days. When you delete your account, your user ID, email address, IP address and browser details are removed from them. Newsletter subscribe and unsubscribe events use a one-way hash of your email address to count unique subscribers.
• Analytics Data (PostHog): PostHog keeps analytics events for up to 1 year and session recordings for up to 30 days. When you delete your account, we ask PostHog to delete your events and recordings sooner.
• Analytics Cookies: Stored in your browser for up to 1 year (can be deleted at any time via browser settings)
• Server Logs: Retained for up to 90 days
• Email and Notification Records: Kept for up to 90 days, including contact and support requests. They are deleted sooner if you delete your account.
• Database Backups: Encrypted backups are retained for a maximum of 3 months, after which they are automatically deleted
• Design Feedback: Kept for up to 12 months. If you delete your account, it is no longer linked to you.
• Local Storage Data: Retained on your device until you clear your browser cache or local storage

8. Your Privacy Rights

For All Users

Local preferences (theme, currency) are stored on your device, and your currency also in a cookie; both can be deleted by clearing your browser data. If you have a GoldTrack account, you can export or delete your account data from your account settings or by contacting privacy@goldtrack.io.

GDPR Rights (EEA, UK, Switzerland)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:

• Right to Access: Request a copy of information we hold about you
• Right to Rectification: Request correction of inaccurate information
• Right to Erasure: Request deletion of your information
• Right to Restrict Processing: Request that we limit how we use your information
• Right to Data Portability: Request a copy of your data in a portable format
• Right to Object: Object to our processing of your information
• Right to Withdraw Consent: Withdraw consent for cookie placement at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know: Request disclosure of personal information collected, used, or shared
• Right to Delete: Request deletion of personal information we have collected
• Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information
• Right to Non-Discrimination: Exercise your rights without discriminatory treatment

Sale or sharing of personal information (US state privacy laws). We do not sell your personal information for money. Visitors who do not have an ad-free plan see ads from Google AdSense. Google may use cookies and similar identifiers to personalise these ads, which some US state laws, including California's, treat as 'selling' or 'sharing' personal information for cross-context behavioural advertising. You can opt out at any time under 'Your Privacy Choices' in the site footer. We also treat a Global Privacy Control signal from your browser as an opt-out. When you opt out, we stop loading Google AdSense for you in that browser, so Google receives no ad requests from our pages and you will not see Google ads on the Site. In the mobile app, use “Privacy options” in the More tab to opt out.

To exercise your California privacy rights, contact us at privacy@goldtrack.io with "California Privacy Request" in the subject line.

9. Children's Privacy

Our Site is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.

10. International Data Transfers

Our servers and database are hosted by Hetzner in Germany, in the European Union. Some of our service providers process personal data in the United States or other countries outside the European Economic Area (EEA), the UK and Switzerland. When they do, we rely on:

• the provider's certification under the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework; or
• the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant).

To ask for a copy of the safeguards that apply, contact privacy@goldtrack.io.

11. Disclosure of Information

We are committed to your privacy and will only disclose your information in limited circumstances. We want to be transparent about when and what we may be required to share:

11.1 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities. This includes:

• Court orders, subpoenas, or other legal processes
• Requests from law enforcement agencies with proper legal authority
• Government investigations or regulatory inquiries
• To protect our legal rights or defend against legal claims

11.2 What We May Be Required to Disclose

If legally compelled, we may be required to provide the following information:

• Account Information: Email address, account creation date, subscription tier
• Activity Logs: IP addresses, timestamps, and user agent information associated with account actions
• Portfolio Data: Holdings and transaction history
• Alert History: Price alerts you have created
• Billing Records: Transaction history and payment status (credit card details are held by Stripe, not us)

11.3 Our Commitment

We will:

• Only disclose information when legally required to do so
• Narrow the scope of disclosure to what is specifically requested
• Notify you of any legal request for your information unless prohibited by law from doing so
• Challenge overly broad or inappropriate requests where legally permissible

11.4 We Do Not Sell Your Data for Money

We do not sell, rent, or trade your personal information for money. Personalised ads from Google AdSense may count as 'sharing' under some US state laws; see 'Sale or sharing of personal information' for how to opt out. We do not share your data with data brokers, or with advertising networks other than Google AdSense, as described in Section 4.2.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us. GoldTrack is operated by Epik LLC dba Anchor Apps.