Privacy Policy
Last updated 17 September 2026
How OnlyTrackr collects, uses and protects personal data: yours as a customer, and the data of the accounts and fans you manage with it.
1. Who we are
OnlyTrackr Ltd. (“OnlyTrackr”, “we”, “us”), Example Street 1, 110 00 Prague, Czech Republic, runs the OnlyTrackr website, web application and API (the “Service”). You can reach us about privacy at support@onlytrackr.com.
This policy uses the terms defined in our Terms & Conditions, such as Customer, Connected Account, Account Owner and Team Member.
2. Our role
- For our Customers’ and Team Members’ own account, billing and usage data, and for visitors to our website, we are the controller: we decide how and why that data is used.
- For personal data inside Connected Accounts, including Account Owners’ and fans’ data, the Customer that connected the account is the controller. We process that data only on the Customer’s behalf, on its instructions, to provide the Service.
If you are a fan or an Account Owner and want to exercise your rights over data processed through a Connected Account, contact the Customer that manages the account. If you contact us instead, we will pass your request on to that Customer where we can identify it.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored only as a secure hash), profile picture | You, or Discord, X or Google when you sign in with them |
| Organization data | Organization name, members, roles, invitations and the email addresses they were sent to | You and your Team Members |
| Security and usage data | IP address and browser details of your sign-in sessions, API keys you create, records of requests and errors | Your browser and our servers |
| Billing data | Plan, subscription status, billing email and invoices; card details are held by Stripe, not by us | You and Stripe |
| Connected Account data | Account profile, the session data needed to act for the account (stored encrypted), its email address, proxy details | You and the Platform |
| Fan data | Usernames and profile details, messages, purchases, tips, subscriptions, lists, and which link a fan came from | The Platform, through a Connected Account |
| Customer Content | Media, captions, message templates, schedules, rules and settings | You and your Team Members |
| Messages to us | The content of emails and support requests | You |
| Website visits | IP address and request details in our server logs | Your browser |
When you connect an account by signing in to it through the Service, its password is used for that sign-in only. It is held encrypted for at most 15 minutes while the sign-in runs, and is never stored.
4. How we use it, and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the Service: accounts, sign-in, organizations and every feature you use | Account, organization, Connected Account and fan data, Customer Content | Performance of our contract with you (Art. 6(1)(b)) |
| Billing, and allowing one free trial per email address | Account and billing data | Contract (Art. 6(1)(b)); our legitimate interest in preventing trial abuse (Art. 6(1)(f)) |
| Keep the Service and accounts secure, prevent abuse, and find and fix errors | Security and usage data | Our legitimate interest in a secure, working Service (Art. 6(1)(f)) |
| Send service emails: verification, invitations, billing and important changes | Account data | Contract (Art. 6(1)(b)) |
| Answer your messages | Messages to us, account data | Contract or legitimate interest (Art. 6(1)(b), (f)) |
| Keep accounting records and comply with the law | Billing data | Legal obligation (Art. 6(1)(c)) |
We do not sell personal data, use it for advertising, or use fans’ data for any purpose of our own. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
5. Who we share it with
We share personal data only as far as needed for the purposes above, with:
| Recipient | Why | What they receive |
|---|---|---|
| Hosting and infrastructure providers | Run our servers, databases and file storage | All data stored in the Service |
| Cloudflare | Deliver and protect our website | IP addresses and request details |
| Stripe | Process payments and manage subscriptions | Billing data |
| Discord, X and Google | Sign you in, when you choose to use them | What you authorise them to share |
| Proxy providers | Route a Connected Account’s traffic through its own IP address | Connection details of that traffic |
| A captcha-solving service | Complete the challenge shown when a Connected Account signs in | The challenge’s image or audio only, never credentials |
| Discord, Telegram and Lovense | Deliver alerts and run integrations you turn on | What you configure them to receive, which can include fans’ names and messages |
| The Platform | Carry out what you do with a Connected Account | The requests you make through the Service |
We may also disclose personal data to professional advisers, to an authority or court where the law requires it, and to a buyer or successor if our business is sold or reorganised.
6. International transfers
Some of our providers process data outside the European Economic Area, for example in the United States. Where a country does not have an adequacy decision from the European Commission, we rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, organization, Connected Account and fan data, Customer Content | While your account is open. A Connected Account’s data goes when you remove it, and the rest within a reasonable period after you close your account, unless the law requires us to keep it. |
| Sign-in sessions | Until you sign out or the session expires |
| Passwords used to connect an account | At most 15 minutes, never stored |
| Message text logged by word filtering | 7 days by default, adjustable by the Customer |
| The notification feed of a Connected Account | Its latest 200 notifications |
| Server logs | Up to 14 days |
| Record of which email addresses have used a free trial | Kept, to allow one trial per email address |
| Invoices and accounting records | As long as accounting and tax law requires |
8. Security
Data is encrypted in transit. Credentials and session data of Connected Accounts are encrypted at rest, sign-in passwords are stored only as secure hashes, and access to production systems is limited to the people who need it. No system is perfectly secure, so please keep your own credentials and API keys safe, and tell us at once if you suspect misuse.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it, including processing based on our legitimate interests;
- receive data you gave us in a portable format;
- withdraw a consent you gave, without affecting what was done before.
To use them, write to support@onlytrackr.com. We answer within one month, and may ask you to confirm your identity first. You also have the right to complain to a data protection authority, in particular where you live or work or where we are established.
11. Age
The Service is for people aged 18 and over. We do not knowingly collect data about anyone younger.
12. Changes to this policy
We may update this policy. We publish the new version on this page with a new date and, for material changes, tell Customers by email or in the app.
13. Contact
Questions about this policy or your data can be sent to support@onlytrackr.com, or by post to OnlyTrackr Ltd., Example Street 1, 110 00 Prague, Czech Republic.