Privacy Policy

Tracker is a personal task manager built and run by Amit Sourav for his own use. It reads his email and messages so that tasks other people give him are collected automatically instead of being remembered by hand.

This policy describes exactly what the application does with data, including data obtained through Google APIs.

Who this applies to

Tracker is a single-user application. Each person who signs in has their own isolated account and can only ever see their own data. There is no shared or public area, no advertising, and no analytics tracking of any kind.

What data is accessed

• Google account email address — to identify which mailbox is connected.
• Gmail messages (read-only) — subject, sender, recipient, date and body text of messages in the inbox and in Sent mail, so that requests made of the user and commitments made by the user can be identified.
• Google Calendar — access is requested for planned scheduling features. Calendar data is not currently read, written or stored.
• WhatsApp messages — only from group chats the user has explicitly enabled, via a bot the user operates themselves. All other chats are never read.
• Tasks, projects, people and notes that the user creates in the application.

How that data is used

Message text is used for one purpose: to identify action items. Messages are first filtered locally — newsletters, promotional mail, automated notifications and messages from senders the user has chosen to ignore are discarded without being read further.

Remaining messages are sent to a large language model through OpenRouter, using the user's own API key, which returns any tasks it finds. Those tasks appear in a review inbox and are added to the task list only when the user accepts them.

Before any text is sent to a model, one-time passwords, verification codes, long digit sequences such as account and card numbers, and bank IFSC codes are replaced with placeholders.

Google user data is never used to train, retrain or improve any machine learning or artificial intelligence model, and is never used for advertising.

Where data is stored

• All data is stored in the user's own Supabase (PostgreSQL) database, protected by row-level security so that a signed-in user can only read their own rows.
• Message bodies are retained for 30 days and then automatically deleted by a scheduled job. Subjects, senders and the resulting tasks are kept until the user deletes them.
• Google refresh tokens and API keys are stored in that same database and are readable only by the account that owns them.
• The application is hosted on Vercel; the database is hosted by Supabase.

Who data is shared with

Tracker does not sell data, does not share it with advertisers, and does not transfer it to anyone for any purpose unrelated to the features described here. Data is processed only by the infrastructure the application runs on:

• Supabase — database and authentication.
• Vercel — application hosting.
• OpenRouter and the model provider selected by the user — receives the redacted text of messages that pass filtering, in order to extract tasks.
• Google — as the source of the mail being read.

Tracker's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Withdrawing access

Google access can be revoked at any time, either by clicking Disconnect in the application's Settings, or from your Google account permissions page. Once revoked, the application can no longer read mail. Stored data can be exported or deleted from Settings at any time.

Security

Access requires a signed-in session. All traffic is served over HTTPS. Database access is restricted per user by row-level security policies. No third party is given access to the database.

Children

Tracker is not intended for use by anyone under 16.

Changes

If this policy changes, the date at the top of this page will be updated.

Contact

Questions about this policy can be sent to amitsourav0407@gmail.com.