TrackStack Privacy Policy
Effective date: 2026-11-10
This privacy policy explains how the TrackStack app for mobile devices and the web, together with its related backend services (collectively, the "App"), handles your information. The App is operated by Rajath Shanbhag (the "Service Provider", "we", "us").
If you have questions, contact us at info@support.trackstacklab.com.
Summary
- TrackStack helps you tailor your resume and cover letter to a job description, using only facts from your own profile, and track your job applications.
- We collect what you give us (your account email, resumes, profile, job descriptions, applications and notes) plus limited technical data needed to run and debug the App.
- With your permission, which the App asks for before the first AI action, your resume or profile content and the job description are sent to the AI provider whose API key you added (Anthropic, OpenAI, Google or xAI).
- Crash reporting is off unless you turn it on.
- We do not sell your personal information, show ads or track you across other companies' apps or websites.
- You can delete your account and all of its data from inside the App at any time (Settings → Delete account).
1. Information we collect
Information you provide
| Category | What it includes | Why we need it |
|---|---|---|
| Account information | Email address; a password, which we store only as a one-way hash; or, if you sign in with Apple or Google, the account identifier and email address that provider shares with us | To create your account, sign you in, verify your email and let you reset your password |
| Resumes | Resume files you upload, including the file name, type and size | To build your structured profile |
| Profile | The structured profile built from your resume and any edits you make: work history, education, skills, projects and similar career details | To generate tailored resumes and cover letters grounded in your own facts |
| Job descriptions | Job postings you paste or share into the App, including the job title and company | To tailor your documents and track the application |
| Applications and notes | Generated resumes, cover letters, gap reports, application status and notes you write | To show your application history and results |
| AI provider API keys | API keys you add for Anthropic, OpenAI, Google or xAI |
To make AI requests on your behalf. Keys are encrypted at rest (AES-256-GCM), and
only a masked form (e.g. sk-…4f2) is ever shown back to you or recorded
in logs.
|
Resume and profile content can include personal details you choose to put in them, such as your name, phone number, location or links. Please include only what you are comfortable having processed as described here.
Information collected automatically
- Diagnostic data (only if you opt in): crash reports and performance traces, including device model, operating system version, app version and the screen or step where an error happened. The App asks once whether to share crash reports, and nothing is sent unless you say yes. You can change this at any time in Settings → Share crash reports. Before it is sent, this data is filtered to remove API keys, resume and profile content, job descriptions and authentication tokens.
- Technical and log data: IP address, request timestamps and request metadata, recorded by our hosting providers when the App talks to our servers. We use it for security, abuse prevention and troubleshooting.
- Session data: a session token stored securely on your device to keep you signed in.
We do not collect your precise location, contacts, photos, browsing history or advertising identifiers. The App does not use third-party advertising or cross-app tracking.
Information stored on your device
The App keeps a local copy of your applications list on your device so it works offline. This copy is cleared when you sign out or delete your account.
2. How we use your information
We use your information to:
- provide the App's features: building your profile, tailoring resumes and cover letters, exporting PDFs and tracking applications;
- create and secure your account, verify your email and process password resets;
- send service emails, such as email verification, password reset and account-deletion notices. We do not send marketing emails;
- diagnose crashes, fix bugs and keep the App reliable and secure;
- comply with legal obligations and enforce our terms.
We do not use your resume, profile or job descriptions to train AI models, and we do not sell your personal information.
3. Artificial intelligence features
TrackStack uses large language models to read your resume into a structured profile, analyze job descriptions, and generate tailored resumes, cover letters and gap reports. Generated content may only reorder and re-emphasize facts already in your profile. The AI never edits your profile; only you can do that.
What is sent, and to whom: when you start an AI action, the relevant content (your resume or profile facts, and the job description) is sent to the AI provider whose API key you added and selected:
- Anthropic (Claude): https://www.anthropic.com/legal/privacy
- OpenAI: https://openai.com/policies/privacy-policy
- Google (Gemini): https://policies.google.com/privacy
- xAI (Grok): https://x.ai/legal/privacy-policy
Because these requests use your own API key, the provider processes the content under your agreement with that provider, including its data retention and model-training terms. Please review those terms.
Your permission: before anything is sent to an AI provider, the App explains what will be sent and to whom, and asks for your permission. Nothing is sent unless you allow it, and only after you have added a key for that provider and started an action that needs it. We record when you gave permission. You can withdraw it at any time in Settings → Share data with AI provider. Withdrawing stops any AI work still in progress, and AI features stay unavailable until you allow sharing again.
4. How we share information
We share personal information only with the following service providers, who process it on our behalf to run the App, and with the AI provider you choose as described in Section 3:
| Service provider | Purpose | Data involved |
|---|---|---|
| Expo (EAS Hosting) | Hosts the App's backend | All data the App sends to our servers, while it is being processed |
| Neon | Database hosting | Account, profile, job, application and encrypted key data |
| Cloud object storage (S3-compatible) | Stores uploaded resume files | Resume files |
| Resend | Sends service emails | Your email address and the email content |
| Sentry | Crash and performance monitoring, only if you opt in | Filtered diagnostic data (see Section 1) |
| Apple / Google | Sign in with Apple / Google, if you use them | Sign-in tokens and account identifiers |
We may also disclose information:
- if the law requires it, for example to comply with a subpoena or similar legal process;
- when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud or respond to a lawful government request;
- to a successor entity in a merger, acquisition or sale of assets, subject to this policy.
5. Data retention and deletion
- While your account is active, we keep your account, resumes, profile, jobs, applications and notes so the App can work. Uploaded resumes and generated applications are kept as a version history and are not overwritten.
- When you delete your account (Settings → Delete account), access is blocked immediately and you are signed out on all devices. If you signed in with Apple, your Apple sign-in authorization is also revoked. After a 24-hour hold, your account and all associated data, including resume files, are permanently deleted. Residual copies in encrypted database backups expire on the backup schedule, within 30 days.
- Diagnostic data, if you opted in, is kept by Sentry for up to 90 days.
- Server logs are kept by our hosting providers for a limited period for security and troubleshooting.
- Email links: email verification and password-reset links expire automatically.
If you cannot access the App, you can also request deletion by emailing info@support.trackstacklab.com from your account's email address.
6. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct inaccurate data (you can edit your profile directly in the App);
- delete your data (see Section 5);
- object to or restrict certain processing;
- withdraw consent at any time, without affecting processing that took place before you withdrew it;
- lodge a complaint with your local data protection authority.
You can stop the App from sending content to an AI provider at any time by turning off Settings → Share data with AI provider, or by removing that provider's key in Settings → API keys. To exercise any other right, email info@support.trackstacklab.com. We will respond within the time required by applicable law.
Legal bases (EEA / UK users)
We process your data to perform our contract with you (providing the App). We rely on your consent to send your content to AI providers and to collect crash reports. We rely on our legitimate interests to keep server logs for security, and on legal obligations where they apply.
California residents (CCPA/CPRA)
In the past 12 months we have collected the categories of personal information described in Section 1: identifiers (email address, account ID, IP address), professional or employment-related information (resume and profile content), and internet or electronic activity information (diagnostic data, if you opt in). We collect them for the purposes in Section 2 and disclose them only to the service providers in Section 4. We do not sell or "share" personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you. You have the right to know, delete and correct your personal information, and the right not to be discriminated against for exercising these rights. Contact info@support.trackstacklab.com to make a request.
7. International data transfers
We and our service providers may process your data in countries other than the one you live in, including the United States. Where the law requires it, for example for transfers from the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.
8. Security
We protect your information with technical and organizational measures. These include encryption in transit (HTTPS), AES-256-GCM encryption of your AI provider keys at rest, one-way hashing of passwords, per-account isolation of all data, and filtering of diagnostic data before it leaves the App. No system is completely secure. If a data breach affects your personal data, we will notify you and the relevant authorities as required by applicable law.
9. Children
The App is not intended for anyone under 16, or a higher minimum age where local law requires it. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact info@support.trackstacklab.com and we will delete it.
10. Changes to this policy
We may update this policy from time to time. When we do, we will post the new version at this address with a new effective date. If the changes are material, we will also notify you in the App or by email. Where the law requires it, we will ask for your consent before a material change takes effect. Previous versions are available on request.
11. Contact us
If you have questions about this policy or your data, email info@support.trackstacklab.com.