Privacy Policy — DeedTracker
Last Updated: June 7, 2026 Effective Date: June 7, 2026
1. Overview
DeedTracker ("we," "our," "us") is operated by Emikra LLC, a Delaware limited liability company. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our AI-assisted career management platform (the "Service").
We take your privacy seriously. DeedTracker handles sensitive career data — your accomplishments, work history, and job applications. This policy is designed to be transparent about what we do, and more importantly, what we don't do with your data.
Key principles:
- You own your data. We process it to provide the Service, nothing more.
- We do not sell your personal data.
- We do not use your career data to train AI models without your explicit opt-in.
- AI processing requires your explicit consent — you can use the Service without AI features.
- All AI processing goes through providers with zero data retention policies.
- We minimize third-party data sharing and require Data Processing Agreements with all subprocessors.
2. Data We Collect
2.1 Account Data
| Data | Purpose | Required? |
|---|---|---|
| Email address | Account identification, login, communications | Yes |
| Name (as provided) | Profile display, personalization | Yes |
| Authentication credentials | Account security — we do not store passwords or credentials. Authentication is handled entirely by Hanko Cloud; DeedTracker never sees or stores your password. Only a JWT session token is stored client-side. | Yes |
| Account tier (Free/Pro) | Service provisioning, feature access | Automatic |
2.2 Profile & Career Data
| Data | Purpose |
|---|---|
| Work history (employers, titles, dates) | Deed management, resume generation |
| Education history | Resume and profile building |
| Skills, certifications, awards | Career profile, ATS optimization |
| Professional accomplishments ("deeds") | Core Service functionality — tracking, summarizing, and leveraging achievements |
| Job application tracking (positions, statuses, notes, dates) | Application management |
2.3 Uploaded Documents
| Data | Purpose |
|---|---|
| Resumes/CVs (uploaded for parsing) | AI-powered extraction of structured career data |
| Cover letters (generated or uploaded) | Application materials |
| Other user-uploaded documents | As directed by you |
2.4 AI Processing Data
When you use AI features (and you have provided explicit consent):
| Data | Processing |
|---|---|
| Prompts you enter for AI generation | Sent to Fireworks AI for processing; exists only in volatile memory during the request |
| Uploaded documents (resumes, etc.) | Sent to Fireworks AI for parsing/generation; zero persistent retention |
| AI-generated outputs | Returned to you; we store the output for your account |
Important: All AI processing goes through Fireworks AI (fireworks.ai) running the DeepSeek-V4-Flash model. Fireworks AI maintains:
- Zero data retention — prompts and content exist only in volatile memory during processing; never logged to persistent storage.
- No training on API data — your data is not used to train, fine-tune, or improve AI models.
- SOC 2 Type II certified — independently audited security controls.
- Data Processing Agreement (DPA) — we maintain an executed DPA (v3.0) with Fireworks AI.
- US-based servers — all processing occurs on US infrastructure (multiple US-based locations).
- Encryption at rest (AES-256) and in transit (TLS 1.3) — data is protected throughout processing.
See: Fireworks AI Data Handling | Fireworks AI Privacy Policy | Fireworks AI Terms
2.5 Payment Data
We do not store full credit card numbers, CVV codes, or complete payment card details. Payments are processed entirely through Stripe. We store only:
- A payment token/reference (used by Stripe to identify your payment method)
- Billing metadata (plan type, subscription status, last 4 digits of card, expiration date)
- Transaction history (amounts, dates, invoice references)
Stripe's use of your payment data is governed by Stripe's Privacy Policy.
2.6 Usage & Technical Data
| Data | Purpose |
|---|---|
| Browser type, operating system, device type | Compatibility, debugging |
| Pages visited, features used, interactions | Product improvement (future) |
| IP address | Security, rate limiting, fraud prevention |
| Log data (timestamps, error logs) | Debugging, security monitoring |
| Referrer URL | Understanding traffic sources |
Analytics: We do not currently use any analytics tools — no Google Analytics, PostHog, Plausible, or similar. We may implement privacy-focused analytics in the future, and will update this policy before doing so.
2.7 Cookies & Similar Technologies
See Section 9 (Cookie Policy) for a complete breakdown.
3. How We Use Your Data
| Purpose | Data Categories Used | Legal Basis (where applicable) |
|---|---|---|
| Provide the Service — account management, deed storage, resume generation, job tracking | All categories | Contractual necessity / Performance of contract |
| AI-powered content generation — resume drafting, cover letter generation, deed summarization, resume parsing | Profile data, prompts, uploaded documents | Explicit consent (collected at registration and re-confirmed in-app) |
| Process payments and manage subscriptions | Payment data, account data | Contractual necessity |
| Improve the Service — analyze usage patterns, fix bugs, develop new features | Usage data (anonymized/aggregated where feasible) | Legitimate interest |
| Communicate with you — product updates, service announcements, support responses | Email, account data | Legitimate interest (service-related); Consent (marketing, if applicable) |
| Security & fraud prevention — detect and prevent unauthorized access, abuse, fraud | IP address, usage data, account data | Legitimate interest |
| Legal compliance — respond to legal process, enforce ToS, meet regulatory obligations | Any category as legally required | Legal obligation |
What We Do NOT Do
- We do not sell your personal data — not to data brokers, not to advertisers, not to anyone.
- We do not use your career data to train AI models — unless you explicitly opt in to such use (currently, we do not offer this option).
- We do not share your data with employers, recruiters, or job platforms without your explicit direction and consent.
- We do not use dark patterns or engagement bait — you are in control of your data and your experience.
- We do not process your data for AI-generated content without your explicit, affirmative consent.
4. AI Processing & Your Consent
DeedTracker's AI features are opt-in by design. Here's how consent works:
4.1 How We Obtain Consent
- At registration: A separate, unchecked-by-default checkbox: "I consent to DeedTracker sending my deeds, profile data, and prompts to Fireworks AI for AI processing. Fireworks AI operates with zero data retention and does not train on my data. I understand that AI-generated content should be reviewed and verified before use."
- In-app before each AI generation: In the apply wizard and job detail flows, a clear consent notice is displayed with an explicit action required to proceed.
4.2 Your Control
- You may withdraw consent at any time in your Account Settings.
- If consent is withdrawn, AI generation features (resume generation, cover letter generation, deed summarization) become unavailable.
- All other features remain fully functional — manual content creation, editing, deed management, job tracking, and data export.
- You may re-enable consent at any time.
4.3 What You Should Know About AI Outputs
- AI-generated content is a draft, not a final product. Always review and verify.
- AI may produce errors, omissions, or "hallucinations" — facts, figures, or phrasings that are incorrect.
- AI may reflect biases present in training data.
- You are responsible for the content you submit to employers or job platforms.
- See our AI Disclosure & Transparency Statement for full details.
5. Third-Party Services & Data Sharing
We work with the following third-party service providers. We share only the data necessary for each to perform its function and require Data Processing Agreements (DPAs) or equivalent contractual protections.
| Provider | Function | Data Shared | Location | DPA/Protections |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing | Payment token, billing metadata | US | Stripe DPA; PCI-DSS Level 1 |
| Fireworks AI | AI text generation (DeepSeek-V4-Flash) | Prompts, resume text, deeds | US (multiple locations) | Fireworks DPA v3.0; SOC 2 Type II; zero data retention; AES-256 encryption |
| Hanko Cloud | Authentication (email/password, passkeys, OAuth, WebAuthn) | Email only (we receive JWT tokens, never passwords) | EU (Hanko Cloud — Germany) | Hanko DPA; GDPR-compliant; ISO 27001 certified; 2FA available |
| Neon, Inc. | PostgreSQL database (serverless) | All stored user data | Europe | Encryption at rest (managed by Neon); Neon DPA in place |
| Cloudflare, Inc. | File storage (R2 — resumes, cover letters, documents) | Uploaded files | US/Global (CDN) | Cloudflare Customer DPA; encryption at rest |
| Dokploy (self-managed) | API hosting (VPS) | All data in transit | Europe (Hetzner VPS) | Self-managed infrastructure |
We may update this list as our infrastructure evolves. Material changes to subprocessors will be communicated as described in Section 13.
5.1 No Sale of Data
We do not sell, rent, or trade your personal data to any third party for monetary or other consideration, as those terms are defined under applicable law (including the CCPA).
5.2 Disclosure Required by Law
We may disclose your data if we reasonably believe it is necessary to:
- Comply with a valid legal process (subpoena, court order, warrant).
- Enforce our Terms of Service.
- Protect the rights, property, or safety of DeedTracker, our users, or the public.
- Detect, prevent, or address fraud, security, or technical issues.
6. Data Retention & Deletion
6.1 Active Accounts
Your data is retained for as long as your account remains active. You may edit or delete individual data items at any time through the Service.
6.2 Account Deletion
When you delete your account via the "Delete Account" option in Settings, your personal data is removed from our active PostgreSQL database immediately and permanently. You may also use "Delete All My Data" to remove your data without deleting your account.
- What is deleted: All your deeds, resumes, cover letters, profile data, job applications, and uploaded documents are removed from the database immediately.
- Recovery window: There is no recovery window. Deleted data cannot be restored through the Service. However, deleted data may persist in automated database backups (managed by Neon) for up to 7 days (Neon's point-in-time recovery on production tier; 6 hours on the free tier) before being permanently purged from backups.
6.3 Exceptions — What We Retain
We may retain certain data for up to 30 days after account deletion to allow for dispute resolution, fraud investigation, or as required by law. The following data may be retained beyond account deletion:
- Payment records: Transaction records required for tax, accounting, and legal compliance. These do not include your career data or uploaded documents.
- Anonymized/aggregated data: Usage data that cannot identify you individually.
- Legal holds: Data subject to a valid legal hold or preservation order.
6.4 Data Export
You can export your data at any time in a machine-readable format (JSON export of deeds, profile data, and job applications). This feature is available in Account Settings.
7. Data Security
We implement and maintain reasonable technical, administrative, and physical safeguards designed to protect your data, including:
7.1 Technical Measures
- Encryption in transit: All communications between your browser and our servers use TLS (HTTPS).
- Encryption at rest: Our PostgreSQL database (Neon) and file storage (Cloudflare R2) both provide encryption at rest, managed by the respective providers. Application-level encryption for specific PII fields is not currently implemented; however, DeedTracker does not collect highly sensitive identifiers such as Social Security Numbers, driver's license numbers, or credit card numbers. The non-sensitive identifiers we do capture (name, email, work history) are used solely for resume/cover letter generation.
- Authentication security: Passwords are handled entirely by Hanko Cloud (never stored in our database). JWTs are verified server-side using JWKS from Hanko's
.well-known/jwks.jsonendpoint. Sessions use httpOnly, secure, SameSite=lax cookies. Hanko supports passkeys (WebAuthn), OAuth (Google, GitHub), and two-factor authentication (2FA). - Principle of least privilege: Access to production systems and user data is restricted to personnel who need it for their function.
- Dependency updates: Dependency updates are currently managed through a manual review process. Automated dependency update checking in CI is planned for future implementation.
7.2 Organizational Measures
- Subprocessors are vetted for security practices and required to sign Data Processing Agreements.
- We maintain an incident response plan (see below).
- Security practices are regularly reviewed and updated.
7.3 Breach Notification
In the event of a data breach involving your personal data, we will notify affected users and relevant regulatory authorities as required by applicable law, without undue delay.
7.4 No System Is 100% Secure
Despite our efforts, no security measures are perfect. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials.
8. International Data Transfers
8.1 Data Location
DeedTracker's infrastructure spans multiple regions:
- API server: Hetzner VPS (Europe), managed via Dokploy
- Database: Neon PostgreSQL (serverless, Europe region)
- File storage: Cloudflare R2 (global CDN, US/Global)
- Authentication: Hanko Cloud (EU — Germany)
- AI processing: Fireworks AI (US — multiple locations)
If you access the Service from outside these locations, your data will be transferred to and processed in these regions, which may have data protection laws that differ from those in your country of residence.
8.2 EEA, UK, and Switzerland Users
For users in the European Economic Area (EEA), the United Kingdom, and Switzerland:
- We transfer personal data to the US based on Standard Contractual Clauses (SCCs) incorporated into our Data Processing Agreements with subprocessors, or other lawful transfer mechanisms recognized under applicable data protection law.
- The US has been deemed to provide an "adequate" level of data protection under the EU-US Data Privacy Framework (DPF). Where our subprocessors participate in the DPF, we may rely on that framework as an alternative transfer mechanism.
8.3 Your Consent
By using DeedTracker, you acknowledge and consent to the transfer and processing of your data as described in this policy.
9. Cookie Policy
9.1 What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work efficiently and provide information to site operators.
9.2 Cookies We Use
| Cookie | Type | Purpose | Duration | Essential? |
|---|---|---|---|---|
hanko | Authentication | JWT auth session (set by Hanko Cloud, httpOnly, secure, SameSite=lax) | Session | Yes |
9.3 Cookies We Do NOT Use
We do not use:
- Third-party advertising cookies
- Tracking pixels for ad retargeting or behavioral advertising
- Browser fingerprinting or cross-site tracking
- Social media tracking cookies
- Analytics cookies or tracking scripts (no analytics tools are currently in use)
9.4 Your Cookie Choices
Most web browsers allow you to control cookies through browser settings. You can:
- Delete all cookies from your browser.
- Block all cookies by default.
- Set your browser to notify you when a cookie is being set.
However, disabling essential cookies (including the hanko auth cookie) will prevent you from logging into and using DeedTracker. Since we do not use non-essential cookies, there is no cookie consent banner — the only cookies we set are strictly necessary for the Service to function.
10. Your Rights (by Jurisdiction)
10.1 All Users (Universal Rights)
Regardless of your location, you have the right to:
- Access your data — view and export your data at any time.
- Correct your data — edit your profile, deeds, and other content.
- Delete your data — delete individual items or your entire account.
- Withdraw consent — for AI processing, at any time.
To exercise any of these rights, use the self-service features in your account settings or contact us at privacy@deedtracker.com.
10.2 California Residents (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights:
| Right | How to Exercise |
|---|---|
| Right to Know — Request information about the categories and specific pieces of personal data we collect, use, and disclose | Contact us at privacy@deedtracker.com or through account export |
| Right to Delete — Request deletion of your personal data | Delete your account, or contact us |
| Right to Correct — Request correction of inaccurate personal data | Edit data in your account, or contact us |
| Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights | Self-enforcing — we treat all users equally |
| Right to Opt-Out of Sale/Sharing — We do not sell your personal data, so no opt-out is necessary | See Section 5.1 |
| Right to Limit Use of Sensitive Personal Data — We only use sensitive data for providing the Service | Consent-based |
Categories of personal data collected in the last 12 months: Identifiers (email, name), commercial information (subscription tier, payment history), internet activity (usage data), professional/employment information (deeds, work history), and inferences drawn from the above (AI-generated content). See Section 2 for details.
We have not "sold" or "shared" (as defined by CCPA) personal data in the preceding 12 months.
You may designate an authorized agent to make a request on your behalf. We will verify your identity before processing requests, typically by confirming your email address. We will respond to verifiable requests within 45 days as required by law.
10.3 EEA, UK, and Switzerland Residents (GDPR / UK GDPR)
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) grants you the following rights:
| Right | How to Exercise |
|---|---|
| Right of Access (Art. 15) — Obtain confirmation of processing and a copy of your data | Account export or contact us |
| Right to Rectification (Art. 16) — Have inaccurate data corrected | Edit in account or contact us |
| Right to Erasure (Art. 17) — "Right to be forgotten" | Delete account or contact us |
| Right to Restrict Processing (Art. 18) — Limit how we process your data | Contact us |
| Right to Data Portability (Art. 20) — Receive data in a structured, machine-readable format | Account export (JSON) |
| Right to Object (Art. 21) — Object to processing based on legitimate interests | Contact us; we will assess and respond |
| Right to Withdraw Consent (Art. 7(3)) — Withdraw consent at any time | Account Settings toggle |
Legal bases for processing (see Section 3):
- Contractual necessity: Providing the core Service.
- Explicit consent: AI processing of your data.
- Legitimate interest: Service improvement, security, communications (balanced against your rights).
- Legal obligation: Tax records, legal compliance.
To exercise any GDPR right, contact us at privacy@deedtracker.com. We will respond within one month (extendable by two additional months for complex requests, with notification). We may request proof of identity to verify your request.
You also have the right to lodge a complaint with your local data protection supervisory authority.
Note for EU/UK users: We do not currently have a designated EU/UK Representative as required by Article 27 GDPR, as we do not actively target or monitor EU/UK users at scale. This will be reassessed if our EU/UK user base grows significantly.
10.4 Other US State Privacy Laws
Residents of Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws have rights similar to those described in the CCPA section above. We extend the same rights to all US users regardless of state of residence.
11. Children's Privacy
DeedTracker is not intended for individuals under the age of 16. We do not knowingly collect, use, or disclose personal data from children under 16. If we learn that we have collected personal data from a child under 16 without verified parental consent, we will delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at privacy@deedtracker.com.
12. Third-Party Links
The Service may contain links to third-party websites, job boards, or services. This Privacy Policy does not apply to those third parties. We are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you interact with.
13. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will:
- Notify you via email (to the address associated with your account) and/or through a prominent in-app notice.
- Provide at least 30 days' notice before material changes take effect.
- Indicate the "Last Updated" date at the top of this policy.
If you do not agree with the updated policy, you must stop using the Service and delete your account before the changes take effect. Continued use after the effective date constitutes your acceptance of the updated policy.
Non-material changes (typo corrections, clarifying language, formatting) may take effect immediately upon posting.
14. Contact Us
Data Controller: Emikra LLC
Address: 1571 Sumneytown Pike, Lansdale, PA 19446
Email: privacy@deedtracker.com
Website: https://emikra.com
For all privacy-related inquiries, data subject requests, or concerns about our data practices, please contact us at the email above. We aim to respond within 5 business days.
This privacy policy has been reviewed and finalized in consultation with DeedTracker's founder. As with all legal documents, we recommend review by qualified legal counsel before publication.