traject

Privacy Policy

Last updated 23 July 2026

1. Who controls your data

The data controller is Sigma Digital s.r.o., ID No. 08897573, with its registered office at Bělehradská 858/23, 120 00 Prague, Czechia ("Sigma Digital", "we", "us", or "our"). Traject includes the Traject mobile application, its API, and the website at traject-app.com (together, the "Service").

For privacy questions or requests, email hi@traject-app.com or write to the address above.

2. Information we process

Depending on how you use Traject, we process:

• Account information: your email address, optional first and last name, password hash if you set a password, pending email changes, and account timestamps.
• Financial tracking content: names and types of accounts or other containers you create, currencies, optional interest rates, balance check-ins, dates, notes, and adjustments or anomalies you record.
• Preferences and app state: primary currency, locale, ordering and inclusion choices, and onboarding progress.
• Authentication and security data: hashed sign-in and refresh tokens, session timestamps, IP address and basic request or server-log information used to deliver and protect the Service.
• Communications: information you include when you contact us.

Traject is not designed to collect bank credentials, card details, transaction feeds, government identifiers, precise location, contacts, photos, health data, or other special-category personal data. Please do not put unnecessary sensitive personal data in free-text names or notes.

We receive information directly from you and automatically through ordinary requests made by the app. We do not obtain personal data from social-login providers or data brokers.

3. Why we process it

• To perform our contract with you: create and authenticate your account, store and display the information you enter, calculate and present balances, send sign-in and account emails, and provide account-management features.
• For our legitimate interests: secure, troubleshoot, maintain, and improve the Service; prevent abuse; and respond to support requests. We balance these interests against your rights.
• To comply with law: meet legal obligations and respond to valid requests from authorities.
• With your consent: where we specifically ask for it. You may withdraw consent at any time without affecting earlier lawful processing.

We do not use your personal data for advertising, automated decisions with legal or similarly significant effects, or AI model training.

4. Service providers and disclosures

We use a small number of providers to operate Traject:

• Fly.io hosts the application and may process network and server-log data.
• MongoDB Atlas hosts the database containing account and app content.
• Resend sends transactional emails and processes recipient addresses, email content, and delivery metadata.

These providers process data for us under their applicable contracts. We may also disclose information when required by law, to protect rights and security, or in connection with a merger, financing, acquisition, or sale of assets, subject to appropriate confidentiality and notice requirements. We do not sell or rent personal data.

Traject retrieves reference exchange rates from Frankfurter and the European Central Bank. Those server-to-server requests contain requested dates and currency pairs, not your account details or recorded balances.

5. International transfers

Our providers may process data in the European Economic Area, the United States, or other countries where they or their subprocessors operate. Where personal data is transferred outside the EEA to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses where required.

6. Retention and deletion

We generally keep account information and financial tracking content while your account is active. You can delete your account from the app; this removes the account and its associated containers, check-ins, anomalies, and authentication tokens from the active database. Limited information may remain temporarily in provider backups or logs until they rotate, and we may retain information longer where reasonably necessary for security, legal compliance, dispute resolution, or legal claims.

Expired authentication links and tokens are removed automatically according to their configured expiry periods. Support correspondence is kept only as long as needed to handle the request and any related obligations.

7. Security

We use reasonable technical and organisational safeguards, including encrypted network transport, hashed passwords and tokens, access controls, and managed infrastructure. No system is completely secure, so we cannot guarantee absolute security. Keep your device and account credentials secure and contact us if you suspect unauthorised access.

8. Cookies and tracking

The Traject website is a static information page and does not set cookies or use analytics, advertising pixels, or similar browser tracking technologies. The mobile app does not use browser cookies. We therefore do not maintain a separate cookie policy. If this changes, we will update this policy and provide any consent controls required by law.

9. Your privacy rights

Subject to applicable law, you may ask us to access, correct, delete, restrict, or provide a portable copy of your personal data, and you may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. You may also lodge a complaint with the Czech Office for Personal Data Protection at uoou.gov.cz or with the supervisory authority where you live or work.

Email requests to hi@traject-app.com. We may need to verify your identity before fulfilling a request. These rights can have legal exceptions.

10. Children

Traject is not directed to children under 18, and we do not knowingly collect their personal data. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.

11. Changes to this policy

We may update this policy to reflect changes to Traject, our providers, or the law. We will post the revised policy here with a new date and, when a change materially affects your rights, provide additional notice where appropriate.

12. Contact