Privacy Policy

Who we are

Trackody (Private) Limited provides affiliate tracking software under the name Trackody. Customers use it to run their own tracking panels, and in doing so they decide what data is collected through their links. For that data they are the controller and we are the processor; for their own account with us, we are the controller.

Data we hold about our customers

Account details you give us: name, email address, timezone, and login credentials. Passwords are stored hashed and are never readable by us. We also keep a record of sign-in sessions, including IP address, approximate location, browser and device, so account owners can review access to their panel.

Data processed through tracking links

When someone follows a tracking link created by one of our customers, we record the information needed to attribute and report on that click. This includes the IP address, user agent, referring URL, approximate country, region and city derived from the IP, device and browser type, and any parameters the customer chose to pass. Conversions reported back by a customer's advertiser are stored against the originating click.

We do not sell this data, use it to build profiles of individuals, or use it for any purpose other than providing the service to the customer who collected it.

Cookies

We use cookies that are necessary for the service to work: a session cookie to keep you signed in, and a token cookie if you choose to stay signed in. We do not use advertising or analytics cookies on this website.

Third parties we share data with

We use a small number of providers to deliver the service. Each receives only what it needs:

• MaxMind — IP geolocation, performed locally from a downloaded GeoLite2 database.
• IP Geolocation by DB-IP — a second local database (CC BY 4.0), consulted when GeoLite2 cannot place an address.
• ipinfo.io — country lookup, used only when neither local database can resolve an address.
• proxycheck.io — proxy and VPN detection, where a customer has enabled it.
• Cloudflare — DNS and traffic delivery for tracking domains.

Connecting your Cloudflare account

If you connect a Cloudflare account so that domains can be set up for you, we store the authorization Cloudflare issues, encrypted, and use it only to create the DNS records and zone settings needed for your domains. We request the narrowest permissions that allow this and never receive your Cloudflare password. You can revoke our access at any time from your own Cloudflare dashboard, and disconnecting in your panel removes what we hold.

How long we keep data

Click and conversion data is retained for as long as the customer's panel is active, because it is the basis of their reporting. Account data is kept while the account exists. When a panel is closed, its data is deleted on request.

Security

Traffic to the service is encrypted in transit. Passwords are hashed, and credentials for connected third-party accounts are encrypted at rest with a key held separately from the database. Access to production systems is limited to those who need it.

Your rights

You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. If your request concerns data collected through a customer's tracking links, we will pass it to that customer, since the data is theirs and they decide what happens to it.

Changes

If this policy changes materially we will update the date at the top of this page and, where the change affects you, tell you directly.

Contact

Questions about this policy or your data: [email protected].