Privacy Policy — TrackJet

Effective: 13 May 2026. Version 1.

1. Who we are #

TrackJet is a free B2B logistics tracking router operated by Trackjet. Our service is reached at https://trackjet.world. For privacy questions: [email protected]. Postal: Bürgeler Straße 25, Frankfurt am Main, Deutschland.

2. What we collect #

Information you provide

Tracking numbers you paste into the search input. We hash these with a daily-rotating salt and never store the original.
Optional notes on shipments saved via the "my TrackJet" feature. These live ONLY in your browser localStorage; we never receive or store them.

Information collected automatically

Country only — read from Cloudflare's CF-IPCountry edge header. We do not store your raw IP address.
Device category (mobile / desktop / tablet / bot) — never the full User-Agent string.
Referrer domain (e.g. "google.com") — never the full referring URL.
Anonymous session id — a 16-char hash derived server-side from your connection metadata + a daily-rotating salt. Mathematically uncorrelatable across days. Used only for aggregate funnel + bounce-rate analytics.

When you sign in (account data)

Public tracking needs no account. If you create one, we additionally process the following — only to provide the features you use, under GDPR Art. 6(1)(b) (contract):

Account: your email address and an Argon2id hash of your password (never the plaintext), your locale and notification preferences.
Account security (optional, only if you turn it on): for two-factor authentication we store your authenticator secret and SHA-256 hashes of your single-use backup codes; for a passkey we store its public-key credential only (the private key never leaves your device); for browser push we store the subscription your browser issues. Turning a feature off deletes its data.
Saved shipments: tracking numbers and optional nicknames you save to your account, stored on our EU servers so we can refresh status and send alerts.
Email alerts: a log of which status changes we emailed you, for delivery and one-click unsubscribe.
Mail-in tracking: the metadata of carrier status emails you forward to your personal TrackJet address (sender, subject, parsed events) — not your mailbox.
Shared links: the token and the Privacy-Lens field choices for any shipment you share; revoking a link stops it resolving.
API keys: a one-way hash of each key (never the secret) plus usage counters.
Webhooks: the endpoint URL you register and delivery logs (status, retries).
Passport exports: generated on demand from data you already hold; we keep no separate copy.
Support messages: the content of emails you send us and our replies.

Information we do NOT collect

Your name or email if you neither create an account nor write to us
Your raw IP address
Your full User-Agent string
Cross-site cookies for tracking

Art. 6(1)(f) — legitimate interests: running the tracking router and improving it via aggregate analytics. No individual profiling.
ePrivacy Art. 5(3) — strictly necessary: localStorage for "my TrackJet" — used only because you actively saved a shipment.

You have the right to access, rectify, erase, restrict, object, and port any personal data we hold about you, and to lodge a complaint with a supervisory authority. Note: tracking-number hashes are non-reversible after 24 h. Email [email protected].

5. Cookies and localStorage #

We use ONE strictly-necessary cookie (tj_csrf) for form-submission security. No tracking cookies. localStorage is used only for features you actively enable: "my TrackJet" saved shipments and dark-mode preference. Clear localStorage anytime via your browser settings or via "Clear all" inside /my/shipments.

6. Third parties #

Cloudflare (CDN + security): processes connection metadata for performance and bot protection.
Google AdSense (advertising): TrackJet uses Google AdSense to show ads that keep the free tracker free. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites. Google advertising cookies (such as the DoubleClick cookie, set from the doubleclick.net domain) enable Google and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. On TrackJet these advertising cookies are consent-gated: they are only set after you accept them in the cookie banner. You can opt out of personalised advertising at Google Ads Settings, and opt out of the advertising cookies of some other third-party vendors at www.aboutads.info. Seat: USA — transfer safeguarded by the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC).

Carriers and licensed feeds: when you track a shipment, the tracking number and your query may be transmitted to the carrier's official tracking surface or to a licensed live-event feed (for example DHL UTAPI) so we can route you or build a source-labelled timeline. The carrier then processes that data under its own privacy policy. TrackJet never fabricates carrier events.

Data processing agreement (DPA): business customers acting as controllers can request a GDPR Art. 28 data processing agreement. During early access this is available on request at [email protected]; a standard DPA will be offered when business accounts go live.

7. Retention #

Data category	Retention period
Tracking-number hashes	365 days, then aggregated and deleted.
Anonymous session ids	30 days, then aggregated.
Aggregated statistics	indefinite (no individual data).
Account data (email, preferences)	while your account is active; deleted within 30 days of account deletion.
Saved shipments and their events	while saved; shipment events are purged on a rolling 30-day cycle and when you delete the shipment or your account.
Email-alert logs and webhook delivery logs	90 days.
Mail-in email metadata	parsed into shipment events, then the raw metadata is discarded within 30 days.
API-key hashes	until you revoke the key; usage counters 90 days.
Shared-link tokens	until you revoke them.
Support messages	up to 2 years, to handle follow-ups and legal claims.

8. International transfers #

Servers in Germany (Frankfurt). Data does not leave the EU under normal operation.

9. Children #

This service is not directed to children under 16. We do not knowingly collect data from minors.

10. Changes #

Material changes are announced via the "Effective" date at the top of this page and a 30-day banner on this URL.