Privacy Policy

Tracker holds some of the most personal information there is: where you go, who you are with, what you drink or smoke, and how you sleep. This policy explains exactly what we collect on this website and in Tracker, why, who else handles it, how long we keep it, and how you can see it or have it deleted. We never sell your data, we do not show ads, and we do not use your data to train AI models.

Privacy at a glance

We never sell your personal information or share it for targeted advertising. We run no ads, no analytics and no third-party trackers on this website or in Tracker.

Who we are and what this policy covers

"Slightly Darker", "we" and "us" mean Slightly Darker Entertainment, LLC, a New York limited liability company operating from Los Angeles, California. We decide how and why the information described here is used.

This policy covers:

• The website at slightlydarker.com, including its contact form.
• Tracker, our personal tracking app at tracker.slightlydarker.com, including its connections to WHOOP, Google Maps, OwnTracks and Open-Meteo, and its MCP server (the interface that lets an AI assistant you choose read and edit your Tracker data).

If you live in Washington, Nevada or Connecticut, or simply want the short version for health data, see our separate Consumer Health Data Notice. Our Terms of Use also apply.

Tracker is offered to adults in the United States and is currently invite-only.

Notice at collection

This section and the table above are our notice at collection. For each kind of information:

• What we collect and why is described in the next two sections.
• Sensitive information: Tracker collects precise location, health-related information (substance use, sleep, recovery, heart rate and workouts) and account sign-in credentials. See Sensitive information and health data.
• Sale and sharing: we do not sell any personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in California law.
• How long we keep it: see How long we keep information.

Information we collect

On the website

• Contact form. When you send a message, we receive your name, your email address and your message. The website does not store the message in a database: it is emailed to our inbox at hello@slightlydarker.com, sent through our email provider Resend from our own domain, with your address set as the reply-to so we can answer you.
• Bot check. The contact form uses Vercel BotID, an invisible check that looks at signals from your browser to tell people from automated bots. There is no puzzle to solve.
• Request logs. Like any website, our host Vercel processes your IP address, browser type and the pages you request in order to deliver the site and protect it from abuse, including rate limits on contact form submissions.

The website sets no advertising or analytics cookies and loads no third-party tracking scripts.

In Tracker: your account

• Account details. Your email address and an internal account ID.
• Sign-in list. The email addresses allowed to create an account, including addresses that a user has added to invite someone, who added them and when each last signed in.
• Passkeys. For each passkey you register: a credential ID, its public key, a usage counter, the type of authenticator and a label. Your fingerprint or face never leaves your device; Face ID or Touch ID simply unlocks the passkey on your device.
• Email sign-in codes. When you ask for a code, we send a 6-digit code and a sign-in link to your email address. The code expires after 10 minutes and allows 5 attempts.
• Settings. Your home place and time zone, units, temperature unit, first day of the week and the time your day starts.

In Tracker: what you log

Everything below is entered by you, or created by Tracker from what you enter.

• Stops and places. Where you were and when (arrival, departure, time zone), notes, and the places you save (name, map pin, address, type, geofence radius and automatic check-in settings, and a Google place ID when you picked the place from Google search). A stop you have not named yet keeps the position where you logged it until you name it.
• Intakes. What you had (for example coffee, alcohol, cannabis or nicotine, from your own list of substances), how much, a label, when, and any note.
• Journal. Your daily entry, how you slept, a sleep note, dosing and "shows" notes, the city you were in and travel stops.
• Plans. Stops you plan to make: place or title, time, note and the people you plan to see.
• People. Names of people you were with, their nicknames, notes about them, their home place (if you set one) and whether they are a favorite. See Information about other people.
• Photos, videos and other media. Files you attach to stops, with their type, dimensions and the time they were taken, plus small thumbnails your browser makes from them. Files are stored exactly as you upload them, so any metadata inside them (such as the time, camera details or the location where a photo was taken) is kept too.
• Search queries. What you type into Tracker's search, used to find your records and not saved.

In Tracker: your location

• Location trail from OwnTracks. If you set up the OwnTracks app on your phone, it sends Tracker your phone's location reports: latitude and longitude, accuracy, time, altitude, speed and battery level where reported, entering and leaving places you have set up as regions, and the full report as sent. Tracker also stores, for each phone, a label, a hash of its access credential, when it last reported, its app version, monitoring mode, battery level and the settings and regions it reports.
• Your position when you use Tracker. When you log a stop or intake, open the app or edit a record, Tracker records your device's position, if your browser allows it. While Tracker is open on today's page, it shows your live position on the map.
• Your corrections. If you move or exclude a point on your trail, Tracker keeps your correction beside the original report.

Tracker uses your trail to work out stops, travel, distances and which stop an intake belongs to. These are calculated when you view them.

From WHOOP (only if you connect it)

If you connect your WHOOP account, you authorize Tracker on WHOOP's own sign-in page. Tracker then receives, through the WHOOP API, data covered by the permissions you approve (profile, recovery, sleep, workouts, cycles and body measurements, plus ongoing access):

• Profile and body measurements: your WHOOP user ID, name, email address, height, weight and maximum heart rate.
• Sleep, recovery, cycles and workouts: sleep times and stages, sleep performance, recovery score, heart-rate variability, resting heart rate, strain, workouts with their sport, duration, distance, heart-rate zones and calories, and the full records as WHOOP sends them.

WHOOP keeps this data current by notifying Tracker of changes, and Tracker also checks for updates once a day.

Weather

For each day, Tracker stores the observed weather (temperature, rainfall, conditions, sunrise and sunset) at where you were that day, and fetches the forecast when you look at upcoming days.

MCP tokens

If you connect an AI assistant to Tracker, we keep a record of each access token: which client it is for, when it was made, when it was last used and whether it has been revoked.

Technical and security information

Tracker keeps short-lived records needed to run securely: rate-limit counters tied to your IP address (for example, how many sign-in codes were requested from it in the past hour), sign-in challenges, the names of AI clients you approve, and service logs. Production logs replace personal details such as names, places, notes, coordinates, email addresses and search terms with a placeholder, and never print passwords, tokens or keys.

What we do not collect

We do not collect payment information, government ID numbers, advertising identifiers, or your phone's contacts or address book. Tracker only receives the photos, videos and other media files you choose to upload.

Sensitive information and health data

Some of what Tracker holds is "sensitive personal information" under California law, and "consumer health data" under laws in Washington, Nevada and Connecticut:

• Health-related information: your intakes of alcohol, cannabis, nicotine and other substances, your journal's sleep and dosing notes, and WHOOP sleep, recovery, heart-rate, workout and body measurements.
• Precise location: your OwnTracks trail, the positions Tracker records when you use it, your stops and places.
• Account credentials: passkeys and sign-in codes.

We use sensitive information only to provide the Tracker features you ask for, to keep your account secure, and to meet legal obligations. We do not use it to infer characteristics about you, to profile you, or for advertising. Because we only use it for these purposes, California law does not require a "Limit the use of my sensitive personal information" link. More detail for health data is in our Consumer Health Data Notice.

How we use information

We use personal information to:

• Run Tracker for you: store your records, draw your day, map and trends, match intakes to stops, calculate totals and show weather.
• Sync the services you connect: keep WHOOP data current and accept your phone's OwnTracks reports.
• Look things up for you: find addresses and places with Google, and show street-level images of places.
• Sign you in and keep your account safe: passkeys, email codes, sessions, rate limits and logs to detect and fix problems.
• Answer your MCP client: return the data your AI assistant asks for, and make the edits it requests, when you have connected it.
• Reply to messages you send through the website or by email.
• Meet legal obligations and enforce our Terms of Use.

We do not use your personal information for advertising, we do not sell it, and we do not use it to train or improve artificial intelligence or machine-learning models, ours or anyone else's.

AI assistants and the MCP server

Tracker includes an MCP server (Model Context Protocol), which lets an AI assistant that you choose, such as Claude, read your Tracker log and make some edits for you. Here is how it works:

• You turn it on. Nothing is connected by default. You connect a client either by approving it after signing in to Tracker (for example, adding Tracker as a custom connector in Claude), or by using a token we create for you at your request.
• What it can read. Your days, stops, intakes, location trail summaries, journal, plans, places, people, substances, trends and WHOOP data, when the assistant asks for them.
• What it can change. It can edit people and places, create and edit plans, edit a day's journal and who you were with, and delete people and places. It cannot log new stops or intakes.
• Where the data goes. Data your assistant reads is sent to that assistant and its provider (for Claude, Anthropic). Their handling of it, including whether conversations are kept or used to train models, is governed by your agreement and settings with that provider, not by this policy. That provider is not our service provider, and we do not control what it does with the data.
• Turning it off. Tokens do not expire on their own. You can see each token, when it was last used, and revoke it in Tracker under Settings, Access; the next request from that client fails. Revoking stops future access but cannot recall data the assistant has already read.
• Keep tokens secret. Anyone holding a token can use it until it is revoked.

Disclosures to your AI assistant happen only at your direction. We do not treat them as a sale.

Who we share information with

We share personal information only in these ways.

Service providers

These companies process information on our behalf to run the website and Tracker. They may only use it to provide their service to us.

Services you connect

• WHOOP is the source of your WHOOP data. We do not send WHOOP anything except what is needed to request your data and manage the connection.
• OwnTracks is an app you install on your phone. It sends data to us; we send it back only the settings and region commands needed to run your location trail.
• Your AI assistant, as described above.

Other cases

• Legal reasons. If we are required to by law, or need to protect someone's safety, our rights or the security of the Services. We will tell you about a request for your data unless the law prevents it.
• Business transfer. If Slightly Darker is involved in a merger, acquisition or sale of assets, your information may be transferred as part of it, and this policy (or one at least as protective) will continue to apply. We will tell you before it happens.
• With your permission. Any other sharing happens only if you ask us to or agree to it first.

WHOOP data

In addition to everything else in this policy:

• WHOOP data is used only to show you your sleep, recovery and workouts in Tracker, and to provide it to MCP clients you connect.
• We never sell, rent, license or market WHOOP data, never use it in advertising, and never use it to train or improve any AI or machine-learning model.
• We do not use WHOOP data to give medical advice.
• The keys that let Tracker reach your WHOOP account are encrypted (AES-256-GCM) before they are stored.
• If you delete a sleep, recovery or workout in WHOOP, WHOOP tells Tracker and we delete our copy of it.
• You can withdraw Tracker's access at any time from your WHOOP account. To have your stored WHOOP data deleted, email privacy@slightlydarker.com.
• You can ask us for a copy of your WHOOP data that Tracker holds.

Tracker uses the WHOOP API and is not affiliated with or endorsed by WHOOP, Inc.

Google Maps Platform

Tracker's map, address search, place search and place images come from Google Maps Platform. When you use these features:

• Your browser loads maps directly from Google, so Google receives your IP address and the area of the map you are viewing.
• Tracker sends Google the text you search for, and the coordinates near which to search.
• To label your travel and unnamed stops with a street address, Tracker sends Google the coordinates of points on your trail. Labels for travel are saved with the point; the hint for an unnamed stop is not saved.
• When you choose a place from Google results, Tracker saves its name, address, coordinates, type and Google place ID as one of your places.
• For a place without your own photo, Tracker checks with Google whether a Street View image exists at its pin, and stores the image to show on the place page.

Google's use of this information is governed by the Google Privacy Policy. Use of Google Maps features in Tracker is also subject to the Google Maps/Google Earth Additional Terms of Service.

Cookies and similar technologies

Website. The website sets no advertising, analytics or tracking cookies. Vercel BotID may use temporary browser data for the bot check on the contact form.

Tracker. Tracker uses only cookies it needs to work: your sign-in session, and a short-lived security cookie while you connect WHOOP. Tracker also saves a few things in your browser's own storage on your device: text you are still typing (so an interruption does not lose it, deleted once you save or discard it) and which passkeys this device has used. That stays on your device.

Do Not Track and Global Privacy Control. Because we do not sell or share personal information, or track you across other sites, there is nothing for these signals to switch off. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing, which we already do not do.

How long we keep information

When you delete a stop, intake, plan, photo or video in Tracker, it is removed at once, including the stored file. People and places you delete are hidden and marked as deleted, so your past stops still make sense, and are removed for good when your account is deleted or when you ask us. Points on your location trail cannot be deleted one by one in Tracker (you can exclude them), and journal text can be edited or cleared; we delete either on request. When you ask us to delete your account, we delete your data from our live systems within 30 days, and from backups within the backup period above.

Your rights and choices

Wherever you live in the United States, you can ask us to:

• Access: tell you what personal information we hold about you and give you a copy of it, in a portable, machine-readable format.
• Correct: fix information that is wrong. You can edit most of it yourself in Tracker.
• Delete: delete your personal information, including your whole account.
• Withdraw consent: stop collecting or using information you allowed us to collect, such as location or WHOOP data.
• Appeal: ask us to reconsider if we turn down your request.

You can also opt out of sale or sharing and limit use of sensitive information, but we do neither of these things, so there is nothing to opt out of. We will not treat you differently for using any of these rights.

How to make a request

Email privacy@slightlydarker.com from the email address on your Tracker account and tell us what you would like. You can also download your data from Tracker.

• Verification. To protect your data, we only act on requests we can match to the account. Usually a request from your account's email address is enough; we may also ask you to confirm by signing in.
• Authorized agents. Someone can make a request for you with your written permission. We may ask you to confirm your identity directly.
• Timing. We will confirm we received your request within 10 business days and respond within 45 days. If we need more time, up to 45 more days, we will tell you why.
• Appeals. If we deny your request, reply to our answer with "Appeal" in the subject. We will respond within 45 days, explaining what we decided and why. If you are still unhappy, you can contact your state attorney general.

Information about other people

Tracker lets you record other people: their names, nicknames, notes, home place, when you were with them, and photos or videos that may show them. We handle that information on your behalf as part of your account, and only you (and any MCP client you connect) can see it. Please record only what you have a right to.

If you believe someone has recorded information about you in Tracker, email privacy@slightlydarker.com. Each Tracker account is private, so we may not be able to tell you whose account it is, but we will look into it and, where appropriate, remove it or ask the account holder to.

Security

We protect information with measures appropriate to how sensitive it is, including:

• Encrypted connections. The website and Tracker are served only over HTTPS.
• Passkeys first. Sign-in uses passkeys, with one-time email codes as backup; code requests and attempts are rate-limited.
• Your data is yours alone. Every Tracker record belongs to one account, and every request is limited to the signed-in user's own records. Database access rules add a second layer of protection.
• Private file storage. Photos and videos are stored in a private bucket and shown through signed links that expire within an hour.
• Encrypted storage. Tracker's database and stored files are encrypted at rest by our database provider.
• Encrypted WHOOP keys. WHOOP access tokens are also encrypted with AES-256-GCM before they are stored.
• Careful logging. Production logs leave out personal details and secrets.

No system is perfectly secure. If a security breach affects your personal information, we will notify you and any authorities as the law requires.

Children

Tracker is only for people 18 and over. The website is not directed to children under 13. We do not knowingly collect personal information from anyone under 18 in Tracker or from children under 13 on the website. If we learn that we have, we will delete it. If you believe a child has given us information, please email privacy@slightlydarker.com.

State-specific information

California

In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described above:

• Identifiers: name (in contact messages and WHOOP profile), email address, account ID, IP address.
• Personal information described in California's customer records law: name, email address.
• Internet or other electronic network activity: website request logs, Tracker service logs, search queries in Tracker.
• Geolocation data: precise location from OwnTracks and from your device, places and stops.
• Sensory data: photos and videos you upload.
• Sensitive personal information: precise geolocation, health-related information, and account log-in credentials.
• Inferences: none. We do not create profiles about you.

Sources: you; your devices (browser and the OwnTracks app); WHOOP, if you connect it; and our service providers (Google and Open-Meteo, for lookups you request).

Disclosures: we disclose each category to the service providers listed above for the business purposes described in this policy. We have not sold or shared (for cross-context behavioral advertising) any personal information, including that of anyone under 16.

California residents can use the rights described in Your rights and choices. We extend these rights to all our users, whether or not the California Consumer Privacy Act applies to us.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing.

Washington, Nevada and Connecticut

See our Consumer Health Data Notice.

New York and other states

We apply the safeguards and breach-notification practices required by New York law to all users. Residents of other states with consumer privacy laws can use the rights in Your rights and choices.

Outside the United States

The Services are intended for people in the United States, and your information is processed in the United States.

Changes to this policy

We will update this policy when our practices change. The "Last updated" date at the top shows when it last changed. For material changes, we will email Tracker users at least 14 days before the change takes effect. We will not use health data for a new purpose without first asking for your consent.

Contact

Slightly Darker Entertainment, LLC, Los Angeles, California.

• Privacy requests and questions: privacy@slightlydarker.com
• Anything else: hello@slightlydarker.com