Privacy Policy

What we collect

• Account data — your name, username, email address, and a hashed (never plain-text) password, for whoever signs up or is added to a company.
• Task/email data — for any email CC'd to the dedicated tracking address, we store the subject line, sender and recipient addresses, a short snippet of the message body, and timestamps, so the thread can be shown as a task. Names and email addresses of people who aren't registered logins (the employees being tracked) are stored too, since that's how the dashboard knows who a task belongs to.
• Usage data — standard web request logs (IP address, timestamps) from running the service.

We only ever read the one dedicated tracking mailbox — never a personal inbox, and never anything not CC'd or addressed to that address.

How we use it

To run the dashboard itself (showing tasks and their status), to sign you in (a one-time code emailed on every login), to let you reset a forgotten password, to send the task reports you opt into from Settings, and to review new sign-up requests. We don't use your data for advertising, and we don't sell it.

Who else sees it

A short list of services we rely on to run the app, each only seeing what they need to do their job:

• Google (Gmail API) — reads the tracking mailbox and sends outbound mail (login codes, resets, reports) on our behalf.
• Railway — hosts the application and database.
• Sentry — receives error reports (tracebacks, request context) when something breaks, so we can fix it.

We don't share your data with anyone else, and never sell it.

Visibility within your company

A task is only visible to the login that sent it and anyone else registered who was addressed or CC'd on that specific thread — not automatically to your whole company. A company's admin manages that company's logins but doesn't get blanket access to every task by default.

Cookies

We use one cookie to keep you signed in (HttpOnly, so client-side scripts can't read it). No advertising or tracking cookies.

Retention and deletion

We keep account and task data as long as your account is active. There's no automatic deletion schedule yet — if you want your data removed, email us and we'll handle it manually.

Security

Passwords are hashed, never stored in plain text. Every sign-in requires a second factor (a one-time code emailed to you). Public endpoints are rate-limited. That said, no system is perfectly secure, and we can't guarantee absolute security.

Children

This service is for business use and isn't directed at children.

Changes

If this changes materially, we'll update the date at the top of this page.

Contact

Questions, or want your data removed: info@trevlik.com.