Privacy Policy

The short version

BoosterBound reads your order email on your own computer, and your orders stay there. The hosted service keeps only what it needs to let you in and bill you, plus the encrypted Gmail App Password for any mailbox you add, which the operator can open to keep your tracker running. Nothing is sold, nothing is used for advertising, and there is no analytics or tracking on any page.

1. What BoosterBound does

BoosterBound is an order tracker. It reads the order confirmations, shipping notices and cancellations that shops send to your email, and turns them into one list of what you bought, what shipped, what was cancelled and what a retailer still owes you.

It runs as a program on your own Mac or Windows computer. A small hosted service at boosterbound.com issues your access key, keeps your subscription, and holds the mailbox password you choose to give it. There is no mobile app; the website can be added to a phone home screen, and that is all.

2. Where your data lives

Almost all of it never leaves your computer. The emails from the shops on your list, the raw copies kept so a parser fix can be replayed, the orders and shipments worked out from them, the product photographs, your notes and tags: all of that is a single file and a folder on your own machine, which you can copy, back up or delete without asking anybody.

The hosted service holds no order and no email. It knows that your account exists, how to let you in, whether you have paid, and — if you added a mailbox — the encrypted password for it.

That split is the design, not a configuration. The server never connects to your mailbox; your own copy does.

3. What is collected

On the hosted service

Your email address, and the name you typed at checkout if you gave one.

A Stripe customer identifier, so your subscription can be found. Nothing about your card.

Your access key, stored only as a one-way hash that cannot be turned back into the key, plus the sessions it has open and the times it has been used.

If you sign in with Discord: your Discord account id and username. Nothing else from Discord, and no access to your servers or messages.

If you add a mailbox: its address, and its App Password sealed with encryption.

On your own computer

The order emails from shops on your allowlist, kept as the original message so a parser fix can be re-run against them. Mail from anyone else is discarded before it is downloaded.

The orders, line items, shipments, prices, dates, tracking numbers and product images worked out from those emails, along with anything you type yourself: notes, tags, payers, card nicknames and manual tracking numbers.

The last four digits of the card a shop named in its email. Never a full card number — a retailer does not put one in an email, and nothing here accepts one.

Your settings: which shops to watch, which Discord channel to post to, and your light or dark preference.

4. How it is used

To let you in, to bill you, and to keep your tracker running when you are not sitting at your computer.

To turn your order mail into orders: matching a shipping notice to the confirmation it belongs to, noticing a cancellation that was never refunded, working out what a drop actually cost you.

To tell you when something changes, through the Discord channel you configure, if you configure one.

There is no other purpose. Your data is not sold, not rented, not used for advertising, and not used to train anything.

5. Connecting Gmail

Connecting a mailbox uses a Google “App Password”. You create it yourself inside your own Google account, and you can revoke it whenever you like at myaccount.google.com/apppasswords, without asking anybody.

BoosterBound connects to Gmail only, over IMAP, and only ever reads. It never marks a message read, moves it, deletes it, or sends anything from your account.

Only your order email is ever saved. The tracker checks who sent a message before it downloads it, and anything from a sender that is not a shop on your list is discarded without being read.

An App Password is not limited to order mail: it gives whoever holds it full access to the Gmail account you made it for. Yours is stored encrypted on the operator’s server, where it can be opened and read, so that your tracker keeps running and can be fixed without asking you for the password again.

Removing a mailbox from BoosterBound removes the stored copy of its password as well.

6. What BoosterBound does not do

Every parser is ordinary code with a test behind it. Nothing about your mail is sent to a language model, by us or by anyone.

It does not call carriers. Delivery states come from what the retailer wrote in its own emails, which is why a parcel can show as in transit after it has arrived. No tracking number is sent to UPS, FedEx, USPS or any tracking broker.

It does not scrape retailer websites or sign in to your shop accounts.

It does not store your card number, and has no field anywhere that would accept one.

It does not run analytics, advertising tags or third-party cookies on any page.

It does not read your mail for anything other than orders, and it decides that from the sender before the message is downloaded.

7. Third-party services

Stripe takes your payment on its own page and holds your card under its privacy policy. BoosterBound receives a customer identifier and whether the subscription is active.

Resend delivers the one email that carries your setup link.

DigitalOcean hosts the service, on servers in the United States.

Google holds your own mailbox, which your copy of the tracker opens with the App Password you created.

Discord, only if you ask for it: a webhook address you supply, which receives the order updates you chose to send there. Anyone who can see that channel can see them.

That is the complete list. No analytics provider, no advertising network, no data broker, no tracking service.

8. Storage and security

Mailbox passwords are sealed before they leave your computer, with a key the server does not have. The server stores a blob it cannot open; somebody who took the whole server would get bytes and no mailbox access.

Access keys are stored only as a slow one-way hash. Sessions are split into a public half and a secret half, and only the secret half’s hash is kept, so a copy of the database is not a set of working logins.

Everything between your browser, your tracker and the service travels over HTTPS.

Backups of the service are encrypted. On your own computer, the tracker’s backups are encrypted too whenever you have a mailbox key.

No system is perfect, and this one is run by a person rather than a security team. What is promised here is the design above, honestly described, not a guarantee that nothing can ever go wrong.

9. How long it is kept, and deleting it

Data on the hosted service is kept while your account exists. Disabling an account keeps its data so that a mistake can be undone; deletion removes it.

You can ask for deletion at any time, and the Terms set out what happens: account data is deleted or de-identified within five business days, apart from anything that must be kept for legal or fraud-prevention reasons, and residual copies may survive in backups for up to 14 days after that before the normal backup cycle removes them.

Removing a mailbox removes its stored password straight away.

Data on your own computer is yours and is not touched by any of this. Deleting your account does not reach it; deleting the folder does.

10. Sharing

Your data is never sold, rented or traded. It is shared only in the ways this policy already describes: with the payment processor to bill you, with the mail provider to send your setup link, with the host that runs the server, and with a Discord channel if you set one up.

Information may be disclosed where the law requires it.

11. Your choices

Revoke the App Password whenever you like, at myaccount.google.com/apppasswords. Your tracker stops reading that mailbox immediately and nothing else is affected.

Remove a mailbox from your own copy, which deletes the stored password here as well.

Export what you have: your orders as JSON, and a cost basis of delivered items as CSV, from your own copy, without asking anybody.

Turn notifications off by clearing the Discord webhook in your settings.

Cancel the subscription, or ask for your account and everything the service holds about you to be deleted.

Ask what is held about you, by writing to admin@boosterbound.com.

12. Cookies and local storage

One cookie: the session that keeps you signed in. It is not readable by scripts and is used for nothing else.

Your browser also remembers whether you chose light or dark. That never leaves your browser.

There are no third-party cookies, no advertising pixels and no analytics on any page of this site.

13. Children

BoosterBound is not for anyone under 18, which the Terms require, and there is no reason for a child’s information to reach it. If you believe a minor has created an account, write to the address below and it will be removed.

14. Changes to this policy

This policy may change. The effective date at the top is the version you are reading.

A change that affects how your mailbox password or your money is handled is emailed to the address on your account before it takes effect, rather than quietly posted here.

15. Contact

Questions about this policy, or about what is held about you: admin@boosterbound.com.