Privacy Policy

Your Privacy Matters. TrackZam is committed to protecting your personal information. We do not sell your personal data.

1. Introduction

This Privacy Policy describes how TrackZam, a product of Power Med LLC d/b/a PostZam ("TrackZam," "we," "us," or "our"), collects, uses, stores, and shares information when you use the TrackZam website, applications, and related services (collectively, the "Service"). By using the Service, you agree to the collection and use of information as described here.

2. Information We Collect

Information You Provide Directly

• Report requests: the plain-English description of the report you want, together with any options you choose, such as the platform, date range, metrics, chart type, or colors
• Connected accounts: when you connect a platform account, the account identifiers that platform returns (such as a channel, page, profile, or ad-account name and ID) and the authorization token it issues
• Brand assets: logos, names, and colors you supply for inclusion in your reports
• Support messages: communications you send to our support, legal, or security teams

Information Collected Automatically

• Technical data: IP address, browser type, device type, and operating system, as recorded by our servers while serving your requests
• Request records: which reports were requested, when, and the policy decisions, approvals, and deletions that governed them, recorded in TrackZam's append-only audit ledgers
• Connector activity: the time, platform, API product, and outcome of each request TrackZam makes to a platform on your behalf

Information from Platform Connections

• When you connect a platform account, we receive and store the authorization token issued by that platform, encrypted at rest
• We use that token only to read the metrics and metadata your reports require, through the platform's official API, using read-only reporting scopes
• We read only the fields a report needs. We never request everything a scope would allow, and we never scrape
• We do not receive your platform passwords
• We never post, publish, edit, delete, like, follow, message, or otherwise act on your accounts, and we do not read private messages

Information We Do Not Collect

• We do not collect Social Security numbers, government ID numbers, or biometric data
• We do not collect data from platforms you have not connected, and we do not collect data about accounts you have not authorized
• We do not collect data from minors — the Service is not directed at anyone under 18
• We do not use analytics or advertising trackers of any kind

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Read, from each platform you connect, the metrics your report requires, through that platform's official API
• Calculate report figures and render reports, charts, and PDF exports inside TrackZam's own engine
• Check every acquisition, storage, calculation, display, and export against the policy rules TrackZam maintains for each platform, and record the decision
• Interpret your plain-English report request, including with the AI assistance described in Section 4
• Keep each platform's data separate — TrackZam never combines data from one platform with data from another
• Respond to support, compliance, and legal inquiries
• Monitor for fraud, abuse, and violations of our Terms
• Maintain logs for security, dispute resolution, and compliance
• Improve the Service through review of aggregate usage

We do not use your data to train AI models. We do not use your data for advertising. We do not sell your data to third parties.

4. AI-Assisted Report Interpretation

TrackZam may use Google Cloud Vertex AI (Gemini models) to help turn the plain-English report request you type into a structured report definition. Before anything is sent, TrackZam removes email addresses, contact numbers, URLs, account handles, identifiers, tokens, and credentials from the request text. The AI provider receives only that sanitized report intent together with TrackZam's approved report vocabulary.

The AI provider never receives raw platform API responses, actual metric values, account-specific findings, customer identifiers, credentials, or any other private platform data. All data acquisition, calculation, and rendering happen inside TrackZam. TrackZam keeps an audit record of each AI interaction that stores a cryptographic hash of your original request rather than the request itself. Your data is not used to train AI models.

5. How We Share Your Information

TrackZam does not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

Service Providers

We share data with vetted service providers who help operate the Service. These providers are contractually required to protect your data and use it only to provide services to TrackZam:

• DigitalOcean — cloud infrastructure, hosting, backups, and server monitoring (New York, United States)
• Google Cloud (Vertex AI) — AI-assisted interpretation of report requests, limited to the sanitized report intent described in Section 4

Third-Party Platforms

When you connect a platform account, TrackZam presents your authorization token to that platform's API to read the data your reports require. The platform sees the requests TrackZam makes on your behalf and handles them under its own privacy policy. TrackZam sends no data to platforms beyond those API requests and never writes to your accounts.

Legal Requirements

We may disclose information when required by law, court order, regulatory authority, or in response to lawful requests from law enforcement. Where permitted, we will notify you before disclosing.

Business Transfers

In the event of a merger, acquisition, or sale of TrackZam or Power Med LLC, your information may be transferred as part of that transaction. You will be notified of any change in ownership and your choices under this Privacy Policy.

6. Data Storage and Security

Your data is stored on infrastructure located in the United States: a DigitalOcean server in New York, with the application and its database running on that server. TrackZam implements the following controls:

• Encryption in transit: all data transmitted between you and TrackZam is protected by TLS (HTTPS), using certificates issued by Let's Encrypt
• Encryption at rest: connector credentials and platform authorization tokens are encrypted at rest and are write-only — once entered they are never displayed, logged, returned by any interface, or included in error messages
• Database isolation: the database is stored on the server's own disk and is not reachable from the public internet
• Platform separation: each platform's data is stored and processed in its own area, and TrackZam's policy engine denies any calculation that would combine data across platforms
• Policy gate and kill switches: every acquisition, storage, calculation, display, and export is checked against platform policy rules before it happens, and any connector or capability can be halted immediately
• Append-only audit ledgers: policy decisions, approvals, deletions, and evidence are recorded in hash-chained ledgers that cannot be altered after the fact
• Access controls: production system access is restricted to authorized personnel on a least-privilege basis
• Privileged access logging: administrative access is logged and reviewed
• Monitoring: server health and resource monitoring
• Automated backups performed regularly and stored securely

No system can be guaranteed 100% secure. If you believe your connected accounts or your data have been compromised, contact admin@postzam.com immediately.

7. Data Retention

TrackZam retains your information for as long as necessary to provide the Service, comply with legal obligations, and honor the retention rules each platform's developer policies require. Typical retention categories:

• Report requests, report definitions, calculated figures, PDF reports, and export records: retained while needed to show you your reports and to maintain the audit record; deleted on request as described in Section 8
• Platform authorization tokens and connector credentials: retained while the connection is active; deleted when you disconnect the platform or request deletion
• Brand assets: retained while you keep them in the Service; deleted on request
• X: content that becomes unavailable on X (deleted, protected, or otherwise withdrawn) is removed from TrackZam within 24 hours
• LinkedIn: client data obtained from LinkedIn is deleted within 10 days of termination of the connection or of your request
• YouTube Analytics: user data is deleted within 30 days of your request or of a failed re-authorization
• YouTube Data: stored resource metadata is refreshed or deleted on a 30-day cycle
• YouTube statistical data: aggregated statistical data may be retained for up to 36 months only where a registered approval covers the application, the use case, and the formula
• Security and access records: minimum 12 months for security monitoring and fraud detection
• Incident documentation: minimum 3 years
• Server logs: application server logs are rotated by size; TrackZam does not keep HTTP access logs
• Support communications: retained for dispute resolution and quality purposes

When data is deleted, TrackZam's deletion service follows the recorded dependency graph from the source data through derived figures, caches, AI artifacts, reports, and exports, and issues a deletion certificate. The certificate is honest about its limit: copies already delivered outside TrackZam, such as a PDF you downloaded or forwarded, cannot be recalled.

8. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information TrackZam holds about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your personal information, subject to legal obligations
• Portability: request your data in a portable format where technically feasible
• Objection: object to certain processing of your information
• Disconnect: revoke TrackZam's access to any connected platform at any time from that platform's own settings (see Section 10) or by contacting support@postzam.com

To exercise these rights, contact admin@postzam.com. We respond within 30 days. We may need to verify your identity before processing certain requests.

Some data cannot be deleted where retention is required by law, for fraud prevention, or for legitimate dispute resolution.

9. Cookies and Tracking

TrackZam sets one cookie: an essential antiforgery cookie that protects forms against cross-site request forgery. It contains no personal information and is not used to track you.

TrackZam uses no analytics cookies, no advertising cookies, no cross-site tracking, and no third-party scripts. TrackZam is ad-free.

10. Third-Party Platform Privacy

When you connect platform accounts to TrackZam, your use of those platforms is governed by their own privacy policies. TrackZam is not responsible for the privacy practices of Meta (Facebook and Instagram), YouTube, TikTok, LinkedIn, X, or any other connected platform.

TrackZam connects to each platform through its official API and requests only read-only reporting scopes — the minimum permissions needed to read the metrics your reports require. TrackZam never requests permission to post, publish, or modify anything. The platforms and API products TrackZam supports are:

• Instagram — Instagram organic insights
• Facebook — Facebook Pages insights
• Meta Ads — ad performance for the ad accounts you connect
• YouTube — YouTube Data and YouTube Analytics
• TikTok — TikTok Display, TikTok Business, and TikTok Ads
• LinkedIn — LinkedIn Marketing and LinkedIn Ads
• X — your own account's content and metrics, and X Ads

YouTube API Services

TrackZam uses YouTube API Services to read YouTube Data and YouTube Analytics for the channels you connect. By using TrackZam's YouTube features, you also agree to be bound by the YouTube Terms of Service, available at https://www.youtube.com/t/terms.

Your use of YouTube API Services is also subject to the Google Privacy Policy, available at https://www.google.com/policies/privacy.

TrackZam reads YouTube data only to produce the reports you request and stores it under the retention rules in Section 7. You may delete your stored YouTube data at any time by contacting admin@postzam.com, and you may revoke TrackZam's access to your Google and YouTube data at any time through the Google security settings page at https://myaccount.google.com/connections?filters=3,4&hl=en.

Revoking Access on Other Platforms

• Facebook and Instagram (Meta): in Facebook, open Settings & privacy → Settings → Business Integrations (or Apps and Websites) and remove TrackZam; in Instagram, open Settings → Security → Apps and Websites and remove TrackZam. Meta Ads access ends when TrackZam is removed from the account that granted it
• TikTok: in the TikTok app, open Settings and privacy → Security & permissions → Manage app permissions and remove TrackZam. For TikTok Business and TikTok Ads, remove TrackZam from the authorized apps in your TikTok for Business settings
• LinkedIn: open Settings & Privacy → Data privacy → Other applications → Permitted services and remove TrackZam. LinkedIn Ads access ends when TrackZam is removed there
• X: open Settings and privacy → Security and account access → Apps and sessions → Connected apps and revoke TrackZam. X Ads access ends when TrackZam is revoked there

Revoking access at the platform stops TrackZam from reading any new data. Stored data is then deleted under the retention rules in Section 7.

11. Children's Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18.

If you believe a minor has provided us with personal information, contact admin@postzam.com immediately and we will delete it.

12. International Users

TrackZam is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

If applicable privacy laws in your jurisdiction grant you additional rights, contact admin@postzam.com.

13. Policy Updates

TrackZam may update this Privacy Policy from time to time. Material changes will be posted on this page and announced in the Service with reasonable advance notice. Continued use of the Service after updates constitutes acceptance of the revised policy where permitted by law.

14. Contact

• Privacy requests and data rights — admin@postzam.com
• Security incidents — admin@postzam.com
• Legal inquiries — admin@postzam.com
• General support — support@postzam.com