Your data, plainly stated

1. What we collect

When you sign in with Google, we use your Google account only to verify that you are a real person. We immediately discard your name and email address and store nothing from your Google account except an opaque internal identifier that lets you sign back in. Your Google password, contacts, Drive files, and everything else in your Google account are never requested or received.

Your account is identified by a nickname you choose. That nickname is the only name associated with you anywhere in our system.

We will never email you or contact you in any way. We have no mailing list and no reason to reach you, so we don’t ask for an email address or any other way to get in touch. There is simply no contact information of yours for us to hold.

Beyond that, we store only what you choose to add: the applications you create, the milestone dates and notes you save, and any visa-office or complexity details you enter. If you claim a row in the community tracker, we link your account to that row.

What you track stays private to you by default. If you choose to share an application with the community, only its milestone dates, stream, visa office, and applied-from country are published, and they are shown fully anonymously, never tied to your nickname or anything that identifies you. You can turn sharing off, or delete the application, at any time and the shared copy disappears immediately.

Cloudflare’s edge network tells us an approximate country when you visit (for example, “CA” if you are connecting from Canada). We use this to understand where our users are coming from in aggregate. We do not log or store your IP address.

2. What we never collect

This is intentional. The app works entirely on milestone dates and application categories. Official identifiers are not needed and are not welcome here. If you find a field that seems to invite that kind of information, please let us know via the contact page.

3. No analytics, no advertising, no third-party trackers

Track Your App runs no analytics platform, no advertising network, and no third-party trackers. There is no Google Analytics, no Meta Pixel, no Hotjar, and no similar service embedded on these pages.

We use only the cookies needed to sign you in and keep you signed in: a session cookie, plus the standard security cookies the Google sign-in flow sets while it verifies the handshake. We set no analytics, advertising, or tracking cookies of any kind, and if you never sign in, you can browse the whole site without a login cookie.

4. How your data is stored and who can access it

All data is stored in Cloudflare D1, a SQLite-based database that runs on Cloudflare's global infrastructure. Traffic to and from the site is encrypted in transit over HTTPS. Data at rest is protected by Cloudflare's standard infrastructure-level controls.

Your data is isolated by your internal user identifier. Every query that touches your records is scoped to your account in code. No other signed-in user can read your milestones or applications.

Access to the production database is limited to the project maintainers. We do not sell, rent, share, or otherwise disclose your data to any third party for commercial purposes.

5. The community tracker and sheet writeback

The application draws from the community IRCC PR Master Tracker, a public Google Sheet maintained by and for Express Entry applicants. If you claim your row in that tracker and update your milestone dates or add a visa office, those changes write back to the public Sheet via a service account we operate.

We write only the fields you edit: milestone dates, complexity, and visa office. We never write your nickname or any other account detail back to the Sheet. Because the Sheet is public, anything visible there is visible to anyone who reads it. If you claim a row, only do so for a row that is already yours.

6. Who else is involved

Three services touch this application:

• Google handles sign-in. We request only the scopes needed to verify your identity: openid and a basic profile scope. We do not store the name or email your account provides. We have no ability to read, modify, or delete anything in your Google account.
• Cloudflare hosts the application and the database. Traffic passes through Cloudflare's network. Cloudflare's privacy policy governs what it retains at the network layer.
• IRCC and Statistics Canada supply public datasets (draw history, processing times, invited-candidate demographics) that we display. Those are open government data. No personal information flows between us and those sources.

7. Your controls

You have three controls available at any time:

• Download your data. Use the Download my data button in your profile to get a JSON file with everything we have stored for your account.
• Delete an application. From your hub card, you can delete any individual application. This removes the application, its milestones, and any associated notes from our database. It does not affect your row in the community tracker.
• Delete your account. You can delete your entire account from your profile settings. This removes your profile, all your applications and milestones, and your sign-in record from our database. What stays: your row in the community Google Sheet, if you contributed one. That row belongs to the community, not to us, and we do not own or control it.

8. Safety and breach notice

We take reasonable steps to protect the data we hold. Because we do not store email addresses, we cannot send email notifications in the event of an incident. If a security incident affects user data, we will post a notice on the site promptly and act to contain and understand the incident.

To report a privacy or security concern, email admin@trackyourapp.ca with “Security” in the subject line.

9. Questions or concerns

If you have a question about this policy, want to exercise any of your data controls, or have spotted something that does not look right, please reach us via the contact page.

Last updated: 7 July 2026.