Privacy Policy

Tracklane ("the service") is operated by FahmiTJ Enterprise (202603128060 (TR0342591-T)) ("we", "us", "our"), a business in Malaysia. For anything in this policy, write to support@tracklane.my.

We are the data user (as the Personal Data Protection Act 2010 of Malaysia puts it) for your account details. For the content that you and your teammates put into a workspace (tasks, comments, files), the workspace is yours: we hold it on your behalf and use it only to run the service.

Account details. Your name, username, email address and a password. We never store your password itself, only a one-way hash made by our sign-in library.

Workspace content. Everything you or your teammates add to a workspace: projects, tasks and their details, comments, uploaded files, recurring rules, settings and the activity log that records who changed what and when.

Membership and access records. Which workspaces you belong to, your role in each, invitations you sent or received, and the API tokens and connector approvals you created. API tokens are stored as hashes; we cannot read them back.

Sign-in and technical records. When you sign in we keep a session record with the time, your IP address and your browser's user agent text. Our hosting provider keeps request logs (address, time, path, status). When a connector such as Claude fails to connect, we log the technical reason (an error code and the public client identifier), never a token, code, password or email address.

Email. We send the messages needed to run your account: email verification, password reset, workspace invitations and, if you asked for an invite, the link to set your password.

Feedback. If you send us feedback through the form on our updates page, we keep what you write and, if you give them, your name and email address, so we can read it, reply to you and plan our work. To stop the form being misused we also keep a code made from your internet address for 30 days; it cannot be turned back into the address. The form also uses a Cloudflare security check (Turnstile) to stop spam. We may show a short, edited version of your idea on our public roadmap, but never your name or email address. We keep feedback until it is no longer useful, and you can ask us to delete it at any time.

Invite requests. If you request an invite through the form on our site, we keep your name, your email address and, if you give them, your company or team, your role and how you plan to use Tracklane. We use them to decide on access, to create your account and workspace, and to email you a link to set your password. We also email ourselves a copy of each request. We keep the request while we decide. Once we approve it, your account holds your details and we delete the request 30 days later; we delete a declined request 90 days after we decline it. To limit abuse we keep a code made from your internet address, and we delete it after 30 days; it cannot be turned back into the address. The form also uses a Cloudflare security check (Turnstile) to stop spam. You can ask us to delete your request at any time.

We do not collect payment details (the service has no billing at the moment), and we do not run advertising trackers.

• to create and secure your account, sign you in, and keep your workspaces separate from everyone else's;
• to run the features you use: showing and updating tasks, searching, recurring tasks, exporting, notifications and email;
• to keep the service safe and working: abuse prevention, rate limits, debugging and fixing faults;
• to answer your requests and to meet legal obligations.

We do not sell your personal data and we do not use workspace content for advertising or to train AI models.

By creating an account or using the service you agree to this policy. If you invite someone, you are responsible for having a reason to share their email address with us. You can withdraw consent at any time by closing your account (section 9), but we may then be unable to provide the service.

We use a small number of providers (processors) to run the service. They handle data on our instructions.

We may disclose information if the law requires it, to protect people's safety, or in a sale or restructuring of the business (you would be told). We share workspace content with other members of the same workspace as their role allows; that is the purpose of the service.

You can let Claude, or another tool that supports connectors, act for you in the workspaces you choose. When you approve a connector you tick the workspaces it may use; it can then read and change those workspaces' data through Tracklane as you, within your role in each. You can change those workspaces or remove the connector at any time in Settings, which takes effect straight away. What the tool does with the data is then governed by that tool's own terms and privacy policy (for Claude, Anthropic's), not by this one. An API token likewise acts as you in the workspaces you choose, and you can change those workspaces or revoke it in Settings.

Our database is stored in Singapore and our files on Cloudflare R2 (Asia-Pacific). Our other providers operate globally, so your data may pass through or be processed in other countries. We choose providers that protect personal data and we keep transfers to what the service needs.

• Workspace content stays until a workspace owner deletes the workspace. Deleting removes access immediately; we permanently remove the data after 30 days, and during those 30 days the person who deleted it can restore it.
• Account details stay while your account is open.
• Session records and technical logs are kept for a limited time that we set for security and fault finding.
• Backups roll off on the provider's schedule.

A workspace owner can export the workspace data as a file at any time (uploaded file contents are not part of that export).

You may ask us to give you a copy of the personal data we hold about you, to correct it, to limit how we use it, or to close your account and delete it. Write to support@tracklane.my from the email address on the account. We aim to reply within 21 days. Some things we can do ourselves in Settings: edit your profile, leave a workspace, remove a connector, revoke tokens.

If workspace content is shared with a team, deleting your account does not remove content that belongs to the workspace, such as tasks and comments, though we will remove your name from it where we reasonably can.

If you are not satisfied with our answer you may complain to the Personal Data Protection Commissioner of Malaysia.

Each workspace's data is separated from others by the application and by row-level security in the database. Passwords and tokens are stored as hashes, traffic is encrypted in transit, and access to our systems is limited. No system is perfectly secure; if a breach affects your personal data we will tell you and the authorities as the law requires.

We use a session cookie to keep you signed in and a small browser setting to remember your light or dark theme. We do not use advertising or cross-site tracking cookies.

The service is not for anyone under 18. We do not knowingly collect their data; if you think we have, tell us and we will delete it.

This policy is written in English. We will provide a Bahasa Malaysia version on request.

When we change this policy we will update the date at the top and, for significant changes, tell you in the app or by email before they take effect.

FahmiTJ Enterprise (202603128060 (TR0342591-T))
support@tracklane.my