Privacy Policy

RemoveMyTracks is a privacy service. We collect only what we need to send deletion and opt-out requests on your behalf, prove those requests happened, and run your account. This page describes that, in plain language. It is not legal advice.

Operator: Remove My Tracks LLC, a Wyoming limited liability company, d/b/a RemoveMyTracks. Contact: privacy@removemytracks.com.

What we collect

  • Account email and password (password is stored by our auth provider, hashed, not readable by us).
  • If you join the waitlist, the email you give us. We use it only to tell you when accounts open.
  • Identity you give us: legal name, aliases, date of birth, phone, current and past addresses, past emails, family and employer names.
  • Optionally, a photo of your driver's license or state ID, plus the fields we extract from it. You can continue without uploading one.
  • Your signature and the Limited Power of Attorney PDF generated from it.
  • The companies we contact for you, the emails we send, and the replies we receive.
  • Optional: a breach-exposure report built from Have I Been Pwned for the emails you list. That is a published-breach lookup, not dark-web monitoring.
  • Billing identifiers if you subscribe (Stripe customer and subscription IDs). We do not store full card numbers.

Why we collect it

To act as your authorized agent: draft and send privacy requests, attach proof of authority, match vendor replies to the right request, show you what happened, and (if you pay) bill the correct plan. If you join the waitlist, to email you when accounts open. We do not sell your personal information. We do not use it for advertising.

Who sees it

  • Vendors we write to — the minimum identifiers needed to find your records. Data brokers receive an alias reply address, not your real email. Consumer companies receive your real email because that is how they look you up.
  • Supabase — database, login, and private file storage.
  • Vercel — hosts the app.
  • Postmark — sends and receives the request emails.
  • xAI — if you upload a license photo, reads it to pre-fill the form; classifies vendor replies; researches unknown companies and catalog pages. See How we use AI.
  • Have I Been Pwned — if you run a breach scan, we look up your emails in their breach corpus.
  • Stripe — they process payment.
  • NeverBounce — used on catalog emails (vendor inboxes), not on your personal inbox, when we verify that a privacy mailbox exists.

The full processor list is on Subprocessors.

How long we keep it

For as long as your account is open, because the service is ongoing removal and proof. A license photo, if you upload one, is also deleted from our systems within 30 days of upload (or sooner from Profile); name, date of birth, and address we already copied stay, because the letters use them. If you delete your account, we delete your profile, company list, email log, license photo, and signature files from our systems. Backups fall off on the host's normal cycle. Emails already sitting in a vendor's inbox cannot be unsent.

Your rights

You can view and edit what we have in Profile and Settings. You can export by asking privacy@removemytracks.com. You can delete your RemoveMyTracks account at any time from Delete my account — linked from the dashboard, Profile, and Settings. That removes our copy of your data. Depending on where you live, you may also have rights under CCPA/CPRA, other US state laws, GDPR, or UK GDPR. Email us and we will honor them. EEA and UK residents: see the section below.

EEA and UK residents

EU GDPR and UK GDPR apply separately. If you are in the European Economic Area or the United Kingdom, we process your account and identity data to perform the contract: send the privacy requests you hired us to send, keep the receipts, and run the account (Art. 6(1)(b) GDPR and the UK equivalent). A license photo is optional. If you upload one, that processing is consent (Art. 6(1)(a)), which you can refuse and still use the service.

We are in the United States. Processors listed on Subprocessorsmay store or access your data in the US. Transfers rely on each processor's published data-processing agreement and Standard Contractual Clauses. We have not signed a separate company SCC pack of our own.

You can ask us for access, erasure, or to stop processing. You can complain to an EU supervisory authority or, in the UK, the Information Commissioner's Office. Email privacy@removemytracks.com. We have not appointed an EU Article 27 representative. This product is not offered as a regular service in the EEA.

What we do not do

  • We do not sell your personal information.
  • We do not run Google Analytics, advertising pixels, or cross-site trackers.
  • Fonts are served from our site, not from Google.
  • We do not store your IP address for product metrics.

Product metrics (anonymous)

On public pages we record which path was viewed and which pricing button was tapped (Soft Ghost, Hard Block, Witness Protection, or free). That is how we know whether Hard Block is the one people actually click. The event has no name, email, account id, or IP. Logged-in dashboard and onboarding are not included. You cannot be opted out of this because it is not tied to you; we simply do not collect a handle to attach it to.

If we add a Google Search Console verification tag so the public pages can appear in search, that tag is a site-ownership check. It is not an advertising ID.

Your driver's license photo

It is optional. Some data brokers will not honor a deletion request without a copy of a government ID. If you decline, we still send letters with the name, address, date of birth, and signed authorization on your profile. If a vendor later asks for a photo of your ID, that stays in Need you for you to handle or ignore. We do not attach the image to outbound letters and we do not upload it to a vendor portal for you.

If you upload one, it lives in a private bucket. Grok reads it once to pre-fill the form. We delete our copy within 30 days of upload, or sooner if you delete it from Profile. Name, date of birth, and address we already copied stay, because the letters use them. Deleting the image does not unsend a letter already delivered. xAI may keep the extract API payload up to 30 days for abuse audit, then delete it.

Children

This service is for adults age 18 and older, as stated in our Terms of Service. We do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13, we will delete it.

Security

Data is stored with row-level access so one customer cannot read another's records. License photos and signatures live in private buckets. Processors encrypt in transit (TLS) and at rest (AES-256 or the equivalent they publish). That is not end-to-end encryption: they decrypt what they need to run the job. Postmark says they keep email bodies readable on their servers. Details and source links are on Subprocessors. We still cannot promise perfect security; no one can. If we learn of a breach that affects you, we will notify you.

Changes

If this policy changes in a way that matters, we will update the date above and, for material changes, email the address on your account.