Privacy Policy
1. Introduction
This Privacy Policy describes how Camp Four Software ("Company," "we," "us," or "our"), operating the Trackless Telemetry platform ("Service"), collects, uses, discloses, and safeguards information in connection with the Service. The Service consists of two distinct components:
- SDK Telemetry -- Software development kits ("SDKs") embedded in our customers' applications that collect anonymous, aggregate event data from end users of those applications ("End Users").
- Dashboard -- A web-based management interface at dashboard.tracklesstelemetry.com used by our customers ("Dashboard Users" or "Customers") to configure applications, manage API keys, view aggregate analytics, and manage their accounts.
Contact: privacy@tracklesstelemetry.com
2. Data Controller
Camp Four Software is the data controller for Dashboard User account data. For SDK telemetry data, Camp Four Software acts as a data processor on behalf of our Customers, who are the data controllers. The Data Processing Agreement (available at tracklesstelemetry.com/dpa) defines the respective responsibilities.
3. SDK Telemetry -- End-User Data
3.1 What We Collect
Our SDKs collect the following categories of data, all pre-aggregated on the client device before transmission:
| Data Element | Description | Source |
|---|---|---|
| Event name | Developer-defined label identifying the event tracked | Application code |
| Count | Number of times an event occurred within the aggregation window | In-memory counter |
| Date | UTC calendar date on which the event occurred | System clock |
| Platform | ios, android, or web | Hardcoded per SDK |
| OS version | Version number (e.g., 17, 17.4) | Operating system API |
| Device class | phone, tablet, or desktop | Platform-specific heuristic |
| Locale | ISO 3166-1 alpha-2 country code from device locale | Device locale API |
| Language | ISO 639-1 language code (e.g., en, fr, de) | Device locale API |
| Browser | Browser family (e.g., chrome, safari, firefox, edge, other) | User agent client hints API |
| OS | Operating system family (e.g., macos, windows, linux, android, ios, other) | User agent client hints API |
| App version | Developer-provided application version string | SDK configuration |
| Build number | Developer-provided build number | SDK configuration |
| Days since install | Bucketed days since first app launch (mobile SDKs only) | Local date comparison |
| Detail | Optional event sub-type for views and features | Developer-provided |
We do not store individual event records. All telemetry is stored as pre-aggregated daily counts.
3.2 What We Do NOT Collect
- User identifiers -- No user IDs, account IDs, or login identifiers
- Device identifiers -- No device IDs, install IDs, or hardware identifiers
- Advertising identifiers -- No IDFA (Apple), GAID (Google), or SSAID
- Session identifiers -- No session IDs. Bucketed session duration and screen depth are collected as aggregate counts (not individual session records). No session identifiers are collected.
- IP addresses -- Never read, parsed, stored, or processed by application code
- Hashed IP addresses -- We do not hash, truncate, or derive data from IP addresses
- Full user agent strings -- Never transmitted to our servers
- Exact device models -- No specific device model identifiers
- Screen resolution, fonts, GPU, timezone -- No high-entropy device attributes
- Geolocation data -- No GPS, cell tower, Wi-Fi, or IP-based geolocation
3.3 No Persistent Client-Side Storage
Web SDK: Zero client-side persistence. No cookies, localStorage, sessionStorage, or IndexedDB. All aggregation occurs in volatile memory.
iOS and Android SDKs: Zero device persistence. All aggregation occurs in volatile memory. No telemetry data is written to the device filesystem.
3.4 No Fingerprinting
We collect only coarse, low-entropy device attributes. The combination of platform, OS major version, and device class does not provide sufficient entropy for device fingerprinting. Cardinality budgets prevent abuse through high-cardinality dimension combinations.
3.5 Legal Basis (GDPR)
Legitimate interests of the Customer -- Article 6(1)(f) GDPR. The Customer's legitimate interest in understanding aggregate event usage patterns constitutes the legal basis for SDK telemetry processing. No personal data identifying any individual End User is collected or stored.
4. Dashboard -- Customer Account Data
4.1 What We Collect
| Data Element | Purpose | Retention |
|---|---|---|
| Email address | Account authentication, notifications | Until account deletion |
| Password (hashed) | Authentication (managed by AWS Cognito) | Until account deletion |
| Application names | Service functionality | Until deleted by customer |
| API key metadata | Service functionality (full key is SHA-256 hashed) | Until deleted by customer |
| Session cookies | Maintaining authenticated sessions | Session duration |
| Subscription metadata | Billing and tier enforcement | Until account deletion |
| Usage counters | Tier limit enforcement (no event names or dimensions) | 395 days after period end |
4.2 Legal Basis
Contract performance -- Article 6(1)(b) GDPR. Processing is necessary for the performance of the service agreement.
5. Cookies and Similar Technologies
SDKs: Zero cookies, zero client-side storage of any kind.
Dashboard: Essential Cognito session cookies for authentication only. Not used for analytics, advertising, or cross-site tracking.
Dashboard localStorage: The dashboard uses browser localStorage for UI preferences including sidebar collapsed state, onboarding wizard progress, usage banner dismissals, and getting-started checklist state. These are essential for dashboard functionality and contain no telemetry data.
Third-party cookies: None.
See our Cookie Policy for full details.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Aggregate analytics data | Default 13 months (auto-deleted via TTL) |
| Dashboard account data | Until account deletion |
| API keys (hashed) | Until deleted by customer or account closure |
| Usage metering records | 395 days after period end |
| Operational logs | 90 days |
| Raw event payloads | Not stored |
| IP addresses | Never processed by application code |
7. IP Address Processing
Application code never reads, parses, stores, or processes IP addresses for any purpose. Locale data is derived exclusively from the device's system locale setting. AWS infrastructure services process IP addresses for DDoS protection and network routing as part of standard cloud operations.
8. Sub-Processors
| Sub-Processor | Role | Data Received |
|---|---|---|
| Amazon Web Services (AWS) | Infrastructure provider | All Service data (hosted in us-east-1) |
| Stripe, Inc. | Payment processor | User identifier, email, payment info only |
No data is shared with advertising networks, analytics providers, or data brokers. A public sub-processor list is maintained at tracklesstelemetry.com/subprocessors.
9. Data Subject Rights (GDPR)
9.1 Dashboard Users
- Right of access (Article 15): View and export all account data through the dashboard.
- Right to rectification (Article 16): Update account information through the dashboard.
- Right to erasure (Article 17): Permanently delete your account and all associated data through Account Settings.
- Right to data portability (Article 20): Export all data in JSON format.
- Right to restrict processing (Article 18): Deactivate API keys to stop collection.
- Right to object (Article 21): Contact privacy@tracklesstelemetry.com.
- Right to lodge a complaint (Article 77): Contact your local data protection supervisory authority.
9.2 End Users of Customer Applications
Trackless stores only aggregate statistical counts that cannot be attributed to any individual End User. This is consistent with GDPR Article 11 (processing which does not require identification) and Recital 26 (anonymous information).
10. Automated Decision-Making
No automated decision-making or profiling occurs within the Service.
11. CCPA / CPRA (California Privacy Rights)
The aggregate telemetry data does not constitute "personal information" under CCPA as it contains no identifiers and cannot be linked to a consumer or household. Dashboard account data is personal information; California residents may exercise their rights by contacting privacy@tracklesstelemetry.com.
Camp Four Software does not sell or share personal information as defined under CCPA/CPRA.
12. International Data Transfers
All data is hosted in AWS us-east-1 (Northern Virginia, United States). For EU/EEA transfers, we rely on the EU-US Data Privacy Framework and Standard Contractual Clauses. For UK transfers, we rely on the UK Extension to the DPF and the UK Addendum to EU SCCs.
13. Data Security
- Encryption in transit (HTTPS/TLS, minimum TLS 1.2)
- Encryption at rest (AWS-managed keys)
- API keys SHA-256 hashed before storage
- Tenant isolation via owner-based authorization
- Per-key and per-owner rate limits
- Minimal operational logging (no request bodies, no IP addresses)
- Role-based access controls and IAM policies
14. Children's Privacy
The dashboard is not directed at children under 13 and we do not knowingly collect personal information from children under 13. Because the SDKs collect no personal information, COPPA verifiable parental consent requirements do not apply to aggregate telemetry data.
15. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 30 days before taking effect.
16. Governing Law
This Privacy Policy is governed by the laws of the State of Michigan, United States.
17. Contact
Camp Four Software
Privacy Inquiries
Email: privacy@tracklesstelemetry.com
Appendix: Known Privacy Limitations
In the interest of transparency, we disclose the following inherent limitations of any aggregate counting system:
- Temporal correlation risk. An adversary with auxiliary knowledge could observe day-over-day count changes to infer individual behavior. This is mitigated by aggregation across all matching users.
- Cross-feature behavioral fingerprinting. For apps with small user bases, the pattern of which features are used could theoretically narrow the anonymity set.
- Dimension thin slices. Uncommon dimension combinations may result in small populations within a given aggregate row.