Privacy Policy

Who we are

This Privacy Policy applies to TrackSignal (https://www.gettracksignal.com), a profit intelligence application for Shopify brands. It describes how TrackSignal Inc. (“TrackSignal,” “we,” “us,” or “our”) collects, uses, stores, shares, and deletes information, including Google user data obtained through Google APIs.

TrackSignal connects Shopify store data and Google Ads account data, applies cost assumptions you provide, and presents profitability metrics such as Net Profit, Profit Margin, and True ROAS. Access to connected accounts is read-only analytics. TrackSignal does not create, pause, edit, or optimize advertising campaigns.

Account data

If you create a TrackSignal account, we store your email address and authentication data on our self-hosted servers. We use this information to sign you in, maintain your account, enforce plan limits, and send optional service-related email.

If you sign in with Google (Google Sign-In), Google provides your email address and, where available, your name so we can create or match your TrackSignal account. We do not receive or store your Google password. Google Sign-In is separate from the Google Ads connection described below.

Shopify commerce data

When you connect a Shopify store, we process order, revenue, refund, and related commerce data needed to calculate profitability metrics. Shopify access is read-only. We do not sell your store data.

Google user data we access and collect

When you connect Google Ads, TrackSignal uses OAuth 2.0 and the Google Ads API (scope: https://www.googleapis.com/auth/adwords), with offline access, to access Google user data for the Google Ads accounts you authorize. We access this data only after you grant consent on Google’s OAuth consent screen, and only for accounts you choose to connect.

The Google user data we access through the API includes:

We request only the permissions required to import this advertising data for profit analytics. We do not request permission to create, change, pause, or optimize campaigns.

How we use Google user data

We use Google user data solely to provide and improve TrackSignal’s user-facing profit intelligence features. In particular, we cross-analyze Google Ads performance data with Shopify order, refund, and revenue data, apply the cost assumptions you enter (such as product cost, shipping, and payment fees), and calculate advertising profit attribution, Net Profit, Profit Margin, and True ROAS for your account.

Google user data is not used to serve advertisements, to build independent advertising profiles, to train generalized or non-personalized artificial intelligence or machine learning models, or for any purpose other than the profit analysis features disclosed in this policy.

Sharing and transfer of Google user data

TrackSignal does not sell Google user data to third parties. We do not share, transfer, or disclose Google user data for advertising, marketing, credit reporting, or data-broker purposes.

Google user data is processed internally, on a secure basis, only as needed to provide TrackSignal’s core profit analysis service to you. Hosting and infrastructure providers that process data on our behalf (including application hosting and our Supabase database) may process Google user data solely to operate the service. They are not permitted to sell that data or use it for their own purposes.

We may disclose information if required by law, legal process, or to protect the security of TrackSignal or our users, and only to the extent legally required.

How we store and protect Google user data

In transit, communications between your browser, TrackSignal, Google, and our infrastructure are encrypted using HTTPS/TLS (SSL).

At rest, Google OAuth tokens are encrypted with application-level encryption before they are stored. Synced advertising metrics and related records are stored in our Supabase (PostgreSQL) database, which provides encryption at rest. Access is isolated with Row Level Security (RLS) so that one customer’s Google Ads data is not available to other customers. OAuth tokens are not exposed to the browser.

Personnel access to Google user data is limited to what is necessary to operate, secure, and support the service, and only in accordance with Google’s Limited Use requirements — for example, with your affirmative consent, to investigate a security issue or abuse, or as required by law.

Retention and deletion of Google user data

We retain Google authorization tokens and synced advertising data only while your Google Ads account remains connected and your TrackSignal account remains active, and only as needed to provide the service.

If you disconnect your Google Ads account from TrackSignal — including from Settings or Integrations — we securely delete the corresponding Google authorization tokens and the advertising history we synced from that account.

If you close or delete your TrackSignal account, we securely delete the Google authorization tokens and synced Google Ads historical data associated with your account. You may request account deletion, or deletion of associated Google user data, by contacting the support email listed on this page.

Payments

Purchases are processed by Paddle.com, the merchant of record. Paddle receives your payment details and billing address to charge you, calculate tax, and send receipts. We store subscription or purchase status and Paddle identifiers. We do not store card numbers. Paddle’s privacy policy applies to the payment data they collect.

Email and Telegram

Optional email notices may be sent with Resend. If you save a Telegram chat ID, we use it only to send product alerts through the Telegram Bot API to the chat you configure.

Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page is the latest version. If we change how we access, use, store, or share Google user data, we will update this policy. Where required, we will notify you and obtain consent before using Google user data in a new way or for a different purpose than originally disclosed.

Contact

These pages are published by TrackSignal Inc.. Use the email on your account, or set NEXT_PUBLIC_SUPPORT_EMAIL for a public contact address.