Draft, to be reviewed by counsel. This page describes how APTRYK works today. It is not final and may change before launch.
Last updated October 23, 2026
Privacy policy
This policy explains what personal information the company that runs APTRYK ("APTRYK", "we") holds when you visit our pages or use the APTRYK portal, why, and what you can do about it.
1. Two roles
For the records a business keeps in APTRYK (its staff, customers, contacts, orders, invoices, files and so on), that business decides what goes in and why. We process those records only on its behalf and on its instructions. If you are a customer or contact of a business that uses APTRYK, ask that business about your information.
For our own customers and visitors (the people who sign up, the administrators we bill, and visitors to these public pages), we decide how the information is used, as described here.
2. What we hold
- Account details: name, work email and the business you belong to. Passwords are stored only as hashes by our database host.
- Sign-up and access requests: company name, your name, email, the plan you chose and the address your request came from.
- Billing: your plan, subscription status and Stripe's ids for your customer and subscription. Card details are entered on Stripe's own page; we never see or store them.
- Security records: sign-ins, changes to settings, permissions, connections and keys, data exports, with who did it and when; for sign-ins also the network address and browser used.
- Keys you give us for your own connections (for example Stripe, Zoho or Google) are kept in an encrypted vault and used only by our server for your business.
- Server logs: our host records each request (address, time, page, result) to keep the service running and secure.
3. Why we use it
- To run the service you signed up for, sign you in and keep your business's records apart from others.
- To bill your subscription.
- To keep the service secure: limits on repeated attempts, noticing new devices, and the audit log.
- To answer your questions and tell administrators about changes to the service or these terms.
We do not sell personal information, we do not use it for advertising, and we do not use your business's records for anything but running APTRYK for you.
4. Cookies and browser storage
APTRYK uses only the cookies it needs to work. There are no analytics, advertising or tracking cookies, so we do not ask for cookie consent.
| Cookie | What it is for |
|---|---|
| Supabase session (sb-...) | Keeps you signed in. Secure, not readable by scripts. |
| aptryk_policy, aptryk_seen | Your business's sign-in rules and when the session was last used, so idle sessions end. |
| aptryk_device | A random id for this browser, so a sign-in from a new device can be noticed. Only a fingerprint of it is stored. |
| aptryk_org | Remembers which business's sign-in page you came from. |
| aptryk-theme | Dark, light or automatic display. |
| aptryk_view_as, aptryk_support_org | Set only while an administrator previews another role, or while APTRYK support views a business under a grant its administrator gave. |
In the customer portal, the order you are building (the cart) is kept in your browser's storage until you place it. The sign-up page loads Cloudflare Turnstile, which checks that a person, not a program, is signing up.
5. Who processes it for us
A few companies run parts of APTRYK for us, such as hosting, the database and payments. They are listed, with what each does, on the subprocessors page.
6. How long we keep it
- Your business's records, files, keys and logins: while your subscription runs, then deleted 30 days after it ends (sooner if you ask in writing).
- Database backups age out on their own 7 to 30 days after that.
- A sign-up nobody paid for runs out after three days.
- Our billing records about your subscription: as long as tax law requires.
7. Security
Connections use HTTPS, the database, its backups and files are encrypted at rest, and each business's records are fenced in the database itself. More on the security page.
8. Your choices
- Administrators can download all of their business's data at any time and ask for its deletion after canceling.
- You can ask us for a copy of the personal information we hold about you, or to correct or delete it, at the support address (to be added before launch).
- For records a business keeps about you, contact that business; we will help it answer.
9. Where it is kept
Our database is hosted in the United States (Supabase, United States East region). The other services we use may process information in other countries.
10. Changes and contact
We will update this page when how we handle information changes; the date at the top shows the latest version. Questions: the support address (to be added before launch).