Privacy Policy

1. Who we are

TrackMyI140 ("we", "us", "our") is a tracking dashboard for USCIS I-140 immigration cases. The service is an independent project operated by the TrackMyI140 team. You can reach us at [email protected].

2. What we collect

When you create an account, we collect:

• Email address — to identify your account and send case updates.
• Name — to address you in emails.
• Password (hashed with bcrypt; we never store it in plain text) — for accounts created with email/password.
• Google profile info (name, email, profile picture) — only if you sign in with Google.
• USCIS receipt numbers you register — to fetch status updates from USCIS on your behalf.

We do not collect Social Security Numbers, A-numbers, passport details, or any other immigration document information beyond the receipt number you choose to register.

3. How we use it

• To check the status of your registered USCIS cases by querying the public USCIS case status system.
• To send you the weekly progress email (you can opt out anytime in your profile).
• To send you alerts when the status of your case changes (you can opt out anytime in your profile).
• To improve the service (aggregated, anonymous usage stats).

We do not sell, rent, or trade your personal data to third parties.

4. Third parties we share with

• Google — only if you choose Google sign-in (OAuth). Google receives sign-in confirmations but not your case data.
• USCIS — public case status lookups on your behalf for the receipt numbers you registered.
• Email delivery provider — to send transactional and weekly emails.
• Hosting providers — Hetzner (Germany, frontend) and our private server (Quito, backend).

5. Cookies and tracking

We use a session token stored in your browser to keep you signed in. We may add anonymized analytics (such as Google Analytics 4) to understand traffic patterns. We do not use advertising cookies.

6. Data retention & deletion

We keep your account and registered cases for as long as your account is active. You can delete your account at any time in two ways:

• Self-service: sign in, go to your profile page, scroll to "Danger zone", and click "Delete my account". The deletion is immediate.
• By email: send a request to [email protected] from the email address you registered with. We process these within 30 days.

Deletion removes your profile, tracked cases, email history, and waitlist entries. Aggregate analytics events are anonymised (disconnected from your identity, kept only as counts). The underlying USCIS case records remain in our database as public data, with no link back to you.

7. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data (see section 6).
• Unsubscribe from emails at any time (link in every email + toggle in profile).
• Export your data (CSV format, on request).

To exercise the rights that don't have a self-service path on the site, email [email protected].

8. Security

Passwords are stored hashed using bcrypt. Communication between your browser and our servers is encrypted via HTTPS. Backups are encrypted and access to production data is restricted to the project operator. No system is 100% secure; in the unlikely event of a breach we will notify affected users by email within 72 hours.

9. Children

This service is not intended for users under 18 years old. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy. Material changes will be communicated by email at least 14 days before they take effect. The "Last updated" date at the top of this page will always reflect the current version.

11. Contact

Questions about this policy: [email protected]