TrackCanary legal
Privacy Policy
Last updated: 1 October 2026
TrackCanary is being incorporated as a joint-stock company (anonim şirket) in Türkiye. The trade name, MERSİS number, trade registry details and registered address will be published on our legal pages as soon as registration is complete. Until then, requests about these documents or your personal data can be sent to contact@trackcanary.com.
This Privacy Policy explains how TrackCanary (“we”, “us”) processes personal data when you visit trackcanary.com, run a free scan, watch a website, create an account or contact us, and how you can exercise your rights.
If you are in Türkiye, our KVKK Information Notice (in Turkish) also applies and prevails for processing governed by Turkish law.
1. Who is responsible for your data
The data controller is TrackCanary (joint-stock company in formation in Türkiye), the company that operates TrackCanary.
- Company
- TrackCanary (joint-stock company in formation in Türkiye)
- contact@trackcanary.com
- Website
- https://trackcanary.com
We are not required to appoint a data protection officer. Privacy questions are handled directly by our team at contact@trackcanary.com.
2. What this policy covers
This policy covers personal data we process for our own purposes as a controller. It does not cover personal data we process on behalf of customers who install our optional snippet on their own websites; for that processing we act as a processor under our Data Processing Addendum, and the customer's privacy notice applies (see section 6).
3. What we collect, why, and on which legal basis
| Activity | Personal data | Purpose | Legal basis (GDPR / KVKK) |
|---|---|---|---|
| Free scans and public reports | The URL you submit and the scan results. Your IP address is used only in a short-lived, in-memory counter to limit abuse and is not stored with the scan. | Running the check you asked for, generating a shareable report, preventing abuse | Legitimate interests, Art. 6(1)(f) GDPR / KVKK Art. 5(2)(f) |
| Watching a website (alerts and digests) | Email address, watched website and selected signals, alert and digest history, unsubscribe tokens | Monitoring the signals you chose and emailing you alerts and periodic digests | Performance of a contract, Art. 6(1)(b) / KVKK Art. 5(2)(c) |
| Account and sign-in | Email address; optional password stored only as a bcrypt hash; one-time sign-in codes stored hashed and valid for 10 minutes; session tokens stored hashed; last sign-in time | Creating and securing your account and letting you manage watched websites | Performance of a contract / KVKK Art. 5(2)(c); security: legitimate interests / KVKK Art. 5(2)(f) |
| Early access, founding price and pilot requests | Email address, website and where you signed up; for pilot requests also your role, number of managed sites, main concern and our follow-up notes | Answering your request, reserving founding pricing and telling you about the launch | Steps taken at your request before a contract, Art. 6(1)(b) / KVKK Art. 5(2)(c); marketing emails only with your consent, Art. 6(1)(a) |
| Paid plans (when available) | Billing contact and company details, plan, invoices and payment status. Card details are entered on our payment provider's page and never reach our servers. | Billing, invoicing, accounting and fraud prevention | Performance of a contract and legal obligations, Art. 6(1)(b)–(c) / KVKK Art. 5(2)(c) and (ç) |
| Support and communication | Your messages and contact details | Answering questions and handling requests and complaints | Performance of a contract and legitimate interests / KVKK Art. 5(2)(c) and (f) |
| Website analytics (optional) | Pages viewed, referrer, approximate location, device and browser data, collected with Google Analytics 4 cookies | Understanding how our website is used and improving it | Consent, Art. 6(1)(a) / KVKK explicit consent, Art. 5(1) |
| Server logs and security | IP address, user-agent string, requested address, timestamps and error details | Keeping the service secure and reliable and investigating abuse | Legitimate interests / KVKK Art. 5(2)(f) |
You need to give us your email address to watch a website, create an account or join early access; without it we cannot provide these features. Everything else on the website can be used without giving us personal data.
4. Data on the pages we scan
When you run a scan or watch a website, our servers load the publicly accessible pages of that website the way a regular browser would. Those pages can contain personal data, for example a phone number in a WhatsApp link or an email address in a contact link. We use what we find only to report which tracking and lead signals appear on the page. Public results and shareable reports mask identifiers such as phone numbers, email addresses, WhatsApp targets, click IDs and query strings. We do not log in, we do not access restricted areas, and we do not build profiles of the people who run or visit those websites.
Our legal basis is our legitimate interest in providing a tracking-quality tool (Art. 6(1)(f) GDPR). Because we cannot reasonably identify or contact the people concerned, we provide this information through this policy (Art. 14(5)(b) GDPR). You can object at any time by writing to us.
5. What we do not do
- We do not sell or rent personal data.
- We do not use your data for advertising and do not allow advertising networks to track you on our website.
- We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
- We do not knowingly collect special categories of personal data (sensitive data).
6. The optional TrackCanary snippet on customer websites
Customers can install an optional JavaScript snippet on their own websites to record lead actions such as WhatsApp, phone and email link clicks, important button clicks and form submissions. For this data the customer is the controller and we are the processor acting on the customer's documented instructions under our Data Processing Addendum.
The snippet records the page address and the referring page without query strings or fragments, the page title, campaign (UTM) parameters, the type of action, a short description of the clicked element, a random session identifier kept in the browser's session storage, the browser's user-agent string and the time of the event. It never records what visitors type into forms, skips forms that contain password or payment-card fields, redacts text that looks like an email address or a card number, and by default does not run for visitors who have enabled Do Not Track.
If you visited a website that uses TrackCanary and have questions about your data, please contact that website's owner; we will help them respond.
7. Who we share data with
We share personal data only with service providers that process it on our behalf under contract, and only as far as needed:
| Provider | Service | Location |
|---|---|---|
| Railway Corporation | Application hosting and database | United States |
| Resend | Delivery of service emails (sign-in codes, alerts, digests) | United States |
| Google (Google Ireland Ltd. / Google LLC) | Website analytics, only if you accept analytics cookies | Ireland / United States |
| Paratika | Payment processing, only when you buy a paid plan | Türkiye |
We may also disclose data to public authorities when the law requires it, to our professional advisers under a duty of confidentiality, or to a successor if our business is reorganised or sold, in which case this policy continues to protect your data.
8. International transfers
Some of our service providers are located outside Türkiye and, for many users, outside their own country, mainly in the United States. We protect these transfers as follows:
- From the EEA, the UK and Switzerland: the provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where available, otherwise the European Commission's Standard Contractual Clauses with the UK Addendum, together with supplementary measures where needed.
- From Türkiye: the appropriate safeguards provided in Article 9 of Law No. 6698 on the Protection of Personal Data (KVKK), in particular the standard contracts published by the Personal Data Protection Board, which are notified to the Authority as required.
- From other countries, such as Saudi Arabia: the safeguards required by the applicable law.
You can ask for more information about these safeguards at contact@trackcanary.com.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account is active; deleted within 30 days after you ask us to close it, unless the law requires us to keep it longer |
| Watch subscriptions and monitoring history | While the watch is active; inactive watches are deleted 12 months after they end. We keep a minimal record of unsubscribes so that we can respect your choice |
| One-time sign-in codes and sessions | Deleted automatically shortly after they expire |
| Scan results and public reports | Up to 24 months |
| Early-access, founding-price and pilot requests | Until you withdraw or ask us to delete them, and no longer than 24 months after our last interaction |
| Events recorded by the snippet on customer websites | 13 months, or shorter if the customer instructs us |
| Server logs and security records | Up to 30 days |
| Invoices and accounting records (paid plans) | 10 years, as required by Turkish commercial and tax law |
| Support correspondence | Up to 24 months after the request is closed |
When a retention period ends, the data is deleted or irreversibly anonymised.
10. Security
We use encryption in transit (HTTPS), store passwords and access tokens only as cryptographic hashes, restrict administrative access, rate-limit public endpoints, isolate our scanner from internal networks, and minimise and mask personal data in what we store and display. No method is perfectly secure; if a breach affecting your data occurs, we will notify you and the competent authorities where the law requires.
11. Your rights
Depending on where you live, you have the right to be informed about and access your personal data, to have it corrected or deleted, to restrict or object to its processing (including objecting at any time to direct marketing), to receive it in a portable format, to withdraw consent at any time without affecting earlier processing, and not to be subject to decisions based solely on automated processing.
- EEA and UK: you may also lodge a complaint with a data protection authority, for example the Agencia Española de Protección de Datos (aepd.es) in Spain or the Information Commissioner's Office (ico.org.uk) in the UK.
- Türkiye: your rights under Article 11 KVKK and how to apply are described in our KVKK Information Notice. After applying to us, you may complain to the Personal Data Protection Board.
- Saudi Arabia: under the Personal Data Protection Law you may request information about, access to, a copy of, correction of or destruction of your data, and may complain to the Saudi Data & AI Authority (SDAIA).
- Other countries: we honour the rights granted by your local law.
To exercise your rights, email contact@trackcanary.com from the address linked to your data. We may ask you to confirm your identity. We respond within one month under the GDPR and within 30 days under KVKK, free of charge unless a request is manifestly unfounded or excessive.
12. Emails we send
Service emails (sign-in codes, watch confirmations, alerts and digests) are part of the service you requested and do not require marketing consent; you can stop watch emails at any time with the one-click unsubscribe link in each email. We send news and offers only with your consent or where the law allows it for existing customers, and every such email includes an unsubscribe link.
13. Cookies
We use strictly necessary cookies and similar technologies to run the website and, only with your consent, Google Analytics cookies. If you choose “Essential only”, Google Analytics is not loaded. Details and how to change your choice are in our Cookie Policy.
14. Children
TrackCanary is a business tool and is not intended for anyone under 18. We do not knowingly collect children's data.
15. Changes to this policy
We may update this policy when our services or the law change. We will publish the new version here with a new date and, if the changes are significant, notify registered users by email.
16. Contact
Questions and requests: contact@trackcanary.com.