Privacy Policy

Order Tracker · Closed beta · Effective 2026-07-16

0. In short

Order Tracker is a personal order-tracking app, currently in a closed beta run by one independent developer. It is not a company.

If you connect Gmail, the app reads order-related email in order to turn it into tracked orders. It does not sell your data, does not show ads, and does not use your data to train anything.

This page describes exactly what happens to your data, including the parts that are inconvenient to admit. If anything here is unclear, ask before you sign up.

1. Who is responsible

Order Tracker is operated by an individual developer, not a registered company. There is no support team, no data-protection officer, and no 24/7 on-call. One person reads the support inbox.

Contact: ordertracker@shaibuilds.builders

2. What the app stores about you

Account: your email address, your name if you provide one (optional), and either a password hash (bcrypt — your actual password is never stored and cannot be recovered by anyone, including us) or your Google account ID if you signed in with Google.

Activity: a timestamp of when you last used the app (written at most once every 15 minutes). This exists to measure whether beta users come back. No IP address is ever stored.

Orders: store name, order number, order date, total amount and currency, status, tracking number, carrier, and any notes you write. For each item: name, quantity, price, SKU, product image URL, and product page URL.

Delivery tracking: the latest carrier checkpoint text and estimated delivery date. Carrier checkpoint text often contains location information (for example a city or a depot name).

Issues: the title and free-text description you write when you open an issue on an order, and the message the AI drafts for you to send to the seller.

Notifications: your device push token, your notification preferences, and a log of every notification the app sent you, including its text (for example "Nike order is now delivered"). This log is kept indefinitely.

Gmail import records: for every email the app imports from, it stores the email's Subject line and From address verbatim, the Gmail message ID, and the structured order data the AI extracted from it.

3. What the app does with Gmail (read this one carefully)

Connecting Gmail is optional. The app works without it; you can add orders manually.

The permission you grant is Google's gmail.readonly scope. Be precise about what that means: that scope grants read access to your entire mailbox. The app narrows this itself, in its own code, by searching only for order-related mail. That narrowing is a choice made in the software, not a limit enforced by Google.

What the app actually searches for: mail from Amazon, AliExpress, eBay, Etsy or Shopify, or mail whose subject looks like an order confirmation (in English or Hebrew), from the last 90 days, excluding the Promotions category. Up to 50 messages per sync.

The app reads both order confirmations and order status updates (shipping, delivery, refunds, customs, carrier handoff). It is not limited to confirmations only.

It reads the text of those emails. It does not read or download attachments.

What is stored from an email: the Subject line and the From address, verbatim and indefinitely, plus the order data extracted from it. The body text of your email is not stored in the database.

The body text is, however, sent to an AI provider for extraction while the sync runs. See section 4.

You can disconnect Gmail at any time. Disconnecting stops future syncing; orders already imported stay in your account until you delete them or delete your account.

4. Who else receives your data

The app does not sell data, share it with advertisers, or use it for any purpose other than running the service for you. The following third parties receive data only because the feature you are using requires it.

• Google — if you connect Gmail or sign in with Google. Governed by Google's own privacy policy.
• Anthropic (Claude) — the AI that reads order emails. During a Gmail sync, each matching email is sent for extraction: its subject, its sender, and up to the first 10 KB of its body text, plus up to 60 links and image URLs found in it. That body text is not filtered for personal information: if an order email contains your name, shipping address or phone number in its first 10 KB, that is sent too. Separately, when you ask for help with an issue, the order details plus the description you wrote are sent. This data is handled under Anthropic's commercial terms; the app does not set a zero-retention flag.
• AfterShip — live delivery tracking. It receives only the tracking number, a carrier code, and the app's internal order ID. It does not receive your name, your email, or any address.
• Expo and Google Firebase (FCM) — push notification delivery. They receive your device push token and the text of the notification, which contains the store name and order status.
• Microlink — used only as a fallback when fetching a product image directly from the merchant fails. It receives the product page URL, which for marketplaces usually contains a product ID. It receives no information about you.
• Sentry — crash and error reporting. The server strips email addresses, usernames, IP addresses, request bodies, headers, cookies and query strings before sending. What remains is the error itself, the stack trace, and the URL, which contains internal record IDs but not your email.
• Railway — the hosting provider that runs the server and database.

The developer also receives automated operational alerts by Telegram (for example "the AI parser failed"). These alerts contain error text only. They do not contain your email, your identity, or your order contents.

5. Encryption, stated honestly

All traffic between the app and the server is encrypted in transit (HTTPS).

Your Google access and refresh tokens are encrypted at rest in the database with AES-256-GCM.

Your password is stored as a bcrypt hash, which is not encryption: it cannot be reversed back into your password.

Everything else — your email address, your order contents, item names, issue descriptions, notification history, and the Gmail subject lines and sender addresses — is stored unencrypted in the database. It is protected by the hosting provider's access controls and by the fact that nobody but the developer has credentials. It is not protected by application-level encryption. You should weigh that before connecting a mailbox.

6. How long data is kept

Until you delete it. There is no automatic expiry and no scheduled cleanup: order history, Gmail import records (including subject lines) and notification logs are kept for as long as your account exists.

This is a deliberate disclosure, not an oversight being hidden: the app has no retention job of any kind today.

7. Deleting your account and your data

Delete your account yourself, at any time, from Settings in the app. It is immediate and permanent. Nobody has to approve it and you do not have to ask.

If you cannot reach the app, email ordertracker@shaibuilds.builders from your account's email address instead.

Deleting your account erases, from the database: your user record, your Gmail connection and its stored tokens, every order and order item, all status history, all Gmail import records including stored subject lines, all issues, all push tokens, your notification preferences, and your entire notification log. There is no soft-delete and nothing is retained in a shadow copy.

Deleting your account also asks Google to revoke this app's access to your Gmail, before the stored token is destroyed. If that request fails — for example if Google is unreachable at that moment — the app tells you so and asks you to remove the access yourself at myaccount.google.com/permissions. Your data is deleted either way.

What deletion does not reach, stated plainly:

• AfterShip keeps its own copy of tracking numbers already registered with it. Those are not deleted from AfterShip when you delete your account.
• Anthropic retains data per its own commercial terms, outside our control.
• Sentry keeps past error reports until its own retention window expires. They contain internal IDs, not your email.
• Server logs at the hosting provider may contain internal user IDs and push tokens for as long as the provider retains logs.

8. Your choices

Use the app without Gmail. Add orders by hand; nothing is imported.

Disconnect Gmail whenever you want, and keep using the app.

Turn off any category of push notification in Settings.

Ask for a copy of your data, or ask for deletion, at the support address.

9. This is a beta. What that means for you

The app is registered with Google in "Testing" mode. Three consequences you will actually notice:

• Google shows you an "app isn't verified" warning screen before you can grant access. That screen is accurate: this app has not gone through Google's verification review.
• Google expires your permission every 7 days. You will have to reconnect Gmail about once a week. This is imposed by Google in Testing mode and cannot be avoided at this stage.
• The beta is limited to a small number of invited testers.

It is a beta in the honest sense: there will be bugs, and it is run by one person. Do not treat it as a system of record for anything that matters.

10. Children

The app is not intended for use by anyone under 16.

11. Changes to this policy

If what the app does with your data changes, this page changes with it, and the effective date at the top is updated. For a change that materially expands what is collected or who receives it, beta testers will be notified directly.