Skip to content
TrackAlive

Privacy Policy

Last updated: 6 September 2026

1. Who we are

TrackAlive is operated by Aurevia Systems Pty Ltd, a company based in Melbourne, Australia. For any privacy question, email hargravelabs@gmail.com.

This policy is written to meet the Australian Privacy Act 1988 (Cth), the EU General Data Protection Regulation (GDPR), the UK GDPR and the California Consumer Privacy Act (CCPA). For GDPR and UK GDPR purposes, TrackAlive acts as a processor for the merchant (the controller) in respect of daily order counts, checkout tokens and GA4 purchase counts, and as a controller for the merchant’s own account data, such as a contact email address and an optional Slack webhook URL. TrackAlive does not sell personal information, as that term is defined under the CCPA.

2. What TrackAlive does

TrackAlive is a Shopify app. Each day it compares three numbers for a merchant’s store: the number of Shopify orders, the number of checkout-completed events recorded by TrackAlive’s own web pixel, and the number of purchase events recorded in the merchant’s own Google Analytics 4 (GA4) property. When those numbers split apart in a way that suggests conversion tracking has broken, TrackAlive alerts the merchant by email or Slack so they can fix it quickly instead of losing weeks of ad data.

3. Data we collect from the merchant

When a merchant installs TrackAlive, we collect and store:

4. Data we collect from the storefront

TrackAlive’s web pixel records a checkout token and a timestamp when a checkout completes and the buyer has granted analytics consent. We do not collect or store names, email addresses, postal addresses, phone numbers, line items, or order amounts from the storefront. The checkout token is a pseudonymous checkout identifier. Although we do not link it to customer contact details, it may be linkable to a transaction and should not be treated as anonymous data.

4a. The free public check and launch list

When someone runs the free check at trackalive.snagtrace.com/check we fetch that store’s public homepage once and keep the store’s domain name, scan time, Shopify-detection result and number of tags found, for 90 days, to measure use of the check. We do not keep the page. If someone leaves an email address to be told when TrackAlive is available on the App Store, we keep that address for that one message and delete it on request to the address in section 1.

5. Google user data

TrackAlive requests read-only access to Google Analytics 4 (the analytics.readonly scope) which permits access to Analytics properties available to the connected Google account. We list accessible property names and IDs so the merchant can select one, then read daily aggregate web-purchase counts and the reporting timezone for that selected property. We store those counts to compare them with Shopify web orders and TrackAlive checkout events. Google refresh tokens are encrypted at rest. Alert messages include these aggregate counts and are delivered through Resend to the configured email address and, when enabled, through Slack to the configured channel. Railway hosts the application and database. We use these providers only to operate the monitoring and notification features described here. We do not sell Google data or use it for advertising. Human access is limited to the circumstances permitted by Google’s Limited Use requirements, such as the merchant’s affirmative consent, security investigations or legal obligations.

TrackAlive’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Retention

7. Processors

We share data with the following processors, only as needed to run TrackAlive:

8. Merchant rights

A merchant can ask us to access, export or delete their account data at any time by emailing hargravelabs@gmail.com. A merchant can disconnect Google Analytics inside the TrackAlive app at any time, and can revoke TrackAlive’s access to their Google account directly at myaccount.google.com/permissions.

We handle merchant account data in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. If a merchant is unsatisfied with how we have handled a privacy request, they may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Customer rights

We do not store customer names, emails, addresses, order contents or a mapping from customer IDs to checkout tokens. We do store the pseudonymous checkout identifiers described above. We authenticate and acknowledge Shopify’s customers/data_request and customers/redact webhooks. If a merchant needs help identifying data related to a request, contact the address in section 1. Tokens are automatically removed under our retention schedule, and shop-wide deletion removes all related tokens.

10. Security

All data in transit is encrypted with TLS. Google refresh tokens are encrypted at rest with AES-256-GCM. Access to production systems is limited to what each service needs to run, on a least-privilege basis.

11. Changes and contact

We may update this policy from time to time. Material changes will be reflected in the “Last updated” date above. Questions about this policy can be sent to hargravelabs@gmail.com.