Privacy policy
How Tack handles the data of our customers and of the people who take part in their tests and answer their pins.
Last updated November 5, 2026
Who we are
The controller of personal data is Martin Prokop, Na Vidouli 1025/1d, 158 00 Praha – Jinonice, Czech Republic, Company ID (IČO) 76252591. For questions about personal data, write to hello@trytack.io. We reply within a month at the latest.
Who this policy covers
Visitors of trytack.io, people on the waitlist, customers who use the Tack app, and respondents and visitors of sites where customers installed Tack.
trytack.io and the waitlist
When you join the waitlist, we store your e-mail, language, where you signed up (e.g. the form on the home page) and the date. We use them only to invite you to Tack and send you the related e-mail. The legal basis is our legitimate interest in responding to your interest in the service. We keep the entry until we invite you; after that it becomes part of your account. We remove you from the waitlist any time, just write to us. The site also runs our own pin, a short anonymous survey; its answers are processed like respondent data below.
Visit measurement and cookies on this website
On trytack.io (the home page, the blog and the legal pages) we measure visits with Google Analytics 4 by Google Ireland Limited, but only if you agree in the consent bar. Without consent Google's script is not loaded at all. With consent the _ga and _ga_* cookies are stored (for at most 13 months) and we measure page views, sections viewed, questions expanded and button clicks, such as signing up or joining the waitlist. Advertising features and Google signals are off. Google may transfer data to the US under the EU–US Data Privacy Framework. You can withdraw consent at any time under Cookie settings in the footer. Without consent we store only necessary cookies: NEXT_LOCALE (language), tack_theme (appearance) and tack_consent (your choice, 6 months); in the app, after signing in, also a sign-in cookie (30 days). Google Analytics is not used in the Tack app or in the script on our customers' sites.
Customer data
For an account we store your e-mail, your name if you add it, workspaces, members and their roles, passkeys (only the public key, never a fingerprint or face) and credit orders. For security and operations we keep technical records (logs) for a short time. We use the data to provide the service, to send messages you need (sign-in links, invitations, limit notices), for invoicing and to protect the service. The legal bases are the contract, legal obligations (accounting and tax) and our legitimate interest in security. We do not send marketing e-mails without your consent.
News by e-mail
Now and then we send customers with a Tack account an e-mail with news about Tack and tips for testing. Account sign-up says so. We do this on the basis of legitimate interest (Art. 6(1)(f) GDPR) and Section 7(3) of Czech Act No. 480/2004 Coll., and only about our own services. You can unsubscribe at any time in your account settings or with the link in any such e-mail, with immediate effect. E-mails the service needs (sign-in, receipts, limits, notices about your tests, changes to the terms) still go out after you unsubscribe.
Data of respondents and visitors of customers' sites
On sites where customers install Tack, the script records page views, clicks, scroll depth, task outcomes and answers to questions. It sets no cookies and does not record typing outside answer fields. It also reports the address path of each page it loads on, without the part after ? or #, linked to no visitor, so the customer can see where Tack runs; these paths are kept for 90 days. It keeps an anonymous visitor ID, a visit count and test progress in browser storage (tack:vid, tack:visits, tack:study and similar), so questions do not repeat and a test continues across pages. The IP address is stored only as a hash, and only to prevent abuse. For this data the controller is the customer who installed Tack on their site; we are their processor and process it only on their instructions (see the Terms of service, Processing personal data for customers). The customer decides what to ask and is responsible for informing respondents, so please contact the site's operator first; we are glad to help them.
Where data lives and who helps us
App data is stored in the European Union. These processors help us: Railway (hosting and database, EU West region in the Netherlands), Resend (sending e-mails, EU region in Ireland), Stripe Payments Europe (card payments, Ireland), Fakturoid (issuing tax invoices, Czech Republic) and Google Ireland (website visit measurement, only with consent). Railway, Resend and Google have parent companies in the US; any transfer outside the EU is covered by standard contractual clauses or the EU–US Data Privacy Framework. We do not sell data and do not use it for advertising or to train AI models.
Payments
Card payments for credits are processed by Stripe. Tack never sees or stores card details; we keep only the order, its amount and the Stripe reference. The billing details you enter at payment are used to issue the tax invoice. Stripe may transfer data outside the EU under its own safeguards.
How long we keep data
Test and pin data is deleted automatically after the retention period of the workspace plan, 90 days on the default plan. Account data is kept while you use the account. When you delete the account in Settings → Account, we delete it at once, along with workspaces where you are the only member. Deleted data leaves our database backups, which we keep for 14 days, within that time at the latest. Orders and invoices are kept for 10 years under tax law. Sign-in links and abuse-prevention records are removed after a day, unaccepted invitations after 30 days. Waitlist entries are kept until we invite you or you ask us to delete them.
Security
All communication is encrypted. You sign in without a password, with a link by e-mail or a passkey. Workspace data is available only to its members according to their roles. Only the operator can access production data, and only when needed to run or support the service.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing and to data portability. You can object to processing based on legitimate interest and withdraw consent at any time. Just write to hello@trytack.io. Workspace owners can delete tests, pins and individual respondents themselves. If you are not satisfied, you can lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).
Changes to this policy
We update the policy when the service or our processors change. The date of the last change is at the top. We tell customers about material changes by e-mail in advance.