Last updated: 09/30/2026
To do its job, Trackr stores the following:
| Data | Why |
|---|---|
| Discord account info (username, ID, avatar) | Signing you in, since Trackr uses "Log in with Discord" |
| The email address(es) of inboxes you connect | Knowing which mailbox to check |
| Your email app password, or the sign-in token from "Sign in with Google" / "Sign in with Microsoft", encrypted at rest | Logging into that inbox over IMAP on your behalf. We never ask for or store your real account password — only a provider-issued app-specific password or sign-in token, which you can revoke at any time from your email provider (for Google: myaccount.google.com/permissions). |
| Order details (order numbers, totals, item names, quantities, statuses, tracking numbers, ship-to name/address) | Building your dashboard and success card |
| A cached copy of the retailer emails Trackr recognizes as orders (compressed, not your whole inbox — only messages matching known retailer senders) | So Trackr can re-process orders when we improve its parsing, without re-downloading your inbox |
| Item photos pulled from those same retailer emails | Showing a picture next to each item |
| A Discord webhook URL, if you set one up | Sending you order notifications, if you turn that on |
| An OpenAI API key, encrypted at rest, if you provide one | Powering an optional feature you've opted into |
| Inventory, sales, raffle entries and settings you add (sold prices, fees, misc. items, manual shipment statuses) | The Inventory, Raffles and Shipments tabs and your profit numbers |
| Basic usage/activity logs (sync times, counts, errors, when you last used the site) | Troubleshooting, showing you sync history, and site-wide counts for the people who run Trackr |
Google user data. If you connect Gmail with "Sign in with Google", Trackr uses that access only to read the retailer order emails described above, to show them to you in Trackr. Trackr's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Gmail data for advertising, don't sell it, don't use it to train AI models, and no person reads it except when you ask us to troubleshoot your account. Removing the inbox from Trackr also revokes Trackr's access on Google's side.
We keep your data for as long as your account exists, with these limits:
You can delete everything Trackr has on you at any time from Settings → Delete my account and data. That removes your connected inboxes, saved passwords, cached emails, orders, inventory and sales right away. Copies inside the daily backups are gone within 7 days, as older backups are replaced. This can't be undone. If you want your data first, export it as CSV from the Orders and Inventory tabs.
The people who run Trackr can see site-wide totals (number of accounts, inboxes and syncs), and for troubleshooting, your Discord username with a shortened inbox address and its last error. They don't browse your orders, and a site-wide backup can only be downloaded by an administrator.
To limit abuse of free sign-ups, your IP address is used briefly, in memory only, to count new accounts from the same network. It isn't stored.
Email app passwords and any API keys you provide are encrypted at rest. No method of storage or transmission is 100% secure, and we can't guarantee absolute security, but we don't store plaintext credentials.
Trackr isn't directed at children, and we don't knowingly collect data from anyone under 13 (or the relevant minimum age in your country).
We may update this policy as Trackr changes. Material changes will be reflected here with an updated date.
Questions about your data or this policy? Reach us on Discord through our ticket system, and staff will be with you shortly.