1. Who we are

TrackMyOPT is a software product of Zyene, Inc. (Delaware), with offices in San Francisco, California. This Privacy Policy explains how we handle personal information when you use our website, web app, Chrome extension, and related services (the "Service").

Contact: support@trackmyopt.com (general) · privacy@trackmyopt.com (privacy requests)

2. Information we collect

2.1 Account information

Email address, name (if provided), and authentication credentials (passwords are hashed; we do not store plain-text passwords)
Sign-in method (email/password or Google OAuth)
Account settings and preferences

2.2 Immigration and workflow information you provide

You may voluntarily enter information to use OPT/STEM OPT tools, for example:

Program end dates, OPT/STEM OPT start and end dates, DSO recommendation dates
Employment history, unemployment tracking inputs, and related notes
USCIS receipt numbers for case status tracking
Case status text, descriptions, and status history returned via USCIS Case Status API access

This information can be sensitive. We use it only to provide the features you request (timelines, reminders, dashboards, notifications).

2.3 Documents and files

Premium users may upload files to the document vault (e.g. immigration-related PDFs or images). Files are stored using our cloud infrastructure (Supabase Storage). The vault is protected by an optional account passcode (stored as a hash). The passcode controls access in the product; it is not end-to-end encryption. If you reset a forgotten passcode, existing vault files may be removed per our recovery policy.

2.4 Payment and billing

Paid subscriptions are processed by Stripe. We receive subscription status, customer IDs, and transaction metadata from Stripe. We do not store full payment card numbers on our servers.

2.5 Communications

Transactional emails (welcome, billing, case status, reminders, support replies)
Email addresses and message metadata in our email queue logs
Information you send via contact or support forms

2.6 Device, log, and usage data

IP address, browser type, device information, and timestamps (security and abuse prevention)
Authentication session cookies (see Cookie Policy)
PostHog browser analytics — when you choose Accept All, browser analytics may collect product events such as feature interactions and page visits. PostHog is not used by TrackMyOPT for advertising targeting.
Server-side service events — limited events generated by account and API activity may be processed for security, billing, reliability, error diagnosis, and operation of core features. These events do not depend on optional browser cookies and are not controlled by the cookie choice.
Google Analytics (GA4) — when you accept cookies in our banner, we load GA4 to collect aggregated website traffic and usage data (e.g. pages visited, session duration). See Google's Privacy Policy.
Google AdSense — when you accept cookies in our banner, we may display ads via AdSense on free content pages. AdSense may use cookies for ad delivery and measurement. See Google's Privacy Policy.
Aggregated performance metrics (Vercel Analytics / Speed Insights) on our website
Chrome extension: version and content-free usage diagnostics. Non-sensitive display preferences may use browser sync storage; authentication tokens, generated resume artifacts, PDFs, structured resume fields, screening questions, and answers are not stored in sync storage.

2.7 AI-assisted features

If you use resume or document AI features, content you submit may be sent to our AI provider (e.g. Google Gemini) to generate output. Do not submit information you are not comfortable sharing with that provider. AI output is not legal advice.

2.8 Chrome extension application prefill

When you explicitly choose Prefill, Continuous, or Guided Autopilot, the Chrome extension may read the open application form and place eligible information from your dedicated job-portal prefill profile and the active job-scoped generated resume into empty fields. The dedicated profile may include job-application contact information, address, LinkedIn, GitHub, and website details and is separate from your normal TrackMyOPT account profile. A generated resume artifact is kept in extension session storage for up to 30 minutes and is invalidated when the normalized job URL, company, or role changes. Optional AI screening drafts and cover letters send the current job description and the active generated-resume snapshot to our AI provider; drafts require your review and are never generated for sensitive questions. You may optionally save work-authorization, visa, sponsorship, citizenship, annual or hourly compensation, in-person/relocation/start/transportation/accommodation preferences, date-of-birth, sex/gender, race/ethnicity, veteran, disability, and EEO answers in a separate server-side record protected with authenticated encryption. You may also save one default job-portal login in that encrypted record. The same default email address and password are made available for your review across third-party employer and applicant-tracking portals, regardless of hostname. Reusing one login across unrelated portals increases the potential impact if any one portal is compromised. The extension never uses this credential on TrackMyOPT pages, never places it in browser sync storage, and keeps the password masked in its review panel. Because TrackMyOPT's server must decrypt a saved portal password to provide the autofill feature, this credential storage is not end-to-end encryption and should not be used for your TrackMyOPT password or a primary password used for sensitive accounts. Credentials and private answers are never guessed or sent to AI, logs, or analytics. The extension loads saved private data into a review panel, and it cannot use it until you approve it for the current application. Approval is cleared when the application or page changes. When filled, the selected credential or answer is disclosed to the employer or applicant-tracking system operating that page. You can edit or delete saved private data on the Chrome Job Prefill page. Guided Autopilot may click narrowly allowlisted non-submit Next, Continue, or Done controls after required fields are complete, but it stops at Review and never clicks Submit, Apply, Finish, or another final application action. Login credentials never trigger Login, Continue, Next, Create Account, or Submit. The extension does not replace non-empty fields or existing files, fill password-change, security-answer, financial, SSN, date-of-birth, authentication-code, OTP, MFA, PIN, or other uncertain password-type fields, or answer Social Security number questions. Autofill analytics contain only bounded counts, feature states, adapter and mode identifiers, navigation outcomes, and content-free error categories—not resume, answer, field, employer, school, job-title, URL, hash, file content, credentials, or private application answers.

Free includes Step-by-step profile/resume/history prefill, optional skills, review-required private answers and one shared default job-portal login, 5 AI screening drafts per month, and 1 AI cover letter per month. Pro adds Continuous filling, opt-in Guided Autopilot, and higher daily AI access. Optional private application data is encrypted separately, never guessed or processed by AI, and requires approval in the extension for every application before filling. The same default portal login may be offered on different third-party job portals after per-application review and approval. It remains masked in the extension panel and is skipped on password-change, security-answer, financial, SSN, date-of-birth, authentication-code, OTP, MFA, PIN, uncertain password-type, and TrackMyOPT pages. Guided Autopilot can advance safe Next/Continue/Done steps for application fields, pauses for required or review-needed answers, and always stops before final submission. Credential filling itself never clicks Login, Continue, Next, Create Account, or Submit. Press Escape or Stop at any time. TrackMyOPT never submits an application; review every field and attachment yourself.

Saving private application answers is optional and requires an explicit consent action. The encrypted record is retained while you keep it in your account, and you may edit or permanently delete it from Settings. If you save a default job-portal login, TrackMyOPT stores one login email and password in that encrypted record. After your review and approval for each application, the same credential may be offered on third-party job portals across different employers and hiring systems. This cross-portal reuse increases the potential impact if any one portal is compromised. The server must decrypt it to provide autofill, so this is not end-to-end encryption. Do not save your TrackMyOPT password or a primary password used for sensitive accounts. When you choose to use an answer, it is disclosed to the employer or applicant-tracking system whose form you are completing. Private application answers are not used to train or prompt our AI features.

3. How we use information

Provide, operate, and improve the Service
Calculate timelines, unemployment tracking, and reminders
Check USCIS case status when you provide a receipt number
Process subscriptions and send billing-related communications
Authenticate users and protect against fraud or abuse
Respond to support requests and enforce our Terms
Comply with law and protect our rights

4. How we share information

We do not sell personal information for money. We disclose information to service providers and other parties only as described below. Some U.S. privacy laws may define disclosures for personalized advertising as "sharing" even when no money changes hands. You can prevent AdSense from loading by choosing Essential Only and use Google's U.S. state privacy control where it is available.

Supabase — Authentication, database, and file storage (privacy policy)
Stripe — Payment processing and subscription billing (we do not store full card numbers) (privacy policy)
Google OAuth — Optional sign-in with Google (privacy policy)
Email delivery (SMTP) — Transactional emails (e.g. ZeptoMail, Resend, or other configured SMTP provider)
PostHog — Optional browser analytics with consent, plus limited server-side service events for security, billing, reliability, and core feature operation (privacy policy)
Google Analytics (GA4) — Website analytics when you accept analytics cookies in the cookie banner (privacy policy)
Google AdSense — Advertising on free content pages when you accept cookies in the cookie banner (privacy policy)
Vercel Analytics & Speed Insights — Aggregated site performance and usage metrics (privacy policy)
Google Gemini — Optional AI features (e.g. resume tools) when you use those features (privacy policy)
USCIS Case Status API — Case status lookups using receipt numbers you provide (USCIS Case Status API access) (privacy policy)

We may also disclose information if required by law, court order, or to protect safety and rights.

If TrackMyOPT is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your personal information becomes subject to a materially different privacy policy, and you will retain any applicable privacy rights.

5. Legal bases (EEA/UK users)

Where GDPR applies, we rely on consent, contract performance, legitimate interests (security, improvement), and legal obligations as applicable.

6. Data retention

Account data: retained while your account is active
After account deletion: we delete or anonymize personal data within a reasonable period (typically within 30 days), subject to backups and legal holds
Billing records: retained as needed for tax, accounting, and dispute resolution
Consent and checkout audit logs: retained for dispute evidence and compliance

For accounts inactive for 24 months with no subscription activity, we may send notice to the email address on your account. If you do not reactivate or respond within 30 days, we may delete account data, subject to legal, billing, security, fraud-prevention, and audit-retention requirements.

7. Security

We use industry-standard measures including TLS in transit, access controls, and Row Level Security on our database where configured. No method of transmission or storage is 100% secure. See our Security page for an overview.

If we become aware of a security breach that may have compromised personal information, we will notify affected users by email and notify applicable authorities as required by applicable law.

8. Your choices and rights

Browser analytics and advertising: Use Privacy choices in the site footer, your dashboard profile menu, or the shield button on public pages to choose Accept All or Essential Only
Access / correction: Update profile and OPT data in Settings
Private application answers: Review, change, or delete all saved answers in Settings → Profile
Deletion: Delete your account in Settings (or email privacy@trackmyopt.com)
Email opt-out: Unsubscribe links in marketing emails; manage notification preferences in Settings
Applicable U.S. state laws: Rights may include access, deletion, correction, and opting out of sale, sharing, or targeted advertising, subject to the law's coverage and exceptions
EEA/UK (GDPR): Rights to access, rectification, erasure, restriction, portability, and objection where applicable

To exercise rights or request opt-out assistance, email privacy@trackmyopt.com. We may verify your identity before responding.

9. Children

The Service is intended for users 18 and older (typical F-1/OPT audience). We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided data.

10. International transfers

We are based in the United States. If you access the Service from outside the U.S., your information may be processed in the U.S. and other countries where our providers operate.

11. Changes to this policy

We may update this Privacy Policy. We will update the date and version at the top. For material changes, we will provide notice (e.g. email or in-app) when appropriate. For material changes to this Privacy Policy or our Terms that require consent, we may request active consent before the changes apply to your continued use of TrackMyOPT.

Privacy Policy