Privacy Policy

Last updated October 1, 2026

This policy explains what information Track Our Projects (“we”, “us”) collects, why, who else handles it, and the choices you have. We collect only what we need to run the service, and we don't sell your information or use it for advertising.

What we collect

• Account details: your name, email address, and password (stored only in a scrambled, one-way form we can't read). Optionally, a mailing address for your invoices.
• What you and your organization enter: the organization's name and billing address, projects, time entries and their notes (with a history of changes to them), tasks, status reports, invoices and their expenses (including any receipt files you upload), hourly rates, teams, and invitations to teammates.
• Sign-in and security records: when sign-in attempts happen, whether they succeeded, and the IP address and browser they came from. We use these to protect accounts and block password-guessing, and an organization's administrators can see them for their own users. If you turn on two-factor sign-in, we store what's needed to check your codes.
• Billing: which plan your organization is on and its status. Card details go directly to Stripe, our payment processor; we never see or store your full card number.
• Paying invoices through the service (if your organization uses it): a team member who sets up payouts gives their identity and bank details directly to Stripe; we keep only a reference to their Stripe account and whether it can receive payments. An organization's bank account details likewise go directly to Stripe. We keep a record of each payment: which invoice, who started it, the amount and fee, and whether it went through.
• Contact form and signup: what you send us through the contact form (name, email, organization, phone, team size, message), and the IP address of signup and contact submissions, used to stop spam.

Cookies

We use only the cookies the service needs to work: one that keeps you signed in, and, if you choose “Trust this device” at two-factor sign-in, one that remembers that choice for 30 days. We don't use analytics, advertising or tracking cookies, and we don't load third-party scripts.

How we use it

To provide the service: showing you and your organization its data, producing invoices and reports, sending the emails the service depends on (sign-in codes, password resets, invitations, submitted reports and invoices, trial and billing notices), keeping accounts secure, processing payments, and answering you when you contact us.

Who can see it

• Your organization: administrators of your organization can see its members' time, reports, invoices and sign-in records. Team leads can view their teammates' invoices.
• Service providers that handle data for us to run the service:
  • Hostinger — hosts the service and its database, and sends its email.
  • Stripe — processes payments, including payments of team members' invoices.
  • Amazon Web Services — stores encrypted daily backups of the database.
  These providers are in the United States, and your information is stored there.
• When the law requires it, or to protect the service and its users from fraud or abuse.

How long we keep it

• While your organization's account is open, we keep its data so you can use it.
• When an organization is closed, all of its data is permanently deleted 30 days later. Signups whose email address is never confirmed are deleted after 30 days.
• Backups roll off after 90 days, so deleted data disappears from them within that time.
• Stripe keeps its own payment records as financial law requires.

Your choices

• Update your name and address from your account menu (“Update account info”).
• An organization's administrators can download all of its data at any time, and can close the organization to have everything deleted.
• If you belong to an organization, it controls the data in it: ask its administrator first. You can also email us at support@trackourprojects.com to see, correct or delete information about you, and we'll help within the limits of what your organization needs to keep.

Security

The service is only available over an encrypted connection (HTTPS). Passwords are stored in a one-way scrambled form, two-factor sign-in is available to everyone and required for administrators, and repeated failed sign-ins are blocked. No system is perfectly secure, but we work to protect your information and will notify affected customers promptly if a breach affects their data.

Children

The service isn't meant for anyone under 16, and we don't knowingly collect information from children.

Changes to this policy

If we change this policy in a significant way, we'll email organization administrators before the change takes effect and update the date at the top.

Contact

Questions about privacy: support@trackourprojects.com, or use our contact form.