Privacy and Gmail data use

This page describes the intended data practices of SoleStep Parcel Tracker, operated for the private use of SoleStep’s authorised owner.

Information processed

With the owner’s consent, the tracker uses Gmail read-only access to find relevant delivery and order emails. It checks sender and subject information before retrieving relevant message bodies. Processing may extract tracking numbers, retailer and order references, explicitly labelled product information, quantities and purchase or dispatch dates. Message identifiers and scan checkpoints help avoid duplicates.

Full email bodies, attachments and unrelated email content are not retained as parcel records. The owner may also enter parcel labels, recipient details, postcodes, notes and order links manually.

Purpose and sharing

Google data is used only for the owner’s parcel-tracking features. It is not sold, used for advertising or used to train general-purpose AI models. The backend may send a selected tracking number, carrier code and opaque registration reference to 17TRACK when tracking is authorised. It does not send Gmail message bodies to 17TRACK.

When the owner enables Discord alerts, selected parcel fields such as retailer, item or profile label, order reference, status, delivery estimate and tracking reference may appear in the configured private channel. Private parcel notes, postcodes and email bodies are excluded from these notifications.

Storage and protection

The private application runs on OpenAI Sites and Cloudflare infrastructure. Parcel records are scoped to the authenticated owner. Gmail refresh tokens are encrypted with an owner-bound server-side key; access tokens are used in server memory. Credentials are not placed in frontend code or source control.

Retention and control

Stored parcel records and processing identifiers remain available for tracking history until removed through authorised maintenance. Removing Google access in the Google Account security settings stops further authorised Gmail access; it does not itself erase previously stored parcel history. For removal of stored Gmail-derived records or the saved connection, contact the operator using the address below. No broader mailbox permission is requested for deletion.

Limited use

SoleStep’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Changes to audience or data use require review before activation.