Security at TrackAm

Designed for a small blast radius

TrackAm is intentionally narrow in what it touches. We never hold your bank credentials, we never hold your money, and we never see your card. The actual transfers happen in your own bank app — TrackAm only records what you choose to log. Even in a worst-case incident, there is very little of high value to lose.

Protecting your account

• Strong password storage. Passwords are processed using industry-standard one-way hashing. We never store them in a readable form and we never log them.
• Sign in with Google and Apple. If you prefer, you can sign in through Google or Apple — TrackAm never sees your provider password.
• Short-lived authentication. The token your phone uses to talk to our servers is short-lived and refreshed quietly in the background. If a refresh token is ever misused, the whole session family is invalidated immediately as a safety signal.
• In-app lock. Add an extra layer with a PIN plus Face ID or fingerprint quick-unlock, with auto-lock after a duration you choose.

Protecting your data

• Encrypted in transit. All communication between the app and our servers uses modern, industry-standard transport encryption.
• Encrypted at rest. The data we store on your behalf is held on secure cloud infrastructure with strong encryption applied to the storage layer.
• Protected on your device. Sensitive items such as your login token and your PIN are kept in your phone's operating-system protected storage.

What we deliberately never store

• Bank account numbers, sort codes, IBANs, card numbers, or card-verification values.
• Plain-text passwords or plain-text PINs.
• Any identifiers from your provider sign-in beyond what is strictly required to look you up next time.

How Stingy AI is kept safe

• Stingy AI can never see another user's data. Every interaction is strictly scoped to your own account.
• Any change Stingy AI makes inside your account — for example, creating a new money bucket or pausing a subscription — only happens after you explicitly confirm it in the conversation.
• Stingy AI cannot send money to anyone outside of your own buckets. It does not have the ability to transfer funds to other people.
• Every change made on your behalf is recorded so you can review what happened and when.

Operations

• Servers run on managed infrastructure that receives security updates automatically.
• Database queries are parameterised — there is no place where user input is concatenated into a query.
• Every protected request is verified against the current account state, so a suspended account cannot continue to act.

Vulnerability disclosure

Found a security issue? Please email security@gettrackam.com. We commit to acknowledging your report within 72 hours, working with you in good faith, and crediting you in our changelog if you would like — and we will never take legal action against good-faith security researchers acting responsibly.

What you can do

• Turn on the in-app PIN lock from More → Privacy & Security.
• Enable Face ID or fingerprint for faster, safer unlock.
• Set auto-lock to a short duration on a shared device.
• Use a unique, strong password — consider a reputable password manager.
• Export your data periodically from More → Privacy & Security → Export my data.