Privacy Policy

Last updated: May 21, 2026

Introduction

TravTrak is operated by TravTrak LLC, 1001 S. Main St. STE 600, Kalispell, MT 59901. TravTrak is a credential and career management platform for healthcare travel nurses, available as a web application at travtrak.com and as a mobile app on iOS and Android.

This Privacy Policy explains what information we collect when you use TravTrak, how we use and share it, how we protect it, and what rights you have over your data. By creating an account or using TravTrak, you agree to this Privacy Policy. If you do not agree, please do not use the service.

1. Information We Collect

Information You Provide Directly

We collect information that you provide directly to us, including:

Name and email address (for account creation and authentication)
Professional credentials and certifications (document type, number, state, issue and expiration dates)
Vaccination and immunization records (vaccine name, type, administration date, expiration date, administered by, notes)
License numbers and expiration dates
Employment and contract information
Staffing agency contact details
Network contacts (names and professional details you manually enter)
Profile information (display name, avatar)
Uploaded documents — certifications, licenses, contracts (Premium tier only)
Legal agreement records (timestamp and version of Terms of Service accepted at registration)

Information Collected Automatically

When you use TravTrak, we and our service providers may automatically collect:

Device information (browser type, operating system, device model)
Device identifiers — including Advertising ID (Android) and, with your permission, IDFA (iOS)
IP address and approximate location data
Usage data (pages or screens visited, features used, time spent, crash logs)
Push notification preferences (mobile app)
Cookies and similar browser storage technologies (web)
Subscription and purchase status (processed by Stripe on web; by RevenueCat and your app store on mobile)

Information We Do Not Collect

Passwords — TravTrak uses passwordless one-time-code (OTP) authentication; no passwords are stored
Patient health information or any data belonging to your patients
Precise geolocation
Payment card numbers — all payments are handled by Stripe (web), Apple App Store, or Google Play (mobile)

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our services
Send credential expiration reminders and notifications (via email on web; via push notification on mobile)
Process payments and manage subscriptions
Display advertisements to free-tier users (mobile only, via Google AdMob)
Respond to your questions and support requests
Send important updates about our service
Prevent fraud and enhance security
Analyze usage patterns to improve user experience
Comply with legal obligations

We do not use your professional credential data for advertising targeting, sale to third parties, or any purpose beyond operating the service you requested.

3. Advertising and Tracking (Mobile App)

Google AdMob

The free tier of TravTrak's mobile app displays banner advertisements served by Google AdMob (a service of Google LLC). AdMob may collect and use your device advertising identifier (Advertising ID on Android; IDFA on iOS), IP address, and in-app usage data to serve personalized advertisements. AdMob's data practices are governed by Google's Privacy Policy.

Premium subscribers and users who purchase “Remove Ads” do not see AdMob advertisements.

App Tracking Transparency (iOS)

On iOS 14.5 and later, Apple requires us to request your permission before accessing your IDFA for advertising purposes. When you first launch TravTrak on iOS, you will see Apple's App Tracking Transparency (ATT) prompt. If you decline, we will not use your IDFA for ad targeting. You can change this setting at any time in Settings → Privacy & Security → Tracking.

Opting Out of Personalized Advertising

Android: Settings → Privacy → Ads → “Opt out of Ads Personalization”
iOS: Decline the ATT prompt, or go to Settings → Privacy & Security → Tracking and disable tracking for TravTrak

Even if you opt out of personalized ads, you may still see non-personalized advertisements on the free mobile tier.

CCPA Note: Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, providing device identifiers to Google AdMob for cross-context behavioral advertising may constitute “sharing” for targeted advertising purposes. California residents have the right to opt out of this sharing. See Section 11 for details.

4. Third-Party Services

We work with trusted third-party service providers to operate TravTrak. Each is bound by their own privacy policy, which we encourage you to review. We do not sell your personal information to these or any other third parties.

Supabase

Database, authentication, and file storage. All TravTrak user data is stored on Supabase-hosted infrastructure in the United States. Privacy Policy

Vercel (web)

Web application hosting and infrastructure. Privacy Policy

Stripe (web)

Payment processing for web subscriptions and purchases. Stripe receives your payment card information directly; TravTrak does not store it. Privacy Policy

Resend (web)

Email delivery for credential expiration reminders and service notifications. Privacy Policy

Apple App Store & Google Play (mobile)

Mobile subscription billing and payment processing. These stores handle all payment data for mobile purchases. Transaction confirmation is shared with TravTrak and RevenueCat to verify your entitlement. Apple Privacy Policy · Google Privacy Policy

RevenueCat (mobile)

Manages in-app subscription and purchase entitlements on iOS and Android. RevenueCat receives purchase transaction tokens from Apple/Google to verify and manage your subscription status. RevenueCat does not receive your payment card information. Privacy Policy

Expo (mobile push notifications)

Provides push notification delivery infrastructure. Expo receives your push notification token (a device-specific identifier) to route credential expiration reminders to your device. Privacy Policy

Google AdMob (mobile, free tier)

Serves banner advertisements to free-tier mobile users. May collect device identifiers and usage data for ad targeting. See Section 3 for details and opt-out instructions. Google Privacy Policy

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

Service Providers: We share data with the third-party providers listed in Section 4 solely to operate TravTrak and provide the service to you.

Legal Requirements: We may disclose your information if required by applicable law, court order, or government request, or to protect the rights, property, or safety of TravTrak, our users, or the public.

Business Transfers: If TravTrak is involved in a merger, acquisition, or sale of assets, your information may be transferred to a successor entity. We will notify you by email or in-app notice before your data becomes subject to a materially different privacy policy.

With Your Consent: We may share your information for any other purpose you explicitly authorize.

6. Data Security

We implement industry-standard security measures to protect your information:

Encryption in transit (HTTPS/TLS) and at rest
Passwordless authentication via one-time codes — no passwords are stored
Row-level security policies restricting database access
Regular security audits and updates
Access controls and monitoring

Important: While we take reasonable precautions to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information to the best of our ability. If you believe your account has been compromised, contact us immediately at support@travtrak.com.

7. Data Retention

We retain your information for as long as your account is active. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal, tax, or regulatory purposes. Transaction records may be retained for up to 7 years as required by law.

Data held by third-party service providers (such as RevenueCat transaction history, AdMob analytics, or Stripe payment records) is subject to their own retention policies.

You can request deletion of your data at any time by contacting support@travtrak.com or by deleting your account in Settings.

8. Your Rights and Choices

Access and Update: You can access and update your personal information at any time through your account settings.

Delete Account: You can delete your account and all associated data from Settings → Account → Delete Account, or by contacting support@travtrak.com.

Notifications: You can control email notification preferences in your account settings (web), or disable push notifications in your device settings or in the app (mobile). Note that you may still receive essential service emails.

Data Portability: You can request a copy of your data in a portable format by contacting support@travtrak.com.

Advertising Opt-Out: See Section 3 for instructions on opting out of personalized advertising on the mobile app.

Cookies: You can control cookies and browser storage through your browser settings. See our for a full breakdown of every technology we use and how to opt out. Note that disabling strictly necessary cookies will prevent you from staying signed in.

9. Cookies and Tracking Technologies (Web)

On the TravTrak website, we use cookies and similar browser technologies to keep you signed in, remember your preferences, and understand how TravTrak is used. We do not use advertising or cross-site tracking cookies on the web platform.

For a complete list of every cookie and storage technology we use — including which are strictly necessary, which are functional, and how to control them — please read our dedicated .

10. HIPAA Disclaimer

TravTrak stores your own professional credentials — such as your certifications, vaccination records, and employment contracts — for your personal career management use. TravTrak is not a HIPAA-covered entity, is not a Business Associate under HIPAA, and is not designed or intended to store, process, or transmit Protected Health Information (PHI).

Do not enter patient information, patient records, patient identifiers, or any other PHI into TravTrak. We expressly disclaim any liability arising from your uploading or storing of PHI in TravTrak.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to know what personal information we collect, use, disclose, and share
Right to delete your personal information (subject to certain exceptions)
Right to correct inaccurate personal information
Right to opt out of the sharing of personal information for cross-context behavioral advertising (AdMob targeted ads — see Section 3)
Right to non-discrimination for exercising your privacy rights

We do not sell personal information. However, providing device identifiers to Google AdMob for targeted advertising on the mobile app may constitute “sharing” under CCPA/CPRA. To opt out of this sharing, use the advertising opt-out steps in Section 3.

To exercise your other CCPA rights, contact us at support@travtrak.com with the subject line “California Privacy Request.” We will respond within 45 days and may need to verify your identity before processing your request. We do not knowingly sell or share the personal information of California residents under 16 without affirmative authorization.

12. Montana Privacy Rights (MCDPA)

If you are a Montana resident, you have rights under the Montana Consumer Data Privacy Act (MCDPA), effective October 1, 2024:

Right to confirm whether we process your personal data and to access that data
Right to correct inaccuracies in your personal data
Right to delete personal data you have provided to us
Right to obtain a portable copy of your personal data in a format that allows you to transfer it
Right to opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling (TravTrak does not sell data or engage in profiling)

To exercise any of these rights, contact us at support@travtrak.com. We will respond within 45 days of receiving your request. This period may be extended by an additional 45 days where reasonably necessary, and we will notify you of any such extension.

Appeals: If we decline to act on your request, we will inform you of the reason within the response period. You may appeal that decision by sending a written appeal to support@travtrak.com with the subject line “MCDPA Appeal.” We will respond to your appeal within 60 days. If your appeal is denied, you may contact the Montana Attorney General to submit a complaint at dojmt.gov/consumer.

13. GDPR — Rights for EEA, UK, and Swiss Residents

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) or equivalent legislation:

Right of access — obtain a copy of your personal data we hold
Right to rectification — correct inaccurate or incomplete data
Right to erasure — request deletion of your data (“right to be forgotten”), subject to legal retention requirements
Right to restriction — ask us to limit processing of your data
Right to data portability — receive your data in a machine-readable format
Right to object — object to processing based on legitimate interests
Right to withdraw consent — where processing is based on consent (e.g., ad tracking), you may withdraw at any time without affecting prior processing

Lawful basis for processing: We process your data on the following legal bases: performance of our contract with you (providing the service), compliance with legal obligations, and legitimate interests (fraud prevention, service improvement). Where we process data based on consent (e.g., ATT ad tracking on iOS), you may withdraw that consent at any time.

International transfers: Your data is stored in the United States. Where required by applicable law, we rely on Standard Contractual Clauses (SCCs) as the legal mechanism for transferring personal data from the EEA/UK to the US.

To exercise your GDPR rights, contact us at support@travtrak.com. We will respond within 30 days (extendable by two months for complex requests). You also have the right to lodge a complaint with your local data protection authority.

14. Children's Privacy

TravTrak is intended exclusively for use by adults who are healthcare professionals or students in a healthcare field. We do not knowingly collect personal information from children under the age of 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@travtrak.com and we will promptly delete that information.

15. International Data Transfers

Your information is stored and processed in the United States, where our primary service providers (Supabase, Vercel) are located. If you access TravTrak from outside the United States, your information may be transferred to, stored, and processed in a country with different data protection laws than your country of residence. Where required by applicable law (including GDPR), we rely on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs).

16. Third-Party Links

TravTrak may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies before providing any information.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on our website and in the app at least 14 days before the changes take effect. Your continued use of TravTrak after changes take effect constitutes acceptance of the updated policy.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Company: TravTrak LLC

Address: 1001 S. Main St. STE 600, Kalispell, MT 59901

Email: support@travtrak.com

Website: https://travtrak.com

Response Time: We respond to privacy inquiries within 48 hours

By using TravTrak, you acknowledge that you have read and understood this Privacy Policy.