Your numbers are yours.

The short version

• We measure how the product is used, with PostHog. Its servers are in the United States, it sets no cookies, and both its code and the events it records travel through our own domain rather than to posthog.com directly — so your browser never opens a connection to it. The data still reaches PostHog, at us.i.posthog.com, and is held there; the proxy changes the route, not the destination. There is no tracking pixel and no advertising code. Two other third-party scripts exist: Paddle’s checkout, which loads from cdn.paddle.com on the billing screen and on the subscribe screen, and Shopify’s App Bridge, which loads from cdn.shopify.com only on the screen embedded inside the Shopify admin.
• We collect what running the product requires: your email address, and the workspace data you enter.
• Every workspace is isolated from every other one — in the application code and again in the database.
• Your data exports to CSV whenever you want, and you can ask us to delete it.

What we collect

• Your account. An email address and a password when you sign up, plus a display name if you give one. Passwords are handled by Supabase Auth, which stores them hashed — Trackost never stores your password and cannot read it.
• Your workspace data. The materials, recipes, products, purchases, production batches, orders, costs and reports you enter or import, and the orders we sync from a sales channel you connect. That is the product — without it there is nothing to cost.
• Your teammates. If you invite someone, we store the email address you invited and the role you gave them.
• How you use the product. Named events — you signed up, you answered the setup questions, you added a material, you saved a recipe, you finished a batch, you connected a shop, you asked us to move your data across, you opened a tax report — plus a few about the subscription itself: it started, it ended, or a payment failed. Then page views, and any JavaScript error your browser hits. Once you are signed in these are labelled with a user id, a random identifier we already store — yours for the things you do, and the workspace owner’s for the ones your payment provider reports to us while you are not here; the ones your browser sends also note which language you chose for Trackost. On the public pages you are not signed in and nothing is tied to you at all. Two of those events also carry the answers you gave — never anything you wrote in prose: from the setup questions, the band you chose for team size and for monthly orders, how long you have been going, what you used before us, and whether you work in batches or make to order, each one picked from a fixed list of options and never what you typed into “what do you make?”. From the move-my-data form, which tool you are coming from and the two rough counts you typed as numbers — never the notes you wrote in it. Never your email, never your name, never a money figure: a subscription event carries which plan and billing period, never an amount. No location, no device fingerprint and no advertising identifier.

What we don’t do

• One analytics vendor, named. PostHog, and only PostHog — not Google Analytics, not Plausible, not Segment, not Vercel Analytics, and no advertising network. It is configured to record the events we chose and nothing more: automatic click capture is off, so there is no profile of everything you clicked, only the named steps listed above. PostHog holds this data on servers in the United States, so if you are outside the US your usage data leaves your country.
• No tracking pixels, and two third-party scripts. Every script a page loads is served from our own domain and is part of the application itself — with two exceptions. The billing screen and the subscribe screen load Paddle’s checkout script from cdn.paddle.com, which is there to take your payment, not to watch you. If Paddle already has you as a customer, those two screens also tell Paddle which customer you are, so it can recover a failed payment — that identifier is the customer reference Paddle itself issued us, never your email and never anything you have typed into Trackost. The subscribe screen appears over the app when a trial or a subscription has lapsed, so on a lapsed account that script can load on whichever page you opened; teammates without billing access see that screen without any plan options, so the script never loads for them. And the Trackost screen embedded inside the Shopify admin loads Shopify’s App Bridge script from cdn.shopify.com — Shopify requires it of every app that renders inside its admin, and it appears only on that embedded screen, never on the pages you browse here. Nothing is fetched from an advertiser or an analytics vendor except PostHog, whose code we serve from our own domain rather than loading from theirs. The first-party scripts include the one line that reads the hint cookie described below, which decides whether the header says “Sign in” or “Open dashboard”. Web fonts are served from our own domain too, so apart from those two a page load fetches nothing from anyone else.
• Session recordings, with every input masked. When you are signed in, PostHog may record a playback of your session so we can see where the product confuses people. Everything you type is masked before it leaves your browser — the recording shows the shape of the page and where you moved and clicked, not the contents of your fields. Recordings are never made on the public pages, only inside the app once you have signed in.
• What our own domain carries to PostHog, stated plainly. Because those requests go to trackost.com first and we pass them on, the cookies your browser attaches to any request to us — including your session cookie — are forwarded along with them. PostHog has no use for it and does not read it, but we would rather say so than let “served from our own domain” sound like more than it is.
• No mailing list. The address you type into a “Start free trial” form goes no further than the sign-up step. It is not added to a mailing list — Trackost doesn’t run one.
• No selling, no sharing, no ad networks. Your costs, margins, suppliers and customers are never sold, rented, or handed to an advertiser. They are the whole reason you’d trust a costing tool.

Where it lives, and who can reach it

• Account-scoped, twice over. Every query the application makes carries your account id, and the database enforces the same rule independently with Postgres row-level security: a session belonging to one workspace cannot read another workspace’s rows even if the application asked it to.
• Your team. People you invite see the workspace you invited them to, at the role you gave them — and a member can be seated without permission to see money figures at all.
• Our infrastructure. Trackost is hosted on Vercel, and its database, authentication and file storage run on Supabase. Paddle handles checkout and subscriptions as merchant of record. If you connect a sales channel, that channel — Shopify, Etsy or Faire — sends order data to your workspace, and only because you connected it. What Trackost takes from each, and what it deliberately does not, is set out below. PostHog receives the usage events and session recordings described above, on servers in the United States. Vercel, Supabase, Paddle, PostHog and the channel you chose: that is the complete list of companies that touch this data on our behalf. There is no email marketing service.
• Us. We look at your workspace data when you ask us to — a support question, or the free white-glove migration where you send us your old exports and we load them for you.

Connected sales channels

• What we import. When you connect a shop, Trackost reads its orders: order number and dates, financial and fulfillment status, totals and currency, the per-transaction fees the channel charged you, and the line items — product title, SKU, quantity and price. Those are the numbers a true-cost figure is built from, and they are the reason the connection exists.
• What we do not import. Your buyers’ personal details. From Shopify, Trackost’s order query asks for no customer record, no name, no email address, no phone number and no shipping or billing address — it does not request them, so they are never sent and never stored. Imported orders are free of buyer personal data by construction rather than by filtering it out afterwards.
• Etsy is different, and we say so plainly. Etsy has no way to ask for an order without its buyer details: every receipt Etsy returns carries the buyer’s name, postal address and, sometimes, their email address, whether we want them or not. Trackost reads none of those fields and stores none of them. The code that turns an Etsy receipt into an order never touches a buyer field, so nothing from that part of the payload reaches your workspace or our database — the payload is discarded once the numbers above have been read out of it.
• How far back, and how often. The first sync of a newly connected Etsy shop reaches back ninety days, so a new workspace starts with recent history rather than nothing. After that, Etsy tells us when an order is paid, shipped or cancelled, and we also check about once an hour in case one of those messages went missing. Nothing is fetched on a schedule for a shop you have disconnected.
• What we use it for. Computing the cost and profit of what you made and sold, for you, inside your workspace. Nothing from a connected shop is used to build a profile, is sold, or is shared with anyone outside the list of companies named above.
• Fees can arrive late, and we go back for them. Etsy does not settle a sale’s card-processing fee until the order ships, so an order imported the day it is placed can be missing that one figure. We re-read the fees on orders that shipped in the last couple of days and correct them in place — no new order, no duplicate. One consequence is worth stating: an order that had already shipped before you connected the shop may never get its card-processing fee, because the fee is only ever fetched for orders we saw ship. Its other fees are still there.
• The shop’s access key. Connecting a shop gives Trackost an access token. It is encrypted before it is stored, with a key held outside the database, and it travels only over encrypted connections — as does everything else between you, us and the channel.
• Disconnecting, and uninstalling. Disconnect a shop and Trackost revokes its access token and destroys its copy immediately; new orders stop arriving. If you uninstall the app from Shopify instead, Shopify tells us, and about two days later we erase the stored key and the raw payloads we received. Your own order, cost and profit history stays — those are your business records, they hold no buyer personal data, and deleting them would take your accounts with them. Ask us and we will remove those too.
• Disconnecting an Etsy shop, precisely. Etsy gives us no way to hand a key back, so we tell you exactly what happens instead of implying more. Disconnecting destroys our copy of the key here and stops every sync, and the key we destroyed stops working on Etsy’s side within the hour; the longer-lived half that could have renewed it expires within ninety days if nothing renews it, and nothing will. If you would rather cut it off at the source, you can withdraw Trackost’s access yourself at etsy.com/your/apps — that takes effect immediately and needs nothing from us.
• Faire is different too, in the same way. A Faire order is a wholesale order, so what arrives with it is a shop’s details rather than a shopper’s: every order Faire returns carries the retailer’s ship-to address and phone number, the contact person’s first and last name, any free-text notes they left with the order, a purchase-order number and, sometimes, the name of your own sales rep. Faire’s interface offers no way to ask for an order without them. Trackost reads none of those fields and stores none of them — the code that turns a Faire order into an order in your workspace never touches one, so nothing from that part of the payload reaches your workspace or our database. One thing is simply absent on Faire’s side: there is no email address anywhere in what it sends us. We also never ask Faire for the packing slip, which is the one place a retailer’s address would be handed over as a document.
• How Faire orders arrive, and what keeps changing. Faire sends no notifications of any kind, so nothing can tell us the moment an order appears — we check about once an hour instead, and once a day we go back over the orders Faire has not paid you for yet. The first sync of a newly connected brand reaches back ninety days. Faire’s own fee figures on an order stay provisional until it pays the brand out, so we keep refreshing them until it does, correcting them in place — no new order, no duplicate. That re-checking is bounded, and we would rather say so than imply it runs for ever: the daily pass stops asking about an order once it is about four months old, and an order Faire still has not paid out by then is a conversation to have with us rather than something we keep polling. One limit worth stating plainly: an order in a currency other than your workspace’s is skipped rather than imported, because Trackost keeps one currency per workspace and importing it would show the wrong money. Nothing is fetched on a schedule for a brand you have disconnected.
• Disconnecting a Faire brand, precisely. Faire does give us a way to hand the key back, so unlike Etsy the sentence above is one we can actually act on here: disconnecting asks Faire to revoke the token, and destroys our copy immediately either way. Faire either confirms the revoke or it does not — if it does not, we tell you so on the screen rather than claim a revoke we did not get, and our copy of the key is gone regardless. New orders stop arriving the moment you disconnect. Faire never tells us if you remove Trackost at its end, so if you would rather cut it off at the source you can do that yourself under Integrations → My Integrations in your Faire brand portal — that takes effect immediately and needs nothing from us.

Cookies

Six from Trackost, and this is the complete list. Analytics adds none: PostHog is configured to keep its identifier in your browser’s local storage instead, so there is no analytics cookie to consent to and none to refuse.

• Session cookies. Set by Supabase Auth when you sign in. They are what keeps you signed in from one page to the next; without them the app cannot work.
• tk-remember — the “Remember me” opt-out. Written only when you untick “Remember me” on the sign-in form. It records that choice so your sign-in ends when the browser closes, and it lasts exactly as long as that browser session — close the browser and it is gone. Ticking the box again (or signing out) removes it.
• tk-signed-in — a cosmetic hint. It holds the single value 1, is readable by the page (not http-only), and is used for exactly one thing: deciding whether the button in the marketing header reads “Sign in” or “Open dashboard”. It grants no access to anything — the session cookies above are the only thing that does.
• tk-etsy-pkce — the Etsy connection handshake. Written only at the moment you click “Connect Etsy”, and deleted the moment Etsy sends you back. It lasts ten minutes, it is readable only by our server (never by the page), and it is limited to the two Etsy connection addresses rather than the whole site. It holds one random one-time value that proves the reply came from the connection you started — it is not an identifier, it says nothing about you, and it is useless once that connection finishes.
• sidebar_state — the sidebar toggle. It holds true or false and records whether you last collapsed the app’s sidebar. Your browser writes it the moment you collapse or expand it — never on page load, never on a phone — and it expires after seven days. It carries no personal data and no identifier. Nothing in Trackost reads it back today: it comes with the sidebar component the app is built on, and it is listed here because a complete list is the only kind worth printing.
• tk-locale — your language choice. It holds en or de and records which language you chose for Trackost. It is set when you pick a language or sign in, never on page load, and it lasts one year. It is readable by the page’s own script (not http-only), like the sign-in hint above. It carries no identifier and grants no access to anything.

Trackost sets no advertising cookies, no analytics cookies and no cross-site trackers. Paddle’s checkout script, on the two screens named above, is a third party and may set storage of its own that we do not control and cannot enumerate here — Paddle’s own privacy notice covers it. Nothing Trackost itself sets requires consent.

Payments

Trackost does not process card payments itself. Checkout runs on Paddle, which acts as merchant of record: card details are entered on Paddle’s checkout and never reach Trackost’s servers. All we keep against your account is Paddle’s customer and subscription reference ids, so we can show you the plan you are on and cancel it when you ask. The free trial takes no card at all.

Exporting and deleting your data

• Export, any time. Your reports export to CSV from inside the app — materials, products, orders, purchases, profit and loss and the rest. No request, no queue, no “contact sales”.
• Deletion, on request. Email us from the address on the account and we will delete the workspace and the data in it. Say what you want removed; if it is the whole workspace, say so plainly.
• Cancelling is not deleting. Ending a subscription does not erase anything by itself — your data stays exportable, and nothing is held hostage.