Track Slash Privacy Policy
This policy covers the Track Slash service at trackslash.com and Track Slash's pages on this website.
Last updated: 14 September 2026.
Track Slash is an issue tracker with accounts. Unlike Vault, it genuinely holds your data on our systems, so this policy describes real processing rather than the absence of it.
Who is responsible for your data
The data controller is Bad Bundle Limited, a company registered in England and Wales, company number 16035056, whose registered office is Silverstream House, 4th Floor, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, United Kingdom.
For anything to do with this policy or your data, email help@badbundle.com.
What we collect
Your account. Your email address, your display name, and your username. Your email address is how you sign in and how we tell accounts apart.
Your credentials. Either a password, which is stored only as a hash and never in a form we can read, or a passkey, for which we store a public key. A passkey's private key never leaves your device and we never see it.
Your sessions. A session token, when it expires, and the browser user agent that created it. Sessions expire and are swept automatically.
What you put into the tracker. Projects, issues, comments, sprints, tags, attachments, and anything else you type or upload. If you put personal data about yourself or anyone else into an issue or a comment, we hold that too — which is worth remembering when you file a bug that quotes a customer.
Push notification subscriptions, if you turn them on. This is a subscription endpoint provided by your browser, two cryptographic keys, and your browser's user agent. See "Push notifications" below.
GitHub connection tokens, if you connect a repository. Stored encrypted.
Your IP address is used transiently to rate-limit sign-in attempts. It is not kept as part of your account record.
What we do not collect
There is no analytics, no advertising, no tracking pixels, and no third-party scripts that profile you. We do not sell data, and we do not share it for anyone else's marketing.
Track Slash sends no email at all. There are no notification emails, no newsletters, and no marketing. One consequence worth knowing: because there is no email channel, there is no account recovery of any kind. If you lose access to your password and your passkeys, your account cannot be recovered. Keep a passkey backed up, or keep more than one.
Where your data is held
Track Slash runs on infrastructure operated directly by Bad Bundle Limited in the United Kingdom. There is no third-party hosting company, no cloud provider, and no managed database service holding your data.
We use a small number of third parties, and only these:
Cloudflare sits in front of the service as a network proxy and content delivery network. It terminates TLS, which means it handles your traffic in transit, and it processes connection data such as your IP address in order to route requests and absorb attacks. Cloudflare operates globally, so this processing may happen outside the UK under Cloudflare's own transfer safeguards.
Your browser vendor's push service — Apple, Google or Mozilla depending on your browser — delivers push notifications if you enable them. See below.
GitHub receives requests only if you connect a repository to a project, and only for that project.
That is the complete list. Your account, your issues, and your uploads are not copied to anyone else.
Push notifications
Push notifications are off unless you turn them on.
When you enable them your browser gives us a subscription endpoint hosted by your browser vendor, together with two keys used to encrypt message content. Notification content is encrypted before it is sent, so the push service relays it without being able to read it. The push service does learn that a message was sent to your device and when.
Turning notifications off in the app deletes the subscription.
How long we keep it
- Your account and its contents — for as long as your account exists.
- Sessions — until they expire, after which they are swept automatically.
- Push subscriptions — until you disable notifications, or until the subscription fails repeatedly and is disabled.
- Deleted accounts — deleting your account deletes your issues, comments, sessions, push subscriptions, and connection tokens along with it.
- Backups — where backups exist, deleted data persists in them until that backup rotates out.
- Support email — two years from the last message in the thread.
Lawful basis
We process your account data to provide a service you asked for, which is performance of a contract. Security measures such as rate limiting rest on legitimate interests — keeping other people out of your account.
Your rights
Under UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct it
- ask us to delete it
- ask us to restrict how we use it, or object to us using it
- ask for it in a portable format
Most of this you can do yourself inside the app: edit your profile, and delete your account when you want to leave. For anything else, email help@badbundle.com. Data protection requests are answered within one month, as the law requires.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you came to us first.
Security
Passwords are hashed. Passkeys store only a public key. GitHub tokens are encrypted at rest. Traffic is served over TLS. Sessions expire.
Track Slash is a young service run by a one-person company. We think the security basics are right, but you should size your trust accordingly and not put anything in it that would be catastrophic to lose or expose.
If you find a security problem, the contact details are in security.txt.
Children
Track Slash is not intended for children and is not directed at anyone under 13.
Changes to this policy
Changes to this policy are reflected on this page, with the date at the top. No notice is given by any other means, and it is your responsibility to check. Where a change materially affects how your data is handled, acceptance of the updated terms may be requested at sign-in.
- 14 September 2026: First published.