1. Who we are

TrackMyOPT is a software product of Zyene, Inc. (Delaware), with offices in San Francisco, California. This Privacy Policy explains how we handle personal information when you use our website, web app, Chrome extension, and related services (the "Service").

Contact: support@trackmyopt.com (general) · privacy@trackmyopt.com (privacy requests)

2. Information we collect

2.1 Account information

Email address, name (if provided), and authentication credentials (passwords are hashed; we do not store plain-text passwords)
Sign-in method (email/password or Google OAuth)
Account settings and preferences

2.2 Immigration and workflow information you provide

You may voluntarily enter information to use OPT/STEM OPT tools, for example:

Program end dates, OPT/STEM OPT start and end dates, DSO recommendation dates
Employment history, unemployment tracking inputs, and related notes
USCIS receipt numbers for case status tracking
Case status text, descriptions, and status history returned via USCIS Case Status API access

This information can be sensitive. We use it only to provide the features you request (timelines, reminders, dashboards, notifications).

2.3 Documents and files

Premium users may upload files to the document vault (e.g. immigration-related PDFs or images). Files are stored using our cloud infrastructure (Supabase Storage). The vault is protected by an optional account passcode (stored as a hash). The passcode controls access in the product; it is not end-to-end encryption. If you reset a forgotten passcode, existing vault files may be removed per our recovery policy.

2.4 Payment and billing

Paid subscriptions are processed by Stripe. We receive subscription status, customer IDs, and transaction metadata from Stripe. We do not store full payment card numbers on our servers.

2.5 Communications

Transactional emails (welcome, billing, case status, reminders, support replies)
Email addresses and message metadata in our email queue logs
Information you send via contact or support forms

2.6 Device, log, and usage data

IP address, browser type, device information, and timestamps (security and abuse prevention)
Authentication session cookies (see Cookie Policy)
Optional analytics (PostHog) when enabled in our deployment. PostHog analytics, when enabled, may collect usage events such as feature interactions and page visits to help us improve the product. PostHog does not use this data for advertising targeting. You may contact privacy@trackmyopt.com to request opt-out.
Google Analytics (GA4) — when you accept cookies in our banner, we load GA4 to collect aggregated website traffic and usage data (e.g. pages visited, session duration). See Google's Privacy Policy.
Google AdSense — when you accept cookies in our banner, we may display ads via AdSense on free content pages. AdSense may use cookies for ad delivery and measurement. See Google's Privacy Policy.
Aggregated performance metrics (Vercel Analytics / Speed Insights) on our website
Chrome extension: version, timezone, and sync storage for sign-in state (see extension permissions)

2.7 AI-assisted features

If you use resume or document AI features, content you submit may be sent to our AI provider (e.g. Google Gemini) to generate output. Do not submit information you are not comfortable sharing with that provider. AI output is not legal advice.

3. How we use information

Provide, operate, and improve the Service
Calculate timelines, unemployment tracking, and reminders
Check USCIS case status when you provide a receipt number
Process subscriptions and send billing-related communications
Authenticate users and protect against fraud or abuse
Respond to support requests and enforce our Terms
Comply with law and protect our rights

4. How we share information

We do not sell your personal information. We share information only with:

Supabase — Authentication, database, and file storage (privacy policy)
Stripe — Payment processing and subscription billing (we do not store full card numbers) (privacy policy)
Google OAuth — Optional sign-in with Google (privacy policy)
Email delivery (SMTP) — Transactional emails (e.g. ZeptoMail, Resend, or other configured SMTP provider)
PostHog — Optional product analytics when enabled in environment configuration (privacy policy)
Google Analytics (GA4) — Website analytics when you accept analytics cookies in the cookie banner (privacy policy)
Google AdSense — Advertising on free content pages when you accept cookies in the cookie banner (privacy policy)
Vercel Analytics & Speed Insights — Aggregated site performance and usage metrics (privacy policy)
Google Gemini — Optional AI features (e.g. resume tools) when you use those features (privacy policy)
USCIS Case Status API — Case status lookups using receipt numbers you provide (USCIS Case Status API access) (privacy policy)

We may also disclose information if required by law, court order, or to protect safety and rights.

If TrackMyOPT is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your personal information becomes subject to a materially different privacy policy, and you will retain any applicable privacy rights.

5. Legal bases (EEA/UK users)

Where GDPR applies, we rely on consent, contract performance, legitimate interests (security, improvement), and legal obligations as applicable.

6. Data retention

Account data: retained while your account is active
After account deletion: we delete or anonymize personal data within a reasonable period (typically within 30 days), subject to backups and legal holds
Billing records: retained as needed for tax, accounting, and dispute resolution
Consent and checkout audit logs: retained for dispute evidence and compliance

For accounts inactive for 24 months with no subscription activity, we may send notice to the email address on your account. If you do not reactivate or respond within 30 days, we may delete account data, subject to legal, billing, security, fraud-prevention, and audit-retention requirements.

7. Security

We use industry-standard measures including TLS in transit, access controls, and Row Level Security on our database where configured. No method of transmission or storage is 100% secure. See our Security page for an overview.

If we become aware of a security breach that may have compromised personal information, we will notify affected users by email and notify applicable authorities as required by applicable law.

8. Your choices and rights

Access / correction: Update profile and OPT data in Settings
Deletion: Delete your account in Settings (or email privacy@trackmyopt.com)
Email opt-out: Unsubscribe links in marketing emails; manage notification preferences in Settings
California (CCPA/CPRA): Right to know, delete, correct, and opt out of sale/sharing (we do not sell personal information)
EEA/UK (GDPR): Rights to access, rectification, erasure, restriction, portability, and objection where applicable

To exercise rights, email privacy@trackmyopt.com. We may verify your identity before responding.

9. Children

The Service is intended for users 18 and older (typical F-1/OPT audience). We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided data.

10. International transfers

We are based in the United States. If you access the Service from outside the U.S., your information may be processed in the U.S. and other countries where our providers operate.

11. Changes to this policy

We may update this Privacy Policy. We will update the date and version at the top. For material changes, we will provide notice (e.g. email or in-app) when appropriate. For material changes to this Privacy Policy or our Terms that require consent, we may request active consent before the changes apply to your continued use of TrackMyOPT.

Privacy Policy