Privacy Policy

Information We Collect

• Account information from your login provider, such as your email address and profile name.
• Receipt files, receipt images, extracted merchant/date/total/item fields, labels, sync status, and duplicate-group metadata.
• Integration credentials and sync metadata, including Google OAuth access and refresh tokens, token expiry timestamps, and last-sync state.
• Operational logs, notification records, and security telemetry — including IP addresses, browser user-agent strings, and page URLs — used to operate, rate-limit, and protect the service.
• If you enable receipt scanning in the mobile app, Tracklified periodically checks your device photo library for new images and runs on-device text recognition to detect receipts. Detected receipts are always presented for your review and approval before being uploaded to your account.
• If you install the browser extension, it automatically reads transaction details — merchant names, amounts, and dates — from supported banking and credit-card websites listed in the extension permissions to match them against your stored receipts. You can also request a scan on any page you are viewing. Transaction data is processed in memory and not persisted on Tracklified servers. The extension stores a per-install API key in Chrome extension storage (which may sync through your Chrome account) to communicate with your Tracklified account.
• If you connect Tracklified to an OpenAI client such as ChatGPT or Codex, Tracklified receives the tool parameters needed to answer your request, such as search terms, date ranges, or transaction merchant/date/amount details. It returns responsive receipt metadata, images, line items, spending summaries, or match results. The Tracklified workspace, when available and explicitly authorized, also processes receipt uploads, corrections, review actions, labels, and selected-record exports that you request. Workspace write audits record action names, changed field names, and record counts. Earlier read-only OpenAI grants do not authorize workspace writes and must be replaced by a new workspace authorization.
• When you choose to save a web page as a receipt, the extension sends the page HTML, its source URL, and, when available, a screenshot of the visible tab to Tracklified for receipt extraction and storage. When you choose a receipt image or PDF, it sends that file, including a local file if you have enabled file access in Chrome. These captures may contain personal or payment information shown in the receipt. Amazon printable invoices use the sanitized invoice capture described below instead of a tab screenshot.
• The browser extension can also extract receipt emails from Gmail when you explicitly choose to save an email as a receipt. This reads the email subject, sender, date, and body content from the page you are viewing.
• When you choose to add Amazon item details, the extension reads printable invoices in your signed-in Amazon tab. It sends invoice content, including item names, quantities, prices, totals, delivery addresses, and payment-method details shown on the invoice, to Tracklified for AI extraction and receipt storage. It does not collect your Amazon password or authentication cookies. Optional Amazon site access lets a session you start visit up to 50 orders already listed in your Tracklified receipts, one at a time. It does not scan your order history or run on a schedule. You can pause the session and revoke Amazon site access in Chrome.
• If you choose to report a site for improved support via the browser extension, a snapshot of the page structure is sent to Tracklified. The extension replaces much of the page text with placeholders, but this redaction is not complete: the site address and page title are included, and short text or HTML attributes may remain. Only report pages you are comfortable sharing for support.

Google API Data

If you connect Gmail, Google Drive, or Google Photos, Tracklified requests only the read-only scopes below and uses the resulting data to import receipts into your account.

Chrome Extension Limited Use

Tracklified uses browser data only to provide the receipt features you use. Our use and transfer of that data adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

How We Use Your Data

• To authenticate your account and keep your session active.
• To import receipt images, PDFs, and receipt emails from the integrations you connect.
• To extract structured fields such as merchant name, date, totals, line items, and category labels.
• To detect duplicates, generate export files, and show sync/upload notifications.
• To match bank and credit-card transactions against your receipts via the browser extension.
• To detect and upload receipts from your device photo library when background scanning is enabled in the mobile app.
• To provide customer support and troubleshoot account, sync, billing, and receipt-processing issues you report.
• To secure the service, prevent abuse, debug errors, and comply with legal obligations.

Automatic and Background Processing

• When Gmail is connected, Tracklified automatically checks for new receipt-like emails when you open the dashboard (throttled to once every 30 minutes). A server-side process also handles emails forwarded to your dedicated Tracklified address on a recurring schedule.
• If you enable receipt scanning in the mobile app, a background task runs periodically to check for new photos. Text recognition runs entirely on your device. Detected receipts are presented for your review and approval before being uploaded. You can disable scanning at any time in the app settings.
• The browser extension automatically reads transaction pages on supported banking and credit-card websites to match charges against your receipts. Transaction data is sent to Tracklified for matching but is not stored beyond the request. The extension automatically activates on sites listed in its permissions and can scan other pages at your request.

Sharing and Subprocessors

• We do not sell your personal information or Google user data.
• We do not use Google user data to serve ads.
• We do not use Google user data to train generalized or non-user-specific AI/ML models.
• When you use the OpenAI connection, OpenAI receives the Tracklified data needed to answer the request you made there. OpenAI is the client you chose for that disclosure, and its own terms and privacy policy govern its handling of the data in your chats.
• If you authorize a Tracklified connection to Meta Muse, Meta receives the receipt records, images, line items, labels, and spending summaries requested through that read-only connection. Tracklified processes search terms, date ranges, receipt IDs, and other tool parameters to answer those requests for the connected account. Meta's terms and privacy policy govern its handling of the data it receives. You can ask support@tracklified.com to revoke the Muse authorization; revocation does not erase information already returned to Meta.
• We only transfer Google user data to service providers as needed to provide user-facing Tracklified features, comply with law, or protect the service.
• Human access to Google user data is restricted to cases where you explicitly ask for support, where access is required for security/abuse investigation, or where required by law.

Processing Locations

Tracklified is based in the United States. Our production receipt files and application database are hosted by AWS in the United States. Authentication and other service providers may process data in other countries where they or their subprocessors operate. Availability of a Tracklified feature in the United States does not mean all provider processing occurs exclusively in the United States.

Government and Third-Party Requests

We verify the identity and legal authority of anyone requesting customer data for legal or governmental purposes. We obtain legal advice when needed, challenge invalid or overly broad requests, and disclose only the data legally required. We notify affected users when legally permitted and document the request and our response. These requests are handled by authorized personnel; a request alone does not grant access to an account.

Security and Retention

Google OAuth tokens are stored with your integration record and encrypted at rest. Receipt files are stored with our cloud storage provider, and receipt metadata is stored in Tracklified's application database. We retain this information while your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements.

Access to customer data is limited to authorized personnel and only when reasonably necessary to provide support, maintain and secure the service, investigate abuse or incidents, comply with law, or with your consent.

Your Choices and Deletion

• You can disconnect Gmail, Drive, or Photos from the Integrations page; this revokes your Google tokens and stops future syncs. You can also revoke access directly from your Google Account security settings.
• You can delete receipts from your dashboard; associated stored receipt images are deleted from cloud storage as part of that flow.
• You can disable background photo scanning at any time in the mobile app settings.
• You can uninstall or disable the browser extension to stop transaction matching on banking sites.
• You can remove the Tracklified connection in ChatGPT or Codex to stop future OpenAI tool requests. You can also ask support@tracklified.com to revoke the authorization on Tracklified's side.
• You can delete your entire account from the Settings page. This removes your receipts, images, integrations, and user record from the active service. You can also request deletion by emailing privacy@tracklified.com. Deleted database records may remain in existing automated backups until those backups expire; automated database backups currently have a seven-day retention period. Retention required for the purposes described under Security and Retention may still apply.

Children's Privacy

Tracklified is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at privacy@tracklified.com.

Contact

Questions or deletion requests: privacy@tracklified.com