Privacy policy

Welcome to PERM Tracker. PERM Tracker is operated by PERM Tracker LLC, a Florida limited liability company ("we," "our," or "us"), which runs permtracker.app. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application for tracking Permanent Labor Certification (PERM) cases.

By using PERM Tracker, you agree to the collection and use of information in accordance with this policy. If you don’t agree with this policy, please don’t use our service.

Account Information

• Email address: Used for account creation, authentication, and notifications
• Name: Obtained via Google OAuth or entered during signup
• Password: If you use email/password authentication, your password is securely hashed and never stored in plain text (managed by our authentication provider)

Case Data

• Employer names and position titles
• Beneficiary identifiers
• Case status and progress information
• Important dates (PWD filing, recruitment dates, etc.)
• Notes and case-related documentation references
• RFI/RFE information and response dates

User Preferences

• UI settings (dark mode, sorting preferences)
• Notification preferences (email, push, quiet hours)
• Dismissed deadline alerts
• Calendar sync preferences
• AI chat action mode preferences

Contact Form Submissions

• Name, email address and message text you submit through the contact form, plus the submitting IP address (used only for abuse rate-limiting)
• Submissions are stored and forwarded to our support inbox so we can reply; they’re never used for marketing and never shared

Technical Information

• IP address and browser type
• Device information and screen resolution
• Usage patterns and interaction data
• Performance metrics (page load times, Core Web Vitals)
• Error logs and stack traces (for debugging)

API Keys

• If you make an API key, we keep its name, a one-way hash of it (never the key itself) and the date you made it, until you revoke it or delete your account
• How many calls each key made per day, under a random account number that names nobody, kept to enforce your plan’s limits and to show your usage in Settings

Claiming a Law Firm’s Page

When someone claims a law firm’s page, we keep the email address they used, the role they gave (shown to no one but us) and what they sent for the profile. The profile is public on the firm’s page as the firm’s own words; the address and role are not. To check a claim we compare the address’s domain with the domains DOL’s public filings list beside the firm, of which we keep only the domains, never the addresses. We may remove a profile at any time. Ask us to delete a claim and its profile at the address below.

We use the information we collect to:

• Provide and maintain the PERM tracking service
• Authenticate your account and ensure security
• Send email and push notifications about upcoming deadlines
• Power the AI chat assistant with case context for relevant responses
• Sync deadlines to your Google Calendar (if enabled)
• Monitor application errors and improve reliability
• Improve user experience and application features
• Respond to customer support requests
• Comply with legal obligations

PERM Tracker uses Google OAuth as one of our authentication methods. When you sign in with Google:

• We access only your email address and display name
• This information is used solely for authentication and account identification
• We do not access your Google contacts, calendar (unless you separately enable Calendar Sync), or any other Google services
• We do not share your Google account data with any third parties
• We do not store your Google password

Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

Your data is stored securely using industry-standard practices:

• Database: Convex backend platform hosted on Amazon Web Services (AWS) in US East (N. Virginia)
• Encryption at Rest: 256-bit AES encryption for all stored data
• Encryption in Transit: All data transmitted via TLS/HTTPS encryption
• Access Control: Server-side authorization ensures each user can only access their own data through authenticated backend functions. Internal access to the database is restricted to authorized PERM Tracker personnel who may access your data only to provide technical support you have requested, diagnose and fix bugs, maintain service security and reliability, or fulfill legal obligations
• Authentication: Managed by Convex Auth with secure session handling
• Compliance: Our backend provider (Convex) is SOC 2 Type II compliant and GDPR compliant
• Calendar Tokens: Google Calendar OAuth tokens are encrypted at rest using AES-256-GCM before storage
• Employer FEIN: Federal Employer Identification Numbers are encrypted at rest using AES-256-GCM and decrypted only when displayed to the authenticated case owner

While we implement robust security measures, no method of transmission over the Internet is 100% secure. We can’t guarantee absolute security of your data.

PERM Tracker includes an AI-powered chat assistant to help you understand your cases, deadlines, and PERM processes. When you use the AI chat feature:

What Data Is Shared

• Your chat messages and questions
• Case data referenced in conversations (employer names, position titles, beneficiary identifiers, wage information, case numbers, status, dates, and notes)
• System-generated context (your name, case counts, current page)
• Conversation history for context continuity

AI Service Providers

Your AI chat data is processed by the following third-party providers via their APIs. We use a multi-provider fallback system for reliability:

• Google Gemini (Google LLC): Primary AI provider. Retains data for up to 55 days for abuse monitoring only. Does not use API data to train models.
• OpenRouter: AI model routing. Zero Data Retention (ZDR) by default; prompts aren’t stored.
• Mistral AI: Fallback AI provider. API data is not used for model training.
• Groq: Fast AI inference on US-based Google Cloud servers. Doesn’t use API data for training when ZDR is enabled.

Web Search

When the AI assistant performs web searches on your behalf, search queries are sent to:

• Tavily: Primary web search provider
• Brave Search: Fallback web search provider

Search queries are derived from your questions and don’t include your personal information or case data.

Your Controls

• You can choose not to use the AI chat feature
• You can configure AI action modes (off, confirm, auto) in Settings
• You can delete your conversation history at any time

We use PostHog (PostHog, Inc.) for product analytics to understand how the application is used and to improve features.

What We Collect

• Page views and navigation patterns
• Feature usage events (e.g., creating a case, using AI chat)
• Browser exceptions and JavaScript errors
• Browser type, device information, and screen resolution
• The country you’re visiting from, as our network provider (Cloudflare) reports it: the country only, never your city or your IP address. When you’re signed in, PostHog may also estimate your city from your IP address.

User Identification

When you aren’t signed in, PostHog runs in cookie-free mode: it sets no cookies and stores nothing in your browser. PostHog’s servers count visits with a one-way hash of your IP address, browser type and our site name, mixed with a random value that changes every day and is deleted once that day is processed, so a visit today can’t be linked to a visit tomorrow.

When you’re signed in, analytics events are linked to your account to help us understand usage patterns, and PostHog uses a cookie and local storage to keep that link. Your identity is reset when you sign out, and analytics goes back to cookie-free mode.

You can switch usage analytics off at any time with the switch at the foot of every page: while it’s off, this browser sends PostHog nothing at all, signed in or not. Signed in, you can also switch it off in Settings, under Support, and that setting follows your account to every device you sign in on.

Data Routing

Analytics data is sent through a reverse proxy on our domain (permtracker.app/ingest) to PostHog's US servers (us.posthog.com). This means analytics requests appear as first-party traffic in your browser's network tab rather than as requests to a third-party domain.

PostHog acts as our data processor. For details, see PostHog's Privacy Policy.

Session Replay

PostHog can also record session replays: playbacks of page interactions (clicks, scrolls, navigation and on-screen content). Session replay is switched off as of September 6, 2026 and no replays are being recorded. If we turn it back on, this section will say so first, and the rules below will apply.

• Form inputs are masked: values you type into fields, and all passwords, are redacted and not captured.
• On-screen text is masked too: the recorder is set to hide all text on the page, which can include case information. We would never use replays for advertising and never sell them.
• Replays are routed first-party through permtracker.app/ingest rather than to a third-party domain.
• Global Privacy Control (GPC): if your browser sends a GPC signal, we automatically disable PostHog analytics and session replay for your session.

Enabling Global Privacy Control in your browser opts you out of PostHog analytics (and replay, whenever it is on). The only other analytics on the site is Ahrefs Web Analytics (Section 13), which sets no cookies and collects no personal data, so there is nothing for GPC to switch off there.

Surveys

PostHog Surveys is switched off. If we ever use it to ask for in-app feedback, responses you choose to give are processed by PostHog as our data processor, and taking part is always optional.

We use Sentry (Functional Software, Inc.) to monitor application errors and improve reliability.

Error Tracking

• JavaScript error messages and stack traces
• Browser and device information (browser type, OS, screen size)
• User actions leading to errors (page navigation, clicks)
• Application performance metrics

Session Replay

Sentry does not record session replays for this site. That feature was removed on August 29, 2026; Sentry receives error reports and performance timings only.

Privacy Protections

• sendDefaultPii is disabled, so cookies, user agent strings with PII, and request bodies aren’t sent
• Request body data is stripped before transmission to Sentry
• Sentry automatically scrubs credit card numbers, SSNs, and other PII patterns
• Development environment events are suppressed (not sent to Sentry)

Sentry acts as our data processor under a Data Processing Agreement. For details, see Sentry's Privacy Policy.

To protect our sign-up, sign-in, and password-reset forms from automated abuse, we use Cloudflare Turnstile, operated by Cloudflare, Inc.

Signals Collected by Turnstile

Per Cloudflare's Turnstile Privacy Addendum, the following signals are processed when a Turnstile challenge is rendered:

• Client IP address
• TLS fingerprint
• HTTP User-Agent header
• Your interactions with our forms (mouse movement, click timing)
• The PERM Tracker sitekey and origin URL

Turnstile does not use third-party tracking cookies and does not read the contents of form fields you type (email, password, or name).

Cloudflare's Role

Cloudflare acts as our data processor when providing Turnstile to us, and as an independent data controller when using aggregated signals to improve its own bot-detection capabilities.

When Turnstile Appears

• Sign-up: widget is always visible
• Password reset: widget is always visible
• Sign-in: widget is invisible for most visitors; an interactive challenge only appears if Cloudflare's risk analysis flags the attempt as suspicious

Legal Basis

We process this data on the basis of our legitimate interest in preventing fraud, spam, and abuse of our service (GDPR Art. 6(1)(f); CCPA service-provider disclosure).

For more detail, see Cloudflare's Turnstile Privacy Addendum and Cloudflare's Privacy Policy.

Rate Limiting

We enforce multiple layers of rate limiting to prevent abuse: per-IP limits at the network edge (covering all traffic to sign-up, sign-in, password-reset, OTP verification, and AI chat endpoints), per-email limits on authentication actions, and per-user limits on hot backend mutations (case create, conversation create, notification marks, knowledge search, etc.). When a limit is reached, requests return an HTTP 429 response for the duration of the rate-limit window. We retain only the minimum counter state needed (request count + timestamp) and an internal abuse blocklist of IP addresses that trip limits repeatedly (auto-expired after 24 hours). Counter state is automatically purged when the window closes.

Automated Account Protection

If we detect an abnormal volume of failed sign-in attempts against the same account (for example, 10 failures within 30 minutes, which is the signature of credential-stuffing), we automatically place the account in a temporarily locked state for up to 24 hours to protect the legitimate owner. We notify our security team and record the event for audit. Owners of accounts placed in this state can contact support to appeal and have the lock lifted earlier.

When you enable push notifications, your browser generates a unique subscription including an endpoint URL and encryption keys. We store this subscription data on your user profile to deliver deadline reminders and case alerts.

What We Collect

• Endpoint URL: Browser-generated URL for receiving notifications
• Encryption keys (p256dh, auth): Browser-generated keys for secure message delivery

This data doesn’t contain personally identifiable information and consists of technical identifiers generated by your browser.

Delivery Services

Notifications are delivered through your browser's push service (Google FCM for Chrome, Mozilla Push Service for Firefox, Apple Push Notification service for Safari). These services may collect technical device metadata. Notification content is encrypted end-to-end where supported.

Your Controls

• Push notifications require explicit opt-in via browser permission
• Disable anytime in browser settings or in-app notification preferences
• Configure quiet hours and notification types in Settings
• Subscription data is deleted when you revoke permissions or delete your account

You may optionally connect your Google Calendar to sync PERM deadlines as calendar events.

• OAuth Scope: We request access only to create, update, and delete calendar events (calendar.events scope)
• Data Synced: Deadline dates, event titles with case information (employer, deadline type), and deadline descriptions
• Token Storage: Your Google Calendar OAuth tokens are encrypted at rest using AES-256-GCM before storage in our database
• Disconnect Anytime: You can disconnect Google Calendar from Settings, which revokes access and removes stored tokens

We don’t access your existing calendar events, contacts, or other Google services through this integration.

We use the following storage technologies:

• Session Cookies: Essential for authentication and maintaining your login session
• LocalStorage: Stores preferences such as dark mode settings, UI preferences, and temporary authentication state during OAuth redirects
• Error Monitoring: Sentry’s script runs only on the sign-in pages and inside the app, where it reports errors. It doesn’t record sessions; that feature was removed on August 29, 2026
• Analytics: if you aren’t signed in, PostHog stores nothing in your browser (cookie-free mode, Section 7). If you’re signed in, it uses a cookie and local storage to link your events to your account. Analytics data is routed through our domain (permtracker.app/ingest) rather than directly to PostHog

These storage technologies are used for application functionality and service improvement. They don’t track you across other websites.

We use the following third-party services to operate PERM Tracker:

• Convex: Backend platform, database, and authentication (SOC 2 Type II, hosted on AWS)
• Oracle Cloud Infrastructure: Hosting for the website and its public-data database, on servers in the United States
• Cloudflare: The network in front of the website. Every request passes through it, so it receives your browser's standard request data (IP address, user agent) to deliver the page and screen out abusive traffic. It also runs Turnstile (Section 9)
• Resend: Transactional email delivery (notifications, OTP verification, password resets) and, if you opt in, marketing and product-update emails (we sync your email address and first name to Resend for this purpose)
• Google: OAuth authentication and Calendar API integration
• PostHog: Product analytics and event tracking (see Section 7)
• Sentry: Error tracking and performance monitoring (see Section 8)
• Ahrefs Web Analytics: Cookieless, aggregate page-view analytics loaded on every page. It sets no cookies, stores no identifiers on your device and collects no personal data; we see page counts and referrers, not people.
• AI Providers: Google Gemini, OpenRouter, Mistral AI, and Groq for AI chat assistance (see Section 6)
• Search Providers: Tavily and Brave Search for AI web search capabilities (see Section 6)
• Cloudflare, Inc.: DNS, encryption and the network edge in front of the site (rate limiting and bot mitigation), and Turnstile on authentication forms (see Section 9)
• Browser Push Services: Google FCM, Mozilla Push Service, and Apple APNs for push notification delivery (see Section 10)
• USCIS (U.S. Citizenship and Immigration Services): the Case Status API behind the USCIS receipt lookup, once USCIS has granted access. What is sent and what is stored is in Section 18.

Each of these services has their own privacy policies. We recommend reviewing their policies for additional information. Convex maintains a public list of sub-processors at convex.dev/legal/subprocessors.

• Your data is retained for as long as your account is active
• You may request deletion of your account and all associated data at any time from Settings
• Upon deletion request, your account enters a 30-day grace period during which you can cancel. After the grace period, all data is permanently deleted
• AI conversation data is automatically deleted after 90 days of inactivity, even if your account remains active
• Read notifications older than 90 days are automatically cleaned up
• Rate limit records are automatically cleaned up after 24 hours
• USCIS case-status lookups are deleted twelve months after the last lookup of that receipt (see Section 18)
• Some data may be retained longer if required by law

AI Provider Retention

• Google Gemini: Up to 55 days (abuse monitoring), then deleted
• OpenRouter: Not stored (Zero Data Retention)
• Mistral AI: Per their data processing terms
• Groq: Not stored when ZDR is enabled

To request data deletion, please email us at support@permtracker.app.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Download all your data at any time via the "Download everything (.json)" button in Settings, or request a copy by contacting us
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Portability: Request your data in a portable format
• Objection: Object to certain processing of your data
• AI Opt-Out: Choose not to use AI chat features

To exercise any of these rights, please contact us at support@permtracker.app. We’ll respond within 30-45 days.

These rights cover the information you give us and the data your account holds. The case records and employer names the site shows from the Department of Labor’s disclosure files and other federal sources are public government records, not data you gave us. To ask about one, write to the same address.

California Residents (CCPA/CPRA)

If you’re a California resident, you have the right to know what personal information we collect and how we use it, to access and delete it, to correct inaccurate information, to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. We won’t discriminate against you for exercising these rights.

• We don’t sell or share your personal information (including for cross-context behavioral advertising), so there’s nothing to opt out of, but we still honor opt-out signals.
• Global Privacy Control (GPC): we detect and honor the GPC browser signal; when it’s present, we disable analytics and session replay for your session.
• Sensitive information: the case data you enter may relate to immigration status. We use it only to provide the service and never for advertising.
• To exercise any California right, email support@permtracker.app (no account changes are required, and you may use an authorized agent).

EEA, UK & Switzerland (GDPR / UK GDPR)

If you’re located in the European Economic Area, the United Kingdom, or Switzerland, you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. Our legal bases for processing are:

• Performance of a contract: to provide the case-tracking service you sign up for.
• Legitimate interests: to secure the service, prevent abuse, and improve the product (including analytics).
• Consent: for optional features such as marketing emails, which you can withdraw at any time.

You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). International transfers of your data to the United States rely on Standard Contractual Clauses (see Section 16). We don’t engage in solely-automated decision-making that produces legal or similarly significant effects.

Your data is primarily stored and processed in the United States. If you’re located in the European Economic Area (EEA), United Kingdom, or Switzerland, your data may be transferred to the United States by our service providers (Convex, AI providers, Sentry, PostHog).

These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, as well as Data Processing Agreements with our service providers.

PERM Tracker isn’t intended for use by individuals under the age of 13. We don’t knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us immediately.

The USCIS case status lookup lets you enter a receipt number and see what USCIS says about that case. It runs on USCIS's Case Status API under credentials issued to PERM Tracker LLC, and it's available only once USCIS has granted that access; until then the page says so and looks nothing up.

What you give and what we send

• You type a receipt number (thirteen characters, such as IOE0912345678). No account is needed and no name is asked for.
• We send that receipt number to USCIS over an encrypted connection with our API credentials. USCIS's own terms of use and privacy policy apply to what USCIS does with the request.
• USCIS answers with the form type, the current status text, and a dated history of status changes. It doesn't return your name or any other identifier.

What we store

• The receipt number, the form type, the status text, the dated history, and the time of the lookup.
• We store it so a later lookup of the same receipt can show what changed, and so we can count lookups by form type and status. Counts are published only in aggregate; a receipt number is never published or shared.
• A receipt number identifies a case rather than a person, and we treat it as personal data anyway: it's encrypted at rest with the rest of the database, it's not sold, and it's not used for advertising.
• Stored lookups are deleted twelve months after the last lookup of that receipt, or sooner if you ask at support@permtracker.app with the receipt number.
• No email or notification is sent from a lookup. If alerts on USCIS receipts are ever offered they will be a separate, opt-in subscription described here first.

We may update this Privacy Policy from time to time. We’ll notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date at the top
• Sending an email notification for material changes

Your continued use of the service after changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: support@permtracker.app
• Application: PERM Tracker
• Operator: PERM Tracker LLC, a Florida limited liability company
• Mailing address: 7901 4th St N, Ste 300, St. Petersburg, FL 33702