← Back to Trackd

Privacy Policy

Last updated: September 12, 2026

1. What data Trackd accesses

Trackd requests read-only access to your Gmail account via Google's OAuth 2.0 API. Specifically, we request the https://www.googleapis.com/auth/gmail.readonly scope. This allows Trackd to:

• Read email metadata (sender, subject line, date) for billing-related messages
• Read email content for messages that appear to be receipts, invoices, renewal notices, free trial confirmations, or subscription-related communications

Trackd does not request or have the ability to:

• Send, delete, or modify any email
• Access your contacts, calendar, or Google Drive
• Read personal or non-billing emails (we filter for billing-related patterns only)
• Access your bank accounts, payment credentials, or financial accounts

2. How your data is processed

All email analysis and subscription detection runs entirely in your browser using client-side JavaScript. Here's the data flow:

1. Trackd fetches a list of recent billing-related emails from Gmail using the read-only API
2. The extension analyzes sender names, subject lines, and email patterns locally in your browser to detect known subscription merchants
3. Detected subscriptions are stored using chrome.storage.local. This is browser-local storage that stays on your device
4. Your email content is never transmitted to any external server, including ours

3. Where your data lives

Subscription data (service names, prices, renewal dates) is stored locally in your browser's chrome.storage.local. This storage is scoped to the Trackd extension and does not sync to any cloud service unless you explicitly enable optional cloud sync in the future.

Trackd does not currently operate any cloud servers or databases that store user data. There is no backend API, no user account system, and no persistent connection to any server beyond the initial Gmail API call.

4. How we protect your data

Trackd applies the following data protection mechanisms for the sensitive data it is granted access to:

• Least privilege by design: Trackd requests a single, read-only scope (https://www.googleapis.com/auth/gmail.readonly) and no other permission. It cannot send, delete, or modify email, and it never requests access to contacts, calendar, or financial accounts.
• On-device processing: Email analysis, merchant detection, and subscription classification run entirely in your browser using client-side JavaScript. No message content is transmitted to or stored on any external server.
• Local-only storage: Detected subscription data is stored in chrome.storage.local, which is scoped to the Trackd extension and stays on your device. It is deleted when you uninstall the extension or clear its data.
• Encryption in transit: Communication with Google's Gmail API and with Gumroad (for license verification) is protected by HTTPS/TLS. No plaintext data is transmitted.
• No backend, no account, no cloud database: Trackd operates no server-side storage of user data. There is no user account system, so there are no credentials or server-side profiles to protect.
• Revocable, transparent access: You can revoke Trackd's Gmail access at any time from myaccount.google.com/permissions, and you control what Trackd can see.
• Access controls and retention limits: Trackd limits each scan to a bounded number of messages you configure, and it analyzes only messages it identifies as billing-related. It does not persist or access messages beyond what is needed for a scan.

5. What we collect (analytics)

We use a self-hosted Umami analytics instance (umami.andreakis.org) to collect anonymous usage statistics about the landing page. Umami collects:

• Page views and referrer URLs
• Browser type and device category
• Country-level location (approximate, IP-based)

Umami does not use cookies and does not collect personally identifiable information.

The Chrome extension also sends anonymized usage events (for example, that a scan ran or that a subscription was confirmed) to the same self-hosted Umami instance. These events contain only usage statistics (such as the event type and a randomly generated session identifier) and never include email content, message metadata, subscription data, or any personally identifiable information. No email content or subscription data is ever transmitted to analytics.

When you enter your email on the landing page to join the Trackd testing group, it is used solely to add you as a test user and to send you install instructions and confirmation that you have been added. Your email will not be sold, shared, or used for any purpose other than Trackd testing-group communications and occasional product updates (with an unsubscribe option).

6. Data retention and deletion

• Local data: All locally stored subscription data is deleted when you uninstall the Trackd extension from Chrome. You can also clear extension data from Chrome's extension settings at any time.
• Testing-group email: Your email address is retained so we can add you as a test user and contact you about the testing group. You can request deletion at any time by emailing trackd@deanware.com, and you can unsubscribe from testing-group messages at any time.
• Gmail access: You can revoke Trackd's Gmail access at any time from myaccount.google.com/permissions.

7. Third-party services

Trackd uses the following third-party services:

• Google Gmail API: To read billing-related emails with your explicit consent. Subject to Google's Privacy Policy.
• Netlify: Landing page hosting and form processing for the testing-group signup form. Subject to Netlify's Privacy Policy.
• Umami: Self-hosted, privacy-friendly analytics. No user data is shared with third parties.

8. Chrome Web Store compliance

Trackd complies with Google's Chrome Web Store Program Policies, including the User Data Privacy requirements. Specifically:

• We only request the minimum permissions needed for the extension to function
• All data handling is described accurately in this privacy policy
• We do not sell or transfer user data to third parties
• We do not use user data for purposes beyond the core functionality
• Users can revoke access and delete data as described above

9. Changes to this policy

If this policy changes materially, we will update the "Last updated" date at the top and notify users at the contact address provided. We will never reduce your privacy rights without explicit consent.

10. Contact

Questions about this policy? Reach out:

Email: trackd@deanware.com

---

← Back to Trackd