Privacy Policy

What we do

Order Tracker helps you track online orders by connecting to your email accounts. We scan for order confirmation and shipping emails from supported retailers and display your order information in one place.

Data we access

• Email access (IMAP or Google OAuth) — We connect to your email solely to search for order-related messages from supported retailers. We inspect mailbox changes and message metadata to identify relevant mail, and process order-related message content to provide this feature.
• Order data — Order numbers, dates, items, totals, and tracking information extracted from retailer emails. This data is stored locally in your browser (IndexedDB) and optionally synced to your account. Automatic Gmail imports require cloud storage.
• Authentication — We use Discord OAuth via Supabase for sign-in. We store your user ID and session tokens. We do not access your Discord messages or contacts.

Google API usage

When you connect a Google account, we request the gmail.readonly scope to search for order emails. Our use of Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only access Gmail data to find order and shipping emails from retailers.
• We do not use Gmail data for advertising, market research, or email tracking.
• We do not share Gmail data with third parties except as needed to provide the service.
• We do not allow humans to read your email content unless required for security or legal compliance.

Data storage

Order data and email account credentials are stored locally in your browser (IndexedDB) and optionally synced to your account. Automatic Gmail imports require cloud storage. When synced, IMAP passwords are encrypted at rest in our database and only decrypted server-side during scrape requests. For automatic Gmail imports, OAuth refresh tokens are encrypted and stored on our servers. Background workers use them to process new order mail while your browser is closed. Google tokens are never included in browser storage or exports. We retain message identifiers and processing outcomes for reliable syncing, rather than full email bodies by default. All data transmission occurs over HTTPS.

Data sharing

We do not sell or rent your personal data. Service providers process data as needed to operate Order Tracker. If you enable Discord import alerts, we send the retailer, order number, item summary, total, and dashboard link to your explicitly selected Discord channel. Your webhook credentials are stored securely on our servers. We do not use your data for advertising or analytics beyond basic anonymous usage metrics (via Vercel Analytics).

Data deletion

You can delete all your data at any time from the Settings page. Disconnecting a Google account immediately disables imports and starts access revocation and credential removal. If Google is temporarily unavailable, cleanup is retried while importing remains disabled. Imported orders remain until you delete them. Deleting an IMAP email account removes its credentials and associated local order data.

Security

All connections use HTTPS. Synced IMAP passwords and Gmail refresh tokens are encrypted at rest and accessed by server components for the features you enable. Google OAuth tokens are managed with automatic refresh and expiration handling. You can pause or disconnect Gmail and disable Discord import alerts from Email Accounts. Turning Cloud Sync off pauses Gmail imports across your account while keeping existing orders. Enabling Cloud Sync again does not resume mailboxes until you choose Resume.

Contact

For questions about this policy, reach out via our Discord server.