← Back

Privacy Policy

Last Updated: January 19, 2026

1. Introduction

This Privacy Policy describes how Commoner Apps LLC ("Trackara Pro," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use our customer portal at sign.trackara.app ("Service"), where mechanics and auto repair shops ("Service Providers") share quotes, work orders, invoices and inspection reports with you.

By using the Service, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information You Provide

Depending on what you do, you provide:

• Name: Your full name as entered in the signature form
• Email Address: Optional when you sign; required when you buy a report from us, so we can send it to you
• Electronic Signature: Your digital signature captured on the signature pad
• Approval and Choices: Your consents, your approval of the document, and the optional items you accepted or declined
• Florida Estimate Answers: For Service Providers in Florida, your answers on the estimate notices, whether you want replaced parts returned, how you plan to pay, and the name and phone number of anyone else you authorize to approve work. Only list someone who has agreed to this.
• Payment Notes: If you tap "I've sent payment", the note you enter

2.2 Automatically Collected Information

When you use the Service, we automatically collect:

Information Type	Purpose
IP Address	Fraud prevention, legal compliance, signature authentication
Device Information	Browser type, operating system, screen resolution
Timestamp	Record exact time of signature for legal purposes
User Agent	Browser and device identification
Language and Time Zone	Recorded with your signature as part of the signing record
Session Duration	Time spent reviewing the document before signing
Document Fingerprint	A code calculated from the document's contents, to show exactly what you signed
Invoice View Time	When you first open an invoice, so the Service Provider knows you have seen it

2.3 Document Information

We store the documents the Service Provider shares with you (quotes, work orders, invoices and inspection reports), including:

• Service descriptions and line items
• Pricing information (subtotal, tax, fees, total, payments)
• Vehicle information
• Photos and videos the Service Provider attaches
• Service Provider (mechanic) details
• Document version and modification history

2.4 Payment Information

When you pay an invoice online, you enter your card or Afterpay details on the payment processor's own page (Square, First Nationwide Payments or Stripe, depending on the Service Provider), not on ours. We never receive your card number or your Afterpay application. From the processor we receive the payment status, amount, payment type (for example card or Afterpay), the card brand and last four digits for card payments, and a receipt link. We store these with the invoice and share them with the Service Provider so they can see that you paid. If you tap "I've sent payment", we store your note together with the payment method the Service Provider has set up.

2.5 Products You Buy From Trackara

If you buy a vehicle history report from us, we collect your email address and the vehicle's VIN. Stripe processes your payment. We send the VIN to our vehicle data provider (VinAudit, an NMVTIS data provider) to produce the report. The report is stored with the Service Provider's record of your vehicle, and if you choose to share it, the Service Provider is told and can view it. We keep the order and the report, and we email you a link to it.

2.6 Items Your Service Provider Includes

If the Service Provider includes a report or a Trackara Link code with your service, we email it to the address the Service Provider has on file for you. Trackara Link invitation pages show the Service Provider's name and contact details and your vehicle; the Trackara app has its own privacy policy.

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Primary Purposes

• Provide the Service: Show you your documents, record your signature and choices, confirm payments, and deliver reports you buy
• Legal Compliance: Maintain legally valid records of signed agreements
• Fraud Prevention: Detect and prevent fraudulent signatures
• Signing Records: Record who signed, when, and from what browser and device
• Dispute Resolution: Provide evidence in case of disputes

3.2 Secondary Purposes

• Communication: Email you reports you buy and items your Service Provider includes
• Service Improvement: Fix problems and improve how the Service works
• Technical Support: Troubleshoot technical issues
• Security: Monitor for security threats and vulnerabilities

4. Data Sharing and Disclosure

4.1 Who We Share With

We share your information only in the following circumstances:

• Service Provider (Mechanic): The mechanic or auto repair shop who sent you the document receives your signature, name, email, approval and choices, the signing record (including IP address and device information), your Florida estimate answers, when you viewed an invoice, payment confirmations and notes, and whether you bought and shared a report
• Cloud Storage Provider: We use Google Firebase to securely store documents, signatures, photos and videos
• Hosting Provider: Our web hosting service (Hostinger) hosts the application
• IP Address Service: We use ipify.org to collect your IP address
• Payment Processors: If you pay online, the Service Provider's processor (Square, First Nationwide Payments or Stripe) and, if you choose Afterpay, Afterpay US, Inc. collect your payment details directly under their own privacy policies. We pass the invoice number and amount, and for First Nationwide Payments your name. If you buy a report from us, Stripe processes the payment and receives your email address.
• Vehicle Data Provider: VinAudit (an NMVTIS data provider) receives the VIN when you buy a vehicle history report
• Email Delivery: Our email provider delivers the report and add-on emails we send you

4.2 Legal Requirements

We may disclose your information if required by law, such as:

• Responding to subpoenas, court orders, or legal processes
• Complying with government investigations
• Protecting our legal rights or defending against claims
• Preventing fraud or illegal activity
• Protecting safety of users or the public

4.3 Business Transfers

If Commoner Apps LLC is acquired, merged, or sells assets, your information may be transferred to the new owner. You will be notified of any such change via email or prominent notice on the Service.

4.4 What We DO NOT Do

We DO NOT:

• Sell your personal information to third parties
• Share your data with advertisers
• Use your signature for any purpose other than the document you signed
• Rent or lease your contact information

5. Data Retention

5.1 Retention Period

Documents, signatures, signing records and payment confirmations are kept for as long as the Service Provider keeps them in their account, generally up to 7 years (standard business record retention). The Service Provider may delete documents sooner. Report orders and reports you buy from us are kept for as long as we need them for the report, our tax and accounting records, and any dispute.

5.2 Rationale

We retain data for this duration to:

• Comply with legal obligations (statute of limitations for contracts)
• Resolve disputes that may arise years later
• Maintain audit trails for regulatory compliance
• Provide evidence in legal proceedings

5.3 Deletion After Retention Period

After the retention period expires, we will securely delete or anonymize your personal information unless we are legally required to retain it longer.

6. Your Privacy Rights

6.1 General Rights

You have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you
• Right to Correction: Request correction of inaccurate or incomplete information
• Right to Deletion: Request deletion of your information (subject to legal retention requirements)
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing of your data for certain purposes

6.2 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information (with exceptions for legal compliance)
• Right to opt-out of the "sale" of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights

6.3 European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under GDPR:

• Right to data portability
• Right to restriction of processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

6.4 How to Exercise Your Rights

To exercise any of these rights, contact:

• The Service Provider (mechanic) who sent you the document, who controls the document data
• Trackara Pro: Email support@trackara.app for platform-level requests and for reports you bought from us

We will respond within the time limits in Section 15.3.

7. Data Security

7.1 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption in Transit: SSL/TLS encryption (HTTPS) for all data transmission
• Encryption at Rest: Data stored in encrypted Firebase databases
• Access Controls: Documents open only from the private link sent to you, which acts as the key, so anyone who has the link can open it. Once a quote or work order is signed, only the Service Provider can read it.
• Signing Records: We record when documents are signed and what was signed
• Security Reviews: Periodic security assessments
• Secure Authentication: Service Providers use secure authentication to access data

7.2 Limitations

Despite our efforts, no system is 100% secure. We cannot guarantee:

• Absolute security of data transmitted over the internet
• Protection against all cyber attacks or breaches
• Security of links you click in emails

You use the Service at your own risk.

8. Data Breach Notification

8.1 Our Commitment

In the event of a data breach affecting your personal information, we will:

• Notify you without undue delay after discovering the breach, and notify regulators within 72 hours where the GDPR requires it
• Describe the breach: What data was affected and how
• Explain the impact: Potential consequences to you
• Detail our response: Steps we've taken to address the breach
• Provide guidance: Recommended actions you should take

8.2 Notification Method

We will notify you via:

• Email (if you provided one)
• Prominent notice on the Service
• Contact through the Service Provider who sent you the document

8.3 Regulatory Reporting

We will also report breaches to relevant regulatory authorities as required by law.

9. Cookies and Tracking Technologies

9.1 Cookies We Use

The Service does not set cookies and does not use your browser's storage to track you. While a page is open, it connects to our Google Firebase database to load and save your document.

9.2 Third-Party Services

We use these third-party services that may collect data:

• Google Firebase: Database and file storage (see Google Privacy Policy)
• Google Fonts: Loads the page's fonts, so Google receives your IP address
• ipify.org: IP address lookup when you sign (no cookies)
• Square and Afterpay: Only when you pay an invoice online, on their own checkout pages (see the Square Privacy Notice and the Afterpay Privacy Policy)
• First Nationwide Payments and Stripe: Only when you pay a Service Provider who uses them, or, for Stripe, when you buy a report from us (see the Stripe Privacy Policy)
• VinAudit: Only when you buy a vehicle history report

9.3 Analytics

We currently do NOT use analytics services (Google Analytics, etc.). If this changes, we will update this policy and notify you.

10. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

11. Canadian Privacy Rights (PIPEDA)

If you are a Canadian resident, your personal information is protected under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

11.1 PIPEDA Compliance

Trackara Pro complies with PIPEDA's 10 Fair Information Principles:

• Accountability: We are responsible for personal information under our control
• Identifying Purposes: We identify why we collect information at or before collection
• Consent: We obtain meaningful consent for collection, use, and disclosure
• Limiting Collection: We collect only information necessary for identified purposes
• Limiting Use, Disclosure, and Retention: We use information only for stated purposes
• Accuracy: We keep information accurate, complete, and up-to-date
• Safeguards: We protect information with appropriate security measures
• Openness: We make our privacy policies readily available
• Individual Access: You can request access to your personal information
• Challenging Compliance: You can challenge our compliance with these principles

11.2 Your PIPEDA Rights

As a Canadian resident, you have the right to:

• Access your personal information held by us
• Challenge the accuracy and completeness of your information
• Request correction of inaccurate information
• Withdraw consent (subject to legal or contractual restrictions)
• File a complaint with the Privacy Commissioner of Canada

11.3 Privacy Commissioner of Canada

If you are not satisfied with our response to a privacy concern, you may contact:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own. These countries may have different data protection laws. By using the Service, you consent to the transfer of your information to:

• United States (where our servers are located)
• Any country where Google Firebase operates

We ensure appropriate safeguards are in place for international transfers, including:

• Standard contractual clauses approved by the EU Commission
• The EU-U.S. Data Privacy Framework, where the receiving provider participates
• PIPEDA-compliant safeguards for Canadian users' data

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last Updated" date at the top
• Material changes will be prominently posted on the Service
• For significant changes affecting your rights, we will notify you by email (if provided)
• Your continued use of the Service after changes constitutes acceptance

14. Do Not Track Signals

Our Service does not currently respond to "Do Not Track" (DNT) browser signals. We collect minimal tracking data as described in this policy regardless of DNT settings.

15. Contact Information

15.1 Privacy Questions

For questions about this Privacy Policy or to exercise your privacy rights, contact:

Privacy Officer
Commoner Apps LLC (Trackara Pro)
Email: support@trackara.app
Phone: (801) 946-9396
Website: https://pro.trackara.app

15.2 Data Controller

For GDPR and PIPEDA purposes, the data controllers are:

• Trackara Pro (Commoner Apps LLC): Controls platform data and the data for reports you buy from us
• Service Provider (Mechanic): Controls the documents they send you and their customer data

15.3 Response Time

We aim to respond to all privacy inquiries within:

• 30 days for general requests and PIPEDA requests
• One month for GDPR requests (may extend by two more months for complex requests)
• For California CCPA requests, we confirm receipt within 10 business days and respond within 45 days

16. Your Consent

By using the Service, including checking the box that consents to electronic signatures and agrees to the Terms of Service and this Privacy Policy when you sign, you consent to:

• Collection of your personal information as described
• Use of your information for the purposes stated
• Sharing of information with parties listed in this policy
• Storage of your data for the retention periods specified
• International transfer of your data

---

This Privacy Policy was last updated on January 19, 2026. We recommend reviewing this policy periodically to stay informed about how we protect your information.

← Back