Privacy Policy

Last updated: October 17, 2026

This policy explains what information Tracked ("we", "us") collects when you use the Tracked web app at tracked.quest and the Tracked browser extension, how we use it, and the choices you have.

1. Who we are

Tracked is operated by Linh Tran, based in Ontario, Canada. You can reach us at contactlinhttran@gmail.com. Linh Tran also serves as our Privacy Officer under Quebec's Act respecting the protection of personal information in the private sector ("Law 25") and is the person you can contact to exercise your privacy rights.

2. What we collect

We only collect what we need to run the service.

• Account information — your email address, and either a password you choose or a Google account ID if you sign in with Google.
• Content you create — the folders, pipeline statuses, settings, and job applications you save, including fields like company, role, location, compensation, URL, dates, notes, and job description text.
• Technical information — standard server logs maintained by our hosting provider (IP address, request timestamp, user agent). We do not run separate analytics or tracking scripts.
• Local storage — your browser stores a session token (so you stay signed in) and a few preference flags (dismissed hints, UI state). This data stays on your device unless you sync it to your account.

What the extension sees. When you open the Tracked extension on a job listing page, it reads the current page's URL and visible text so it can pre-fill the save form. The page content is only read when you open the popup, is only used to populate the form you see, and is only sent to our database when you click Save Job. We do not read pages in the background.

3. What we do with it

• Provide the service — show your data back to you, sync it across devices.
• Keep you signed in and let you reset your password.
• Keep the service secure (detect abuse, debug errors).
• Communicate with you about your account if needed (for example, a password reset email).

We do not sell your data, show you ads, build advertising profiles, or share your content with third parties for their own purposes.

4. Service providers we use

To run Tracked we rely on these providers. They process data on our behalf, under their own security and privacy terms.

• Supabase (database and authentication) — stores your account, your content, and your session tokens. See Supabase's privacy policy.
• Vercel (web hosting) — serves the Tracked website and keeps standard access logs. See Vercel's privacy policy.
• Google (sign-in with Google, optional) — only used if you choose Google sign-in. Google tells us your email address and basic profile. See Google's privacy policy.

5. Where your data is stored

Your data is stored on servers operated by Supabase and Vercel. These providers may process data in regions outside your own country, including the United States. Where required, transfers are covered by standard contractual clauses offered by those providers.

Before using these providers to process personal information of Quebec residents, we assessed whether the information would receive protection equivalent to what applies in Quebec, considering the sensitivity of the information, how it is used, the protections (including contractual) in place, and the legal regime of the destination. We rely on the providers' standard contractual commitments and their published security practices as part of that assessment.

6. How long we keep it

We keep your account and content for as long as your account is active. If you delete your account, we delete your folders, statuses, jobs, and settings from our database. Server logs are kept for a short rolling window by our hosting providers (typically up to 30 days) for security and debugging.

7. Your rights

You can, at any time:

• See the data in your account by signing in.
• Edit or delete any folder, status, or job application you created.
• Change or reset your password from the sign-in page.
• Ask us to delete your account and all its data by emailing contactlinhttran@gmail.com.

Depending on where you live, you may also have the right to request a copy of your data, object to how we use it, or complain to your local data protection authority (for example, in the EU/UK under the GDPR, or in California under the CCPA/CPRA). To exercise any of these rights, contact us at the email above.

Quebec residents. Under Quebec's Law 25 you also have the right to access the personal information we hold about you, to have it corrected if it is inaccurate, to withdraw your consent where consent is the basis for processing, to receive your information in a structured, commonly-used technological format (data portability), and to request that we stop disseminating your information or that a hyperlink to it be de-indexed where the law allows. If you believe we are not meeting our obligations, you can also file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

8. Children

Tracked is not intended for children under 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

9. Security

All traffic between your browser and our servers uses HTTPS. Passwords are hashed by Supabase; we never see your plain-text password. Access to the production database is restricted. No system is perfectly secure — if we become aware of a confidentiality incident affecting your personal information, we will notify affected users and, where required by law, the relevant regulator. For Quebec residents, this includes notifying the Commission d'accès à l'information du Québec when the incident presents a risk of serious injury, as required by Law 25.

10. Changes to this policy

If we change this policy, we will update the date at the top of the page and, for significant changes, let you know in the app or by email.

11. Contact

Questions, requests, or complaints: contactlinhttran@gmail.