TRAX operates from Romania and this site is subject to the GDPR. What follows describes what is actually collected by this website and by the rider-facing app at /app, why it is held, and how to have it removed.
Page views are recorded with Aptabase, a privacy-friendly analytics service that does not use cookies and does not build a profile of a visitor across sites. What is recorded is which page was opened, an anonymous per-session identifier, a coarse device class and the referring site. No advertising trackers, remarketing pixels or social media trackers run on this site.
Errors are reported to Sentry so that faults can be found and fixed. An error report can include the page being viewed and technical details of the failure.
The site is hosted on Vercel, which keeps short-lived server access logs containing IP addresses, as any web server does. TRAX does not use these logs for analytics.
The app at /app is for riders admitted to the collective. It holds a rider's name, their phone number, their standing, which experiences they took part in and completed, any objects issued to them, and the two sentences they choose to write after an experience.
There are no accounts and no passwords. A rider's device is bound by a one-time link sent over WhatsApp, and the session is held in a cookie scoped to /app so that it is never sent with a request for the rest of this website.
A rider's own written lines are private by default. They are published only where that rider has explicitly ticked the box allowing it, and then only under a first name. Nothing a rider writes is shown to another rider.
The Threshold self-assessment is answered entirely on the device. Nothing typed into it reaches a server, and no analytics event is recorded anywhere inside it.
Links to the app are delivered over WhatsApp using Twilio. The message contains the rider's own single-use link and nothing else. TRAX does not send marketing messages, newsletters or scheduled broadcasts, and there is no push notification capability anywhere in the product.
The serial lookup at /app/m is public and requires no identity. It returns the tier, year, issue date and status of an object, and never returns a name or any other personal data.
Under the GDPR you may ask for a copy of the personal data held about you, ask for it to be corrected, or ask for it to be erased. A rider using the app can erase their own record directly: the option sits at the bottom of their record and removes their rows from the database and their data from the device.
For anything else, message the WhatsApp number on the contact page and say what you want done. Requests are handled by a person.
Data is kept for as long as it is useful to the collective's own record and no longer. Nothing held by TRAX is sold, rented, or shared with advertisers.