PRIVACY POLICY

Effective Date: May 20, 2024

Last Updated: September 14, 2026

1. Introduction

Welcome to TrackMe (the "App"). This Privacy Policy explains how Sheriff Security AG ("we," "us," or "our") collects, uses, shares, and protects your personal data when you use our family location tracking application and related services.

Trust and security are our core values. We are committed to protecting your privacy and ensuring strict compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Swiss Federal Act on Data Protection (FADP), and other applicable data protection laws.

2. Data Controller Information

For the purposes of data protection laws, the Data Controller responsible for your personal data is:

Company Name: Sheriff Security AG
Business Identifier: D-U-N-S® Number: 487350682
Address: c/o Maryna Stryzhova, Brunngasse 66, 4153 Reinach, Switzerland
Contact Email: trackme@sheriff.com.ua

3. Information We Collect

To provide the TrackMe service, we collect the following categories of personal data:

A. Data You Provide Directly:

Account Information: Name, email address and profile picture. If you sign in with Google or Apple, we receive your account identifier, name and email address from that provider. When you sign in with email, we send a one-time code to your email address.
Family Circle Data: Information about the family groups ("Circles") you create or join, the roles assigned (e.g., Parent, Child), places you create, and SOS alerts you send.
Purchase Information: Subscription status and the purchase or transaction identifiers provided by Google Play or the Apple App Store. Payments are processed by Google or Apple; we never receive your card details.

B. Data Collected Automatically:

Precise Geolocation Data: We collect your real-time precise location data using GPS, Wi-Fi, and cellular towers. TrackMe collects background location data (even when the App is closed or not in use) to continuously share your location with your authorized Family Circle. This is the core functionality of the App.
Device Information: Device model and manufacturer, operating system and version, app version, app installation identifier, push notification token, battery level, and network status (to inform your family if your phone is unreachable).
App Usage and Analytics Data: Information on how you interact with the App (such as screens viewed, onboarding steps and subscription events), timestamps, and approximate location (country or region) derived from your IP address. Collected with Firebase Analytics.
Crash and Diagnostic Data: Crash logs, stack traces and the device state at the time of a crash. Collected with Firebase Crashlytics.
Identifiers and Attribution Data: Firebase app instance ID, AppsFlyer ID, IP address and, on Android where permitted by your device settings, the Android Advertising ID, together with information about how you found and installed the App (for example, the store or marketing campaign). Collected with AppsFlyer and Firebase.

4. Purposes and Legal Basis for Processing

Under the GDPR and FADP, we process your data based on the following legal grounds:

Purpose	Data Category	Legal Basis
Account Creation & Service Provision: To manage your TrackMe account, Circles and subscriptions, and provide customer support.	Account Information, Family Circle Data, Purchase Information	Performance of a Contract (GDPR Art. 6(1)(b))
Location Tracking & Sharing: To share your real-time location and movement history with authorized members of your Circle.	Precise Geolocation Data	Explicit Consent (GDPR Art. 6(1)(a)). You can withdraw this at any time via device settings.
Push Notifications: To deliver SOS alerts, place arrival/departure alerts and other service notifications.	Device Information (push notification token)	Performance of a Contract (GDPR Art. 6(1)(b))
Device Status Alerts: To notify your family if your battery is low or you lose connection.	Device Information	Legitimate Interest (GDPR Art. 6(1)(f)) to ensure family safety.
App Improvement & Analytics: To understand how the App is used and improve the TrackMe user experience (Firebase Analytics).	App Usage and Analytics Data, Identifiers, Device Information	Legitimate Interest (GDPR Art. 6(1)(f)) or Consent where required by applicable law.
Stability & Crash Reporting: To detect, diagnose and fix crashes and bugs (Firebase Crashlytics).	Crash and Diagnostic Data, Device Information	Legitimate Interest (GDPR Art. 6(1)(f)) in providing a reliable app.
Install Attribution & Marketing Measurement: To understand which stores and marketing campaigns lead to installs and subscriptions (AppsFlyer).	Identifiers and Attribution Data, App Usage Data	Consent (GDPR Art. 6(1)(a)) where required by applicable law, otherwise Legitimate Interest (GDPR Art. 6(1)(f)).
Legal Compliance: To comply with law enforcement requests.	All applicable data	Legal Obligation (GDPR Art. 6(1)(c)).

5. Children's Privacy

As a family tracking app, the safety and privacy of children are our highest priority.

Parental Control: TrackMe accounts for children under the age of 16 (or the applicable age of digital consent in your jurisdiction) may only be created and linked by a parent or legal guardian acting as the Family Administrator.
Data Control: The parent controls the child's data, location sharing permissions, and can delete the child's account at any time.
If we discover we have collected personal data from a child without verifiable parental consent, we will delete that information immediately.

6. Who We Share Your Data With

Sheriff Security AG does not sell, rent, or trade your personal data, including your location data, to third parties, marketers, or data brokers. We only share data with:

Your Family Circle: Members you explicitly invite and authorize within the TrackMe App.
Trusted Service Providers (Data Processors): The providers listed below, which process data on our behalf only for the purposes described in this policy and are bound by data processing agreements or equivalent terms.
Law Enforcement: Only when legally required by a valid court order or subpoena.

Third-party services and SDKs used in TrackMe:

Service	Provider	Data processed	Purpose
Firebase Analytics	Google Ireland Ltd. / Google LLC	Firebase app instance ID, Android Advertising ID (where permitted), in-app events, device model, operating system, app version, approximate location from IP address	Usage analytics and app improvement
Firebase Crashlytics	Google Ireland Ltd. / Google LLC	Crash logs, stack traces, Crashlytics installation identifier, device model, operating system, app version	Crash reporting and stability
Firebase Cloud Messaging	Google Ireland Ltd. / Google LLC	Push notification token, Firebase installation ID, notification content	Delivering push notifications
AppsFlyer	AppsFlyer Ltd.	AppsFlyer ID, Android Advertising ID (where permitted), IP address, device model, operating system, install source and in-app events (e.g., onboarding, trial and subscription events)	Install attribution and marketing campaign measurement
Google Sign-In / Sign in with Apple	Google LLC / Apple Inc.	Account identifier, name, email address	Signing in to your account
Google Play Billing / Apple App Store	Google LLC / Apple Inc.	Purchase and subscription information	Processing and verifying subscriptions
Cloud hosting	Hetzner Online GmbH	All data stored on our servers	Operating the TrackMe service

You can read how these providers handle data in their own policies: Google Privacy Policy, Privacy and Security in Firebase, AppsFlyer Services Privacy Policy, Apple Privacy Policy.

7. Data Retention

We adhere to data minimization principles:

Account Data: Retained for as long as your TrackMe account is active. When you delete your account, it is removed from our production systems immediately, and from backups within 30 days.
Location History: Real-time location is overwritten dynamically. Location history (if supported by your plan) is retained for a maximum of 7 days and then permanently deleted from our servers.
Analytics, Crash and Attribution Data: Retained by Google (Firebase) and AppsFlyer for a limited period in line with our retention settings and their terms, after which it is deleted or aggregated so that it no longer identifies you.

How to delete your account: in the App under Settings → Account → Delete Account, on our website at http://back-end.trackme-app.com/account/delete, or by emailing trackme@sheriff.com.ua.

8. International Data Transfers

Sheriff Security AG is headquartered in Switzerland. Switzerland is recognized by the European Commission as providing an adequate level of data protection. Our servers are located in the European Union. Some of our service providers, including Google, Apple and AppsFlyer, may process data in the United States or other countries outside Switzerland and the European Economic Area (EEA). In such cases we ensure your data is protected by appropriate safeguards, such as Standard Contractual Clauses (SCCs) or the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

9. Your Privacy Rights

If you are a resident of the EU/EEA or Switzerland, you possess the following rights:

Right of Access: Request a copy of the data Sheriff Security AG holds about you.
Right to Rectification: Correct inaccurate data.
Right to Erasure ("Right to be Forgotten"): Permanently delete your TrackMe account and associated data through the App settings, on our account deletion page, or by contacting us.
Right to Withdraw Consent: Stop background location sharing at any time by disabling location permissions in your phone's OS settings.
Right to Object: Object to processing based on legitimate interest, including analytics and attribution. On Android you can also delete or reset your Advertising ID in your device settings (Settings → Google → Ads).
Right to Restriction & Portability: Request suspension of processing or receive your data in a machine-readable format.

To exercise these rights, email us at trackme@sheriff.com.ua. You also have the right to lodge a complaint with your local Data Protection Supervisory Authority (e.g., the FDPIC in Switzerland).

10. Data Security

Sheriff Security AG implements state-of-the-art technical and organizational measures to protect your data. This includes TLS/SSL encryption for data in transit and encryption at rest for data stored on our servers. You are responsible for keeping access to your email account and your Family Circle invitation codes confidential.

11. Changes to this Policy

We may update this policy periodically. If material changes are made (especially regarding geolocation data), we will notify you via an in-app alert or email prior to the changes taking effect.

12. Contact Us

For any questions regarding this Privacy Policy or requests to delete your data, please contact us at:

Email: trackme@sheriff.com.ua
Mailing Address: Sheriff Security AG, c/o Maryna Stryzhova, Brunngasse 66, 4153 Reinach, Switzerland.