Privacy Policy

Trakwyn (“Trakwyn”, “we”, “us”) helps you track job applications, interviews, and offers. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

Account information

When you create an account, we collect your email address and a password (stored as a salted hash — we never see or store your password in plain text). You may optionally add your name, timezone, and target role.

If you sign in with Google or GitHub instead, we receive your name, email address, and a profile identifier from that provider. We never see your Google or GitHub password.

Job search data you provide

Everything you enter to track your job search: applications (company, role, status, notes), contacts, interview rounds, offers, and any documents (résumés, cover letters, offer letters) you upload.

Security and device information

To protect your account, we log the IP address, approximate location, and device/browser information associated with sign-ins and certain security-sensitive actions (password changes, two-factor authentication changes, session revocations). This is what powers “new device signed in” alerts and the active-sessions list in Settings.

AI features, if you use them

Trakwyn’s AI features (cover letter generation, résumé matching, the assistant) are bring-your-own-key: you provide your own API key for a provider you choose (e.g. OpenRouter, Google AI). Your key is encrypted at rest. When you use an AI feature, the relevant content (e.g. a job description, your résumé text) is sent directly to the provider you configured — not stored or processed by any AI service of ours. That provider’s own privacy policy governs how they handle it.

The Trakwyn Clipper browser extension

If you install the Clipper, it reads the job posting on the page you’re viewing (job title, company, location, description and link), only on the job boards it supports (LinkedIn, Indeed, Glassdoor, Greenhouse, Lever and Workday) and only when you open it. Nothing is sent anywhere until you choose to save, and then it goes to your Trakwyn account like any application you add yourself.

If you press “Read with AI”, the text of the page is sent through Trakwyn to the AI provider you configured with your own key, as described under AI features. It is never sent unless you press that button.

The Clipper keeps your sign-in tokens in the browser’s session storage and sends them only to the Trakwyn API; they are cleared when you close the browser. If you tick “Keep me signed in” when you sign in, the refresh token (and only that token) is also kept, unencrypted, in the browser’s local storage on this device, so you stay signed in after a restart. Signing out removes it, and so does the end of the session, at most 90 days after you signed in. It also keeps your name, email address and profile picture link in session storage, so it can show who is signed in as soon as it opens; they are cleared with your sign-in. It stores nothing else.

When something breaks, such as a failed sign-in or a posting it could not read, the Clipper sends anonymous error reports to our error-monitoring provider, PostHog (EU). Each report has a random identifier, no user profile and no location lookup, and never includes your tokens, your email address, the job’s content or the page address. A report names the job board, not the site you were on.

Payments

If you buy Pro, our merchant of record, Polar, collects your payment details (card, billing country and address, and tax information) and processes the payment. We never see or store your card number. We send Polar your email address and your Trakwyn account ID so it can issue your receipt and match the purchase to your account, and Polar tells us your plan, the status of your subscription and the dates it ends.

Polar keeps its own record of your purchases, including after you delete your Trakwyn account, because it has tax and accounting duties as the seller. Deleting your account stops any subscription renewing (it ends with the period you have paid for, without a refund) but does not erase Polar’s records; Polar’s privacy policy explains how it handles them.

Cookies

We use cookies necessary to keep you signed in, which can’t be switched off, and, only where you’ve opted in, analytics cookies to understand how Trakwyn is used. You can review or change your choice anytime via “Cookie preferences” in the site footer.

How we use this information

• To operate Trakwyn — storing and displaying the data you enter, keeping you signed in.
• To secure your account — detecting unfamiliar sign-ins, supporting password resets and two-factor authentication.
• To send account-related email — email verification, password reset, security alerts, and, if you’ve enabled it, a weekly or daily digest of your job search activity. You can turn optional emails off in Settings.
• To fix bugs and improve the product, using aggregated, anonymized usage data.

How we share information

We do not sell your personal information. We share it only with:

• Service providers who process it on our behalf to run Trakwyn — our hosting provider, our email delivery provider, our payment provider (Polar, the merchant of record) if you buy a paid plan, and, only if you’ve configured them, the OAuth provider you sign in with and the AI provider you bring your own key for.
• Law enforcement or other parties if required by law, or to protect the rights, property, or safety of Trakwyn, our users, or others.

Your data, your control

You can export a full copy of your data at any time from Settings, and delete your account there too. We email you a link to confirm; once you use it, the account is closed straight away and permanently deleted 14 days later, and until then you can cancel and nothing is lost. Deleting is a hard delete — it removes your applications, documents, profile photo, notes, and the security/login records described above, not a soft delete or deactivation. After that, our database backups hold a copy only for a short restore window of at most 7 days. Once deleted, we cannot recover it.

Data security

Passwords are hashed, sensitive fields (like AI provider keys and two-factor secrets) are encrypted at rest, and account access supports two-factor authentication. No method of transmission or storage is 100% secure, but we work to protect your information using practices appropriate to the sensitivity of the data involved.

Children’s privacy

Trakwyn is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll update the “Last updated” date above and, where appropriate, notify you directly.

Contact us

Questions about this policy or your data? Email us at contact@trakwyn.com.