Trakker ("Trakker," "we," "us," or "our") is operated by Heimer. This Privacy Policy explains what information we collect when you use Trakker, including our website and web app, the Trakker Chrome extension, and the Trakker iOS app (together, the "Service"), how we use it, and the choices you have.

1. Information We Collect

Account information. When you sign up, we collect your name and email address, either directly or through a third-party sign-in provider (such as Google, Microsoft, GitHub, or Sign in with Apple in the iOS app), via our authentication provider Clerk. If you sign in with a provider, we receive your name, email address, and profile photo as that provider makes them available.

Profile and education information. During onboarding or in account settings, we collect information you provide to personalize job matching and notifications: your preferred name, school, major, education status, expected graduation year, whether you are a PhD candidate, target companies and role preferences, desired level (intern or new grad), location preference, phone number, and links to profiles you choose to share (for example GitHub, LinkedIn, or a personal website).

Resume content. Any resume content you create, paste, or import into Trakker, including work history, education, skills, and bullet-point descriptions, is stored so the editor can display it and let you edit it. Some features send resume text to an AI provider; Section 2 lists exactly which ones and what each sends.

Application tracking data. The company names, job titles, locations, links, statuses, and dates you add to your applications trakker, whether directly, by importing a spreadsheet, or by logging an application you sent with the Chrome extension or the iOS app.

Autofill profile. If you use the Chrome extension or the iOS app to fill job applications, you can keep an autofill profile on the Autofill page: your name, email address, phone number and links; your residential address and, if you add one, a separate mailing address; your education and work history; your skills; and your answers to common application questions, such as whether you are authorized to work in a country, whether you will need visa sponsorship, your notice period, and how you heard about a job. It can also hold voluntary self-identification answers (such as gender, race or ethnicity, veteran status, and disability status), but only if you choose to enter them. Self-identification answers are used to fill a form only while the setting that allows it is on, and that setting is off unless you turn it on.

Saved answers. Answers you save to a job application's own questions, stored with the question's wording, so that the same answer can be filled the next time a form asks that question. You can edit or delete them on the Answer bank page.

The Chrome extension. The extension connects to your account with a pairing token created on the Autofill page. We store only a one-way hash (SHA-256) of each token, never the token itself, and you can disconnect a browser there at any time. The extension keeps a copy of your autofill profile, saved answers, and chosen resume in your browser's extension storage so it can fill forms, and it erases that copy when the browser is disconnected. On a page where you use it, the extension reads the application form: its field labels, questions, headings, and the options it offers. When you log an application, it sends us the company, job title, location, and link. To attach your resume, it sends the resume to our servers to be rendered as a PDF; the PDF is created for that request and not kept.

The iOS app. The iOS app uses the same account and the same data as the website. If you allow notifications, we store your device's push notification token, with the app's version and build type, so we can send you alerts through Apple's push service, and a record of which alerts we delivered to you and when you opened them. You can also save jobs to a list in the app. The app includes an in-app browser for opening job applications, which fills forms the same way the Chrome extension does; websites you visit in it may store their own cookies on your device, which you can clear for a site from the browser's menu. When you use "Share to Trakker" from another app, the link you share is sent to us and added to your apply queue. The app keeps its connection to your account in your device's Keychain.

Apply queue. When you add a job to your apply queue, we read the posting's application questions from the employer's public job listing and draft answers ahead of time from your profile and resume (see Section 2), so they are ready when you open the application. Questions we do not answer for you are shown to you to answer yourself, and those answers are saved to your answer bank. The application is filled and sent from your own browser or device, by you.

Job search preferences. Companies you follow or favorite, job boards you save or share, and your notification preferences (instant alerts or a daily digest, by email or push notification).

Email activity. Our emails include a small image and links that pass through our servers, so we can tell when an email is opened and which links in it are clicked. We use this to measure whether alerts are useful and to ask whether you applied to a job you clicked through to.

Usage and log data. Standard technical information such as IP address, browser type, device information, and pages visited, collected automatically for security and to understand how the Service is used. The website uses Vercel Web Analytics for aggregate page-view statistics, which does not use cookies.

Payment information. If you subscribe to a paid plan, payment is processed by Stripe. We do not receive or store your full card number; Stripe handles that directly, and we only receive confirmation of payment and subscription status.

2. AI Features

Some features send information to an AI model provider to produce a result, and only when you use that feature. Each request carries what that feature needs and nothing else. Today the features and their providers are:

• Resume import (a .docx or .pdf file), served by Google (Gemini): the full extracted text of the resume, including any contact details written on it, so it can be restructured into an editable Trakker document.
• Spreadsheet import of applications, served by Google (Gemini): a small structural sample of the file (a representative set of rows, not your whole file), to identify what each column holds and to map unrecognized status labels to Trakker's categories. That mapping is then applied in code to the rest of your rows, which are not sent, and you review the result before anything is saved.
• Bullet rewriting and resume tailoring (in the resume editor, from a job posting on the board, or with "Tailor for this job" in the Chrome extension), served by Anthropic (Claude): the bullets being rewritten, the role or section heading each one belongs to, any instructions you type, and, when tailoring for a job, the text of that job posting.
• Written answers to application questions (in the Chrome extension, and when you draft an answer with Trakker in the iOS app), served by Anthropic (Claude): so that the answer is written from your own experience, the request includes your name, email address, LinkedIn and website links, city, state and country, work history, education (including GPA if you entered one), skills, your answers about how you heard about the job, your notice period and start date, up to about 6,000 characters of your resume, and the application's questions and job details. We do not store these answers unless you save one to your answer bank.
• Apply queue drafts, served by Google (Gemini): the same information as written answers, for each posting you queue.
• The extension's form assistant, served by Anthropic (Claude): the page's web address, the form's visible labels, questions, headings and options, and which kinds of facts your profile holds, without their values. For a few facts about the application itself (how you heard about the job, when you can start, and whether you have applied before), it receives your stored answer so it can choose the matching option on the form. If you type an instruction for it, it receives that instruction. It never receives what has been typed into the page's fields.

Your self-identification answers, and your answers about work authorization, visa sponsorship, and citizenship, are never sent to an AI provider. Depending on our configuration, the same features can instead be served by OpenAI, Moonshot AI (Kimi), xAI, or DeepSeek. For each AI request we record which feature and model were used and how many tokens it took, in order to meter usage; those records do not contain what was sent.

3. Cookies and Local Storage

We use a small number of functional cookies and browser storage mechanisms, not third-party advertising or cross-site tracking cookies. These include: a session cookie from Clerk that keeps you signed in; a short-lived cookie that remembers you've completed onboarding so we don't need to re-check on every page; and browser local storage / IndexedDB that saves your theme preference, sidebar layout, which Trakker extension is installed in your browser, and a local draft of your resume on your own device (so edits load quickly and survive a refresh before they're synced to your account). The Chrome extension and the iOS app store what is described in Section 1 on your own device. We do not use these technologies for cross-context behavioral advertising.

4. How We Use Your Information

• To provide and operate the Service (displaying your resume, matching and sending job alerts, tracking your applications, filling job applications when you ask, and processing the AI requests described in Section 2).
• To send you transactional and notification emails (job alerts, digest emails, account-related messages), sent via Amazon Simple Email Service (SES), and, if you turn them on in the iOS app, push notifications, sent via Apple Push Notification service.
• To process payments and manage your subscription, via Stripe.
• To improve the Service and diagnose problems.
• To communicate with you about your account or changes to our terms or policies.

5. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only with the following service providers, each acting under their own privacy and security obligations:

• Clerk: authentication and account management, including sign-in with Google, Microsoft, GitHub, or Apple.
• AI model providers: Anthropic and Google, and, depending on our configuration, OpenAI, Moonshot AI, xAI, or DeepSeek, only for the features and the information described in Section 2.
• Amazon Web Services (AWS): hosting, database storage, and email delivery (SES).
• Vercel: hosting of the website and web app, and aggregate page-view analytics.
• Cloudflare: network and security services between your device and our servers.
• Apple: delivery of push notifications to the iOS app (Apple Push Notification service), and sign-in if you use Sign in with Apple.
• Stripe: payment processing for paid subscriptions.
• Slack: internal operational alerts to our team, which may include an internal account identifier but not your name or email address.

Employers. When you fill or send a job application with the Chrome extension or the iOS app, the information in that application goes to the employer and its application system, and is handled under their privacy policies.

Clubs and cohorts. If you choose to join a club on Trakker, the counts derived from your application tracking are included in that club's totals, and the other members of that club can see those totals. They see aggregates only: how many applications the club's members sent, how far those progressed, and which employers its members applied to. They do not see your name, your email address, your resumes, the individual companies or roles you applied to, or any figure that identifies you. Totals are withheld entirely until a club has at least five members, and a per-employer figure is withheld until at least five members have applied to that employer. Joining is always your choice, never automatic, and you can leave a club at any time; from that moment your data is no longer counted in it.

We may also disclose information if required by law, or to protect the rights, property, or safety of Trakker, our users, or others.

6. Data Retention and Deletion

We retain your account, resume, application-tracking data, autofill profile, and saved answers for as long as your account is active, or until you delete them. Some records are kept for less time:

• An apply queue item keeps its drafted answers until you send that application, remove it, or it expires 30 days after you queued it; the drafts are erased at that point.
• The record of alerts delivered to the iOS app, and when you opened them, is deleted after 30 days.
• A device's push notification token is deleted when you sign out of the iOS app on that device, and is no longer used once Apple reports that the device does not accept notifications.
• A disconnected browser's pairing token stops working immediately.

Deleting your account. You can delete your account in the iOS app (Profile, then Delete account), or by contacting us at the address below. Deleting an account cancels any active subscription, deletes your sign-in account at Clerk, and deletes the information associated with your account from our database, including your profile and preferences, resumes, applications and trakkers, autofill profile, saved answers, apply queue, pairing tokens, device tokens, saved jobs, alert history, email activity records, AI usage records, feedback, and club memberships. A few things are kept: a community event you submitted to the public events board stays on it, no longer linked to you; a record that the account was deleted is kept for seven days so that a sign-in session that was still open cannot recreate it; records of our staff accessing account data are kept for security auditing; and Stripe keeps its own payment records, as may we where the law requires it (for example, for tax or accounting purposes).

7. Your Choices and Rights

You can edit or delete your resume content, application-tracking data, autofill profile, and saved answers at any time within the Service, turn off the use of your self-identification answers on the Autofill page, and disconnect a browser from your account there. You can change your notification preferences (instant alerts, digest frequency, email or push, or opt out entirely) in account settings or in the iOS app, or use the one-click unsubscribe link in any notification email. You can delete your account as described in Section 6. Depending on your location, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA), other U.S. state privacy laws, or the EU/UK General Data Protection Regulation (GDPR), including the right to access, correct, or delete your personal information, and the right to opt out of the sale or sharing of personal information, which, as noted above, we do not do. Because we do not sell or share personal information for targeted advertising, a Global Privacy Control or similar opt-out signal has no additional data use to turn off, but we will still honor it as a valid opt-out preference where required by law. Contact us to exercise any of these rights.

8. Children's Privacy

Trakker is intended for users who are at least 16 years old. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

9. International Users

Trakker is operated from the United States, and the information we collect is processed and stored on servers located in the United States (via AWS). If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have data protection laws that differ from those of your country.

10. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit (HTTPS), access controls, and storing only a hash of each extension pairing token. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date, and for material changes, we will make reasonable efforts to notify you (such as by email or an in-app notice).

12. Contact Us

Questions about this Privacy Policy or your data can be sent to: hello@trakkerhq.com