Privacy Policy

Key points

• Who is responsible. WEBCOREX LTD runs TrackLode and is responsible for your personal data. For the data about your clients that you add, you're in charge and we act on your behalf (section 2).
• What we collect. What you give us, a record of sign-ins and of time spent in the app, your plan status from Stripe, and the technical data we need to keep TrackLode safe and working.
• What we don't do. We don't sell personal data, we don't use it for advertising, and we don't use your content to train AI models.
• Who can see it. A small number of authorised staff can see account details and some activity in our admin panel, for support and security (section 6). Our service providers are listed in section 7.
• Where it's kept. In Microsoft data centres in the Netherlands, with backups in Ireland.
• Your control. You can download your data and delete your account under Account > Your data. For anything else, email support@tracklode.com.
• Cookies. Only the cookies and storage TrackLode needs, so there's no cookie banner. Our public pages count visits with Cloudflare Web Analytics, which uses no cookies (sections 4 and 12).
• Complaints. You can complain to us, and you can always complain to the Information Commission (ICO) or to your local data protection authority (section 11).

1. Who we are and how to contact us

TrackLode is provided by WEBCOREX LTD, a private limited company registered in England and Wales under company number 16329140. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We're registered with the Information Commission (ICO) under reference ZB979040.

For anything about your personal data, email support@tracklode.com, use the contact form at tracklode.com/contact, call +30 694 544 1201, or write to us at the address above.

We haven't appointed a data protection officer, because the law doesn't require us to.

Because we offer TrackLode to people in the European Union, we have a representative there under Article 27 of the EU GDPR: Vasileios David Ntanos, Krevvata 60, Piraeus 18538, Greece, support@tracklode.com. You can contact our representative instead of us about any data protection matter. We're based in the UK, so we don't need a UK representative.

This policy covers tracklode.com, the TrackLode web app and the TrackLode browser extension.

2. Our two roles

We're the controller of personal data about TrackLode's users, the visitors to our website and the people who contact us: account details, plan status, activity records, support messages and the like. This policy explains that processing.

We're a processor for the personal data of your clients and other people that you add to TrackLode or send through it, such as client names, email and postal addresses, VAT numbers, and the invoices and emails you send them. You decide how that data is used, and we process it on your behalf under the Data Processing Terms in Schedule 1 of our Terms of Service. Section 14 explains what this means for your clients, including the few limited purposes for which we use their data as a controller.

3. The personal data we collect

Google. We use what Google gives us only to create your account and sign you in, and never for advertising. Our use of information we receive from Google APIs follows the Google API Services User Data Policy. You can remove TrackLode's access in your Google account settings at any time; to delete what we already hold, delete your TrackLode account.

Do you have to give us this data? To create an account you need an email address and a password, or a Google account. To buy Pro you must give Stripe your payment and billing details. Business details are needed only for what appears on your invoices. Everything else is optional or comes from your use of TrackLode. Without the required data we can't provide your account or Pro.

4. Logs, activity and performance monitoring

Server logs. Our server writes one line for each request: the method, the address of the page without its query string, the result, how long it took, a request id, and your account id if you're signed in. It doesn't log IP addresses or email addresses, and it hides email addresses that appear in error messages from email providers. We keep server logs for 14 days.

Application Insights. We may use Application Insights, part of Microsoft Azure, to find errors and slow pages. When it's on, it records requests (address, result and timing), the calls our server makes to other services (such as our database, our file storage, Stripe, and the website of a client you look up with Find online) and errors. It doesn't store your IP address, which it masks, although Microsoft may first use it to work out an approximate location. It may record your browser's user agent. We don't add your name, email address or account id. Page addresses can contain internal numbers, such as an invoice's number in a download link. We keep this data for 30 days, and our admin panel shows only totals from it.

Activity record. We record sign-in events with the time and your browser family, but not your IP address or email address. While you're signed in and the app is open, our server adds the time that its connection to your browser stays open to a total for the day. It measures this itself and reads nothing from your browser or device for it. Staff see these totals only added up across all accounts, never per account. We use the activity record to keep accounts secure, to give support and to understand how much TrackLode is used.

How you found us. When you create an account, we keep where you came from, so we can see which of our posts and pages bring people to TrackLode: the campaign name of the link you followed (such as utm_source=linkedin), the name of the website that linked to us (only its name, such as linkedin.com, never the address of the page), and your answer to the optional question on the sign-up form. While you read our public pages, these travel only inside the links on the page, never in a cookie or in your browser's storage. We look at them only as totals per source in our admin panel, never to profile you, and never for advertising. They're kept with your account and deleted with it, and they're in your data download.

Visitor statistics. On our public pages (home, pricing, contact, this policy and the Terms), and never inside the app, a small script from Cloudflare counts visits. It sets no cookies and stores nothing on your device, and Cloudflare gives us only totals, such as page views, referring sites, countries and browsers, never information about a single visitor. The script isn't loaded if your browser sends a Global Privacy Control or Do Not Track signal.

Rate limits. To slow down repeated sign-in attempts and to stop forms being flooded, the app keeps IP addresses in its memory for up to an hour (IPv6 addresses are shortened). They're never written to our logs or our database. Microsoft's infrastructure may log IP addresses for its own security and operation.

5. Why we use your data and our lawful bases

Our legitimate interests are keeping TrackLode secure and reliable, preventing fraud and abuse, understanding how TrackLode is used so that we can improve it, giving support, and protecting our legal rights. We've weighed these against your interests: the data involved is limited and not sensitive, it's the kind of use people expect from a work tool, and it stays within TrackLode. You can object (section 10).

Consent. We rely on consent only when you choose to load Spotify's player (section 12) and, through your browser's permission, for timer notifications. You can withdraw consent at any time, without affecting what happened before.

6. Who at TrackLode can see your data

A small number of authorised staff of WEBCOREX LTD can use our admin panel. It's a separate website that requires a staff account and a second sign-in step with an authenticator app. In it, staff can see:

• your account details: email address, display name, whether it's confirmed, role, status, failed sign-ins, when you joined and last signed in, whether Google sign-in is linked, and your plan and subscription status;
• how many clients, projects, time entries and invoices you have, but not what's in them;
• your recent sign-in events with your browser family;
• the names, first characters and dates of your access tokens, never the tokens themselves;
• your own mail server's address, user name and last error, never its password;
• whether your Focus timer link is on and whether a Spotify link is set;
• the emails the app has queued or sent for you, including to your clients: addresses, sender name, subject, attachment name and size, any error and, until it's delivered, the message itself (account emails, which can contain one-time links, are hidden);
• your ratings and comments, with your account id;
• your data requests;
• totals and statistics across all accounts, including the total time spent in the app (never per account), lists of the accounts with the most hours tracked, time entries or invoices (shown by account id), and totals from Application Insights.

From the panel, staff can also disable or re-enable your account, confirm your email address, change your display name, email address or role, sign you out, revoke your tokens, switch off your own mail server, retry or cancel emails, prepare a copy of your data for you, schedule or run a deletion, and switch features on or off for everyone. Every change made in the panel is recorded, with ids only. Simply viewing information isn't recorded.

Staff who manage our infrastructure can also reach the database with administrator credentials, which can read and change all data.

We access your data, including your content, only when we need to: to give support, to keep TrackLode secure, to meet a legal obligation, or because you ask us to.

7. Service providers and other recipients

We don't sell personal data and we don't share it for advertising. We share it only with the recipients below.

When you email an invoice, it's delivered to the addresses you enter. When you use Find online, the website you name receives a request from our server, not from your browser. We'll update this list before we add a provider that handles your clients' data, as our Data Processing Terms require.

8. International transfers

We store data in the European Economic Area (EEA): in Microsoft's data centres in the Netherlands, with backups in Ireland. UK adequacy regulations cover the EEA, so no extra safeguard is needed for this. For people in the EU, the European Commission has decided that the UK protects personal data adequately (the decision was renewed in December 2025 and runs to December 2031), so data can come to us in the UK.

Some of our providers process data in the United States (section 7). Where we transfer data there, we rely on the UK Extension to the EU-US Data Privacy Framework (and, for EU data, on the Framework itself) where the provider is certified. Otherwise we use the IDTA or the UK Addendum to the SCCs and, for EU data, the SCCs, after checking that the protection is not materially lower than UK law requires. Contact us if you'd like a copy of the safeguards.

9. How long we keep data

We keep personal data only for as long as we need it, and then delete it.

After a deletion, data stays in our backups until they're overwritten. We use backups only to recover the service, and if we ever restore one, we delete again the data that had been deleted.

10. Your rights

You have the right to:

• access your data and get a copy of it: download it under Account > Your data, or ask us for anything the download doesn't contain, such as what our logs hold about you;
• correct it: edit it in the app, or ask us to change the email address you sign in with;
• erase it: delete your account under Account > Your data (section 9 explains what remains afterwards);
• restrict our use of it, for example while we look into a complaint;
• object to our use of it based on legitimate interests, such as the activity record. We'll stop unless we have compelling grounds or need the data for legal claims;
• data portability: the download is in JSON, a common machine-readable format;
• withdraw consent where we rely on it; and
• not be subject to a decision based solely on automated processing that significantly affects you. We don't make any (section 15).

To use these rights, go to Account > Your data or email support@tracklode.com. It's free. We may ask you to confirm that the request comes from you, usually by replying from your account's email address. We'll answer within one month of receiving your request (or anything we need to identify you). If a request is complex, we may need up to two more months; if so, we'll tell you within the first month and explain why.

11. Complaints

To us. You can complain to us about how we use your personal data by email to support@tracklode.com or through the contact form at tracklode.com/contact. We'll acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome.

To a regulator. You don't have to complain to us first. In the UK, you can complain to the Information Commission (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint. In the EU, you can complain to the data protection authority in the country where you live or work, for example in Greece to the Hellenic Data Protection Authority (dpa.gr).

12. Cookies and similar technologies

TrackLode uses only the cookies and browser storage it needs to work, plus the things that happen only when you choose them. We don't use analytics, advertising or tracking cookies. Our server-side monitoring and the visitor statistics on our public pages (section 4) use no cookies and store nothing in your browser. That's why there's no cookie banner.

On tracklode.com and in the app (all set by TrackLode, so first party):

The pages of our public website (home, pricing, contact, this policy and the Terms) set none of these, except tl-theme if you switch between light and dark mode, and the antiforgery cookie when you send the contact form.

Information read from your browser, with nothing stored:

On the admin website (staff only):

Other companies (third parties):

• Spotify. Only if you press Load the player in the Music panel on the Focus page (on any plan, with a Spotify link saved), your browser loads Spotify's player from open.spotify.com. The panel tells you this before anything loads. Spotify then receives your IP address and browser details and may set its own cookies, including ones it uses for analytics. Nothing is loaded from Spotify otherwise. To stop, don't load the player, and delete Spotify's cookies in your browser. Spotify's cookie policy is on spotify.com.
• Stripe. Checkout and Manage subscription are Stripe's own pages. Stripe sets its own cookies there, including for fraud prevention, under its own cookie policy. We don't load any Stripe code on our pages.
• Cloudflare Web Analytics. Only on our public pages, your browser loads a small script from static.cloudflareinsights.com, which reports the visit to cloudflareinsights.com. It sets no cookies and stores nothing in your browser. It isn't loaded inside the app, or if your browser sends a Global Privacy Control or Do Not Track signal, and any content blocker can block it.
• Google sign-in. If you choose Continue with Google, you go to Google's pages, which set Google's own cookies.
• The browser extension stores a few items in your browser (section 13).

Your choices. You can delete cookies and site data in your browser settings, but you'll be signed out and your choices will be forgotten. UK law lets a site adapt to you in some ways as long as you're told and can object, free of charge. Reading your time zone is one such use: if you'd rather we didn't, set your time zone in Settings, and we won't need to read it from your browser. Counting visits to our public pages is another: to object, turn on Global Privacy Control or Do Not Track in your browser, and the counting script won't be loaded. Our fonts are served from our own server, so no font provider sees your visit. For anything else, contact us.

13. The browser extension

The TrackLode extension lets Pro users start and stop the timer and run Focus sessions from the browser toolbar. That's its single purpose.

What it stores in your browser:

What it sends. It sends data only to TrackLode at https://tracklode.com, over HTTPS, with your token in the request header and no cookies. It reads your timer and Focus status and your projects; starts and stops the timer, with the project and any note you add; starts, pauses, resumes, skips and stops Focus; and changes your Focus settings. Our server handles this data as the rest of this policy describes.

What it doesn't do. It doesn't read the pages you visit, your tabs or your browsing history. It has no analytics or advertising, contacts no other service and runs no code loaded from elsewhere.

Permissions. storage keeps the items above. alarms refreshes the status and times the notifications. notifications shows one notification when a Focus round or a break ends. It also asks for access to https://tracklode.com when you press Save or Test connection, and gives that access up when you remove the token.

Your control. Remove the token in the extension's settings, revoke it in TrackLode under Settings > Browser extension, or remove the extension, which deletes what it stored.

Limited Use. Our use of the information the extension handles complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use it only for the extension's single purpose. We never sell it or use it for advertising or credit decisions, and nobody reads it except as that policy allows.

14. If you're a client of a TrackLode user

If a freelancer or business uses TrackLode to keep your details, send you invoices or remind you to pay, they decide what to keep about you and why. They're the controller, and we process your data on their behalf. Please contact them first about your data. If you contact us, we'll pass your request on to them.

What we hold for them can include your name, billing email and postal address, VAT number, country, website and social profile links, logo, and the invoices and emails they send you. Emails sent from TrackLode's address show their business name followed by "via TrackLode", and replies go to them.

We use some of that data ourselves, as a controller, only for limited purposes: delivering emails and dealing with failed deliveries and abuse (we keep a delivery record for 90 days), keeping TrackLode secure, statistics that don't identify you, and complying with the law. Our lawful basis is legitimate interests. The rest of this policy, including your rights and how to complain, applies to that use. We don't contact you directly about it, because that would be disproportionate and you'll normally hear from the user.

15. Find online, AI and automated decisions

When a user presses Find online for a client, our server fetches the public web page they name (or the website of the domain in the client's billing email, unless it's a free email service), and up to four logo images, to suggest the client's website, logo and social links. The user sees the results and saves only what they choose. The website sees a request from our server.

If a page offers several possible logos or profiles, we may send TypeSafe AI, Inc. the website's host name, the page title and the candidate links,, if that service is switched on, with a fixed question asking which is the official one. We send nothing about the user or their account. TypeSafe's privacy policy says it doesn't train models on what it receives. Without TypeSafe, we use the first candidate.

TrackLode doesn't use your content or your clients' data to train AI models.

We don't make decisions based solely on automated processing that have legal or similarly significant effects on you. Automatic security measures, such as a 15-minute lockout after repeated failed sign-ins and rate limits, are temporary. Any decision to suspend or close an account is made by a person.

16. Emails we send

• Account and security emails: confirming your email address, password resets and changes, new access tokens, and your data requests. You always receive these.
• Plan and delivery emails: Pro started, payment failed, Pro ending, back on the Free plan, a Free limit reached, an invoice email that couldn't be delivered, problems with your own mail server, and one invitation to look at Pro about two weeks after you sign up (sent once, and only if you're still on the Free plan). They're about your plan and your account and may mention what Pro includes. You always receive these.
• A welcome email, once, when your account is ready.
• Optional emails that you switch on in Settings: a weekly list of overdue invoices, a weekly summary, and a reminder when a timer is left running. They're all off until you switch them on, and you can switch them off at any time.

We don't send newsletters or other marketing emails. If we start, we'll ask for your permission first or, where the law allows, give you a simple way to say no, and every such email will include a way to unsubscribe.

17. Security

We use technical and organisational measures that suit the risk, including:

• HTTPS only, with TLS 1.2 or higher;
• passwords stored only as one-way hashes, a minimum password length, and a lockout after repeated failed sign-ins;
• access tokens and confirmation links stored only as hashes, and your mail server password encrypted with keys protected in Azure Key Vault;
• private file storage, reached only through the managed identities of our own apps;
• limited staff access, with a second sign-in step, and a record of every change made in the admin panel;
• backups and monitoring.

Azure encrypts stored data by default. TrackLode doesn't yet offer two-step sign-in for user accounts. No system is completely secure. If a breach is likely to put your rights at risk, we'll tell the regulator and you as the law requires.

18. Children

TrackLode is for people aged 18 or over. It isn't designed for or aimed at children. If you think a child has created an account, tell us and we'll delete it.

19. Information for specific regions

European Union and EEA. The EU GDPR applies to our processing of data about people in the EU. Our EU representative is named in section 1. You can complain to the authority where you live or work (section 11).

Switzerland. You have similar rights under Swiss law, and you can complain to the Federal Data Protection and Information Commissioner (FDPIC).

United States. We don't sell or share personal information, as those terms are used in US state privacy laws, and we don't use it for targeted advertising. We don't track you across other websites, so our site doesn't respond differently to Do Not Track signals. You can ask to see or correct your information (section 10). If we make a material change to this policy, we'll tell you as section 20 describes.

Elsewhere. We apply this policy wherever you are. Contact us if you have questions.

20. Changes to this policy

We'll update this policy when the way we use personal data changes, show the date at the top, and send you an earlier version on request. If we make a significant change, we'll email you before it takes effect. If we want to use your data for a new purpose, we'll tell you before we start.