Data & security
Privacy and security
Elmtrackr is built to keep your work data on your device and under your control. Your shifts live in an encrypted local database, an app lock can guard access, and anything that leaves the device does so only when you choose to sign in and sync. This page explains how that works in plain terms.
Last reviewed: 2026-07-16
Your device is the source of truth
Elmtrackr stores your shifts, rules and receipts in a local database on the device — built on Room, Android's on-device database layer. The app is designed to run fully from that local store, so it keeps working with no account and no connection.
How your data flows
At a glance — where your data lives and the only times it leaves the device:
The local database is encrypted
That local database is encrypted using SQLCipher, with a passphrase generated and kept on the device. If an older, unencrypted database exists from a previous version, it is migrated into the encrypted one. The intent is that the raw data on disk is not readable as plain text.
Locking the app
You can lock Elmtrackr behind your biometrics or your device credential (PIN, pattern or password). When the lock is on, it also guards remote clock actions — so a punch triggered from a widget, the notification or the watch is held until you unlock, keeping your record private on a shared or lost device.
Optional account and cloud sync
An account is entirely optional. If you want your data on more than one device, you can sign in with an email address and password, and Elmtrackr syncs through Supabase when sync has been configured and you are connected. There is no Google or social sign-in and no anonymous account — and if you never sign in, nothing syncs and everything stays local.
What stays on the device, and what can leave
Without an account, your shifts and receipt images stay on the device. Data leaves the device only for specific reasons: cloud sync of your records when signed in, receipt upload and retrieval as part of that sync, signing in to your account, and — if enabled — crash diagnostics. Everyday tracking and on-device receipt reading do not require the network.
Crash diagnostics you can turn off
Optional crash reporting can help fix problems. It is doubly gated: it only runs if a reporting key is built into the app and you have consented, and it is configured not to send personally identifying information by default. You can turn it off under Settings → Help & About → Share crash reports.
Deleting your data
You can delete your account and its data from within the app. Uninstalling the app removes it and the data held on that device. If you have used cloud sync, in-app account deletion is how you remove the account's synced data.
To delete your account and data, follow the steps on the account-deletion page.
Limitations
A few honest boundaries:
- Cloud sync and account features depend on signing in and having a connection; they are off until you opt in.
- Crash diagnostics only run when a reporting key is present and you have consented, and can be switched off.
- This page explains the app's behaviour and is separate from the legal privacy policy, which governs the formal terms.
- Security features reduce risk but no software can promise absolute security.
Frequently asked questions
Is my shift data encrypted on the device?
Yes. The local database is encrypted with SQLCipher, using a passphrase kept on the device.
Do I need an account to use Elmtrackr?
No. The app runs fully on the device without an account. Signing in with email and password is optional and only needed for cloud sync across devices.
Can I lock the app?
Yes. You can require biometrics or your device credential to open it, which also guards clock actions from the widget, notification and watch.
What happens if I delete my account or uninstall?
Deleting your account from within the app removes the account's data, including synced data. Uninstalling removes the app and the data stored on that device.
Can I stop crash reports being sent?
Yes. Crash reporting is optional and off unless enabled; you can turn it off under Settings → Help & About → Share crash reports.
Your data, on your terms
Track offline by default, and turn on an account only if you want to sync.