Your data

Privacy, in plain language.

Last updated October 24, 2026

PumpkinTrack organizes order emails, purchase history, and shipment updates. This page explains the information the service handles and the controls available to you.

Account and device information

The service stores your account identifier, email address, authentication records, and connection settings. Password accounts use salted password hashes with a server-side secret; the service does not retain your plaintext password. Google and, when enabled, Apple sign-in use the verified identity returned by that provider.

The app stores a session so you can stay signed in. On iPhone, updated builds protect that session in the device Keychain. Browser sessions and local app data remain in that browser's storage. Manual purchases, imported email files, notes, matches, settings, and shopping plans may remain only on the device where you save them.

Connected email and order data

Google sign-in does not automatically grant Gmail access. When you separately connect Gmail through Google approval, PumpkinTrack requests read-only Gmail access to find and read order receipts. That Google permission cannot send, edit, or delete mail. iCloud and the optional Gmail fallback use provider app passwords, which can grant broader mail access. PumpkinTrack uses those passwords only to read email; it does not send, delete, or mark messages read.

Connection credentials and provider tokens are encrypted on the server. Collected original messages are temporarily stored encrypted in the receipt queue for up to 30 days while waiting to be read. Supported receipts can be read on the server while the app is closed, using the same receipt reader as the app. Once a queued message is processed, it is removed from that queue. If reading fails, a bounded encrypted copy may be retained in Reading problems for up to 30 days from collection so you can explicitly retry or export it. A copy may become unavailable sooner when storage limits are reached. Extracted order records can contain products, amounts, addresses, email identifiers, merchant information, and shipment details.

Original-email viewing retrieves the requested message from your connected mailbox. Email text is displayed without executing email HTML or loading remote tracking images.

What we use information for

• Signing you in and keeping your workspace separate from other accounts.
• Collecting and reading receipts you connect or import.
• Organizing orders, shipment updates, cancellations, and recorded sales.
• Providing account controls, preventing abuse, and diagnosing service failures.

PumpkinTrack does not sell Google user data, use it for targeted advertising, or use it to train generalized artificial intelligence models. Use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Service providers

Cloudflare hosts the web application, APIs, encrypted receipt queue, and account database. Google, Apple, and connected mailbox or marketplace providers process the requests needed for the connections you enable. Product or tax lookups contact their applicable lookup providers when you request them. Paid checkout, when available, is handled by its payment provider; PumpkinTrack does not collect full payment-card details itself.

Subscriptions

When paid checkout becomes available, Stripe handles web payment details and Apple handles App Store purchases. PumpkinTrack stores the provider customer and transaction identifiers, selected plan, subscription status, and billing-period dates needed to verify your access and manage billing. The service does not store full card numbers or raw payment webhook bodies. A small cleanup record may retain provider resource identifiers and retry timing until provider cleanup succeeds.

Your controls

• Pause imports in Connections to stop new collection. Pausing does not delete existing history or revoke a saved grant.
• Revoke Gmail access in Google Account connections. Revoke app passwords in the corresponding provider account.
• Use the account data controls to export account records or request deletion. A complete export may require a current app version.
• Remove local browser data or uninstall the app to remove device-held records. Export anything you want to keep first.

Retention and deletion

Account and extracted order data remain until you request deletion or the service no longer needs them. Account deletion removes the account's active server records and connected credentials through a staged cleanup. Provider revocation or cleanup problems can leave a request pending until retries succeed; a pending request is not represented as completed deletion.

Deleting PumpkinTrack does not delete your mailbox messages or end an external marketplace listing. Cancel a subscription through web billing or Apple subscription settings to stop its renewal. Permanent account deletion cancels a connected Stripe customer’s subscriptions before its ownership records are erased. Apple subscriptions must be cancelled separately in Apple settings. Provider records and infrastructure backups can have their own retention periods.

Changes and help

This page may change as available features and providers change. Material changes will be reflected here. See Support for account, import, and privacy controls. A public support contact will be supplied before paid subscriptions open.