TrackMyOPT is operated by Zyene, Inc.. This page is not legal advice. U.S. counsel should review before launch.

We take reasonable steps to protect information in TrackMyOPT. This page summarizes our approach; it is not a guarantee against all risks.

1. Infrastructure

Hosted on modern cloud providers (e.g. Vercel for the web app, Supabase for data and auth)
HTTPS/TLS for data in transit between your browser and our servers
Database Row Level Security (RLS) so users can access only their own rows where enabled

2. Authentication

Passwords hashed with industry-standard algorithms (via Supabase Auth)
Optional Google OAuth sign-in
Document vault optional 6-digit passcode (hashed; not full-disk encryption)

3. Payments

Card payments are handled by Stripe. Payment card details are entered on Stripe's secure flows; we do not store full card numbers on our servers.

4. Sensitive immigration data

Receipt numbers, OPT dates, and uploaded documents are sensitive. Limit what you upload. Use a strong account password and do not share your vault passcode.

5. Monitoring and incidents

We use logging and optional analytics to detect abuse and outages. If we become aware of a breach affecting your personal information, we will notify affected users and authorities as required by law.

6. Your role

Use a unique, strong password
Sign out on shared devices
Report suspicious activity to support@trackmyopt.com

7. Vulnerability reports

If you believe you found a security issue, email security@trackmyopt.com (or support@trackmyopt.com) with details. Please do not publicly disclose unresolved critical issues without giving us reasonable time to respond.

We use TLS for data in transit, access controls, and trusted infrastructure providers. We do not claim SOC 2, PCI DSS, HIPAA, FedRAMP, or end-to-end encryption for the Service unless separately documented in writing.

Security