trckr legal
Privacy policy
trckr keeps your financial records in one place, and that only works if you trust us with them. This policy explains what we collect, why we collect it, where it lives and the choices you have. It is written to be read, not skimmed past.
The short version
- We collect what you give us: your sign-in details, plus the financial records and documents you choose to add.
- We use it to run trckr for you. Nothing else.
- We do not sell your data. There are no advertising trackers and no third-party analytics on trckr.
- Your records are stored in Australia, in the AWS Sydney region.
- Your data is seen only by you, an accountant you choose to invite, and the providers that run trckr for you. You can take an accountant’s access back at any time.
- You can ask for a copy of your data, ask us to correct it, or ask us to delete it.
Who we are
trckr is operated by MFlow Pty Ltd (ABN 39 633 568 635). In this policy, “we”, “us” and “trckr” mean MFlow Pty Ltd. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
trckr is currently an invite-only beta. This policy still applies in full: beta data is real data, and we treat it that way.
What we collect
We only collect information trckr needs to work. There are no hidden categories.
Account and sign-in details
You sign in with Google through Auth0, our sign-in provider. From that we receive your name, your email address and an account identifier. We never see or store your Google password.
The financial records you add
Bank, broker and exchange statements and balances, property and loan details, and income and deduction records. You choose what to add, and trckr is built to work with partial information.
Documents you upload
PDFs, receipts and statements you upload so trckr can read them and draft entries for you. We keep the original file attached to the records it created, so every figure can be traced back to its source.
Waitlist and contact details
If you join the waitlist or email us, we hold the email address you gave us.
Feedback
If you send feedback from inside the app, we receive the message you wrote and, only if you chose to attach one, a screenshot.
Technical logs and error reports
Basic records of the service running, which we use to find and fix problems. Before a log line is written, email addresses and long numbers (such as account numbers) are scrubbed out of it.
What we deliberately do not collect
There are no advertising trackers, no marketing pixels and no third-party analytics tools on trckr. We do not buy information about you from anyone.
How we use your information
- Running the service. Showing your balances, records, summaries and estimates back to you is what trckr is.
- Reading your documents. When you upload a document, an AI model (AWS Bedrock, running inside AWS) reads it and pre-fills a draft for you. The result is always a draft: nothing enters your records until you review and confirm it. We do not use your documents to train AI models.
- Estimates and summaries. We calculate the estimates and summaries you see from the records you added. trckr prepares estimates and organised records; we never lodge anything on your behalf.
- Support. Answering you when you contact us, and acting on the feedback you send.
We do not use your information for advertising, and we do not sell it. Ever.
Where your information lives
trckr runs on Amazon Web Services (AWS) in the Sydney region (ap-southeast-2). Your records, your uploaded documents and our backups are stored there, in Australia.
Two service providers can process some of your information outside Australia, each for one named reason:
- Auth0 handles sign-in. It holds your sign-in profile (name, email address and account identifier) in the regions its service is configured to use. We use Auth0 so that passwords and sign-in security are handled by a specialist, not built from scratch.
- AWS Bedrock reads the documents you upload so trckr can draft entries for you. That model processing stays inside AWS but may run in AWS regions outside Australia.
We do not send your information overseas for any other reason.
Who can see your data
You, and only you, unless you decide otherwise.
If you invite your accountant, their practice can see the records you shared, for the work you asked them to do. That access exists only because you granted it, you can see that it is active, and you can revoke it at any time. Revoking it cuts off their access.
Beyond that, we share personal information only with the service providers named above (AWS and Auth0), and with authorities if the law requires it, only to the extent it requires.
How we protect it
Your connection to trckr is encrypted. Access keys you provide to link an account are encrypted before they are saved. Access to the systems that run trckr is limited to the people who operate it. And as above, log lines are scrubbed of email addresses and long numbers before they are written.
Keeping and deleting your data
We keep your records while your account is active, because keeping year-round records together is the point of trckr.
If you want your data deleted, email us at contact@trckr.com.au and we will delete your account and its records. Deletion is an assisted process today: a person handles the request and confirms with you when it is done. Copies in backups are not removed instantly; they age out on a schedule, and we do not restore them except to recover from a disaster.
If you are on the waitlist and want off it, the same address works. We will remove your email.
Your rights
Under the Australian Privacy Principles you can ask us for a copy of the personal information we hold about you, and ask us to correct anything that is wrong. Most of your records you can view and edit directly in the app; for anything else, email us at contact@trckr.com.au and we will help.
If you think we have mishandled your information, please contact us first at contact@trckr.com.au. We want to hear it and we will respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes to this policy
When this policy changes, we update the version date at the top of this page. For changes that matter, we will also tell you in the app or by email. The current version is 2026-08-24.
Contact
MFlow Pty Ltd (ABN 39 633 568 635)
Email: contact@trckr.com.au