Security at Tap Track
Tap Track handles your spending, so we keep the design simple: you forward bank alerts, we read them, and we keep as little as we can.
Tap Track hasn't launched yet. Items marked Before launch are being built and will be in place before anyone signs up. Items markedIn place are already true today.
Forwarding only, no inbox access
We never see your inbox In place
Tap Track never asks to sign in to your email account and has no Gmail access. We only receive the bank emails your filter forwards.
A private address for each user Before launch
Each person forwards to their own unguessable address. You can replace it at any time, and the old one stops working.
Only real bank email is accepted Before launch
Forwarded alerts are checked for a valid DKIM signature from the bank's own domain. Anything else is held for you to review, never added automatically.
Encryption
In transit Before launch
The site and app are served over HTTPS only.
At rest Before launch
Your data is stored on Cloudflare (D1 databases and R2 storage), which encrypts it at rest. Backups are encrypted too.
Keys and secrets In place
Service keys are kept encrypted and are never stored in plain text or in code.
Keeping as little as possible
Transaction alerts only Before launch
Bank marketing and statement emails that match your filter are deleted on arrival.
Minimal text sent to AI Before launch
When a merchant needs AI to categorise it, we send only the cleaned merchant name or the minimum text needed, not your name or the full email.
No personal data in logs Before launch
Logs record a hashed user id only: no amounts, merchants or email addresses.
No ads, no selling data, no trackers In place
This site has no third-party trackers or ads, and we never sell your data.
How long we keep data Before launch
| Data | Kept for |
|---|---|
| Raw bank alert emails | 90 days, then deleted |
| Business receipts and records | At least until 31 December of the financial year plus 5 years, as IRAS requires, while your account exists |
| Logs | 30 days |
| Backups | Age out within 35 days |
| Deleted accounts | Purged, including stored files |
The full details will be in our privacy policy. The companies that process data for us are listed on the sub-processors page.
Your rights under the PDPA
Singapore's Personal Data Protection Act (PDPA) gives you the right to ask what personal data we hold about you and how it has been used, to correct it, and to withdraw your consent. If you withdraw consent, we stop collecting and using your data, which may mean we can no longer provide the service.
- Export your data as CSV and delete your account from Settings in the appBefore launch
- Or email privacy@tracklah.io. Our Data Protection Officer's details will be published here before launch.
Report a vulnerability
If you find a security problem, emailsecurity@tracklah.io with the steps to reproduce it. Please don't access other people's data, run denial-of-service tests or publish the issue before we have fixed it. We will acknowledge your report and keep you updated until it is fixed. Our security.txt has the same contact.