Privacy policy

1. Who is responsible

The data controller is Laura Virués, who runs Commission Tracker from Mexico at mycommissiontracker.net.

For any question or request about your data, write to support@mycommissiontracker.net.

2. What data we process

Your account

• Email address and password (the password is stored as a hash, never in readable form). If you sign in only with Google, there is no password.
• Artist name, username (the one in your public profile), currency, theme, language and your preferences and goals inside the app.
• If you turn on two-step verification or passkeys: the secret of your authenticator app and recovery codes, and the public key of each passkey (the private key never leaves your device).
• The invitation code you used to sign up and the internal label we gave it when handing it out (for example, who we gave it to), so we know how each person joined and for moderation tasks. If we gave the code to another user so they could invite whoever they chose, we also keep the link to their account (which codes we gave them and which account used each one), so we know who invited whom and can review both accounts if there is a problem. We do not show that relationship to other users, and the person who invites does not receive any data from the invited account.

What you add to the app

• Your commissions: platform, category, usage type, dates, status, stages, notes, amounts, payments, refunds and tags.
• Your clients: the username or @ they contact you with and, if you add them, their contact details (email or social accounts) and notes. More in section 3.
• Your Finances entries, if you use them: income and expenses you log by hand outside your commissions (date, amount, concept, source and notes), your recurring expenses (concept, amount, how often and the next date) and your monthly expense cap. They are private: they are never shown on your public profile.
• Your catalogs, notes and calendar events, announcements, terms of service and cancellation policy, and your timer activity.

Your public profile

If you turn on your public profile, we also process what you choose to show: profile picture and banner (stored as files), bio, pronouns, links to your socials, languages, country, time zone if you choose to show your local time, rest days and vacations. Exactly what is visible is explained in section 5.

Sign in with Google

If you choose "Continue with Google", we receive from Google only your email address, an identifier of your Google account and your first name (only to suggest an artist name that you can change). We do not store your Google picture, we do not ask for access to your files, calendar, contacts or mail, and we do not keep Google access tokens.

Technical and security data

• IP address and browser (user agent) of your sign-ins and security events (password changes, passkeys, two-step verification, closed sessions, account deletion). We use them to detect suspicious access and to email you when someone signs in from a new location.
• The open sessions of your account (device, IP and last activity), so you can see and close them from Settings.
• Application error logs (section 6, Sentry), which by configuration contain no personal data.

Beta access requests

If you ask for access using the request form (hosted on Google Forms), we receive what you write in it: your artist name, your email, the links to your portfolio, how many commissions you take, which tools and payment methods you use, your authorship declaration, how you found the project and anything you want to add. We use it only to evaluate your request, reply to you and, if we accept it, hand you a code. Google processes those answers on our behalf (section 6). The answers are deleted from the form no later than 90 days after we reply; if we accept you, only the code's internal label (for example, who we gave it to) remains.

Profile reports

Any visitor can report a public profile. We store the reason, the details they write, their email if they choose to give it, and their IP address, only to review the report.

3. Your clients' data

Artists keep information in Commission Tracker about the people who commission them. You enter that information, so you decide what to store and you answer for it to your clients; we only host it to provide the service.

• The app is designed not to ask for real names: a client is identified by a username or @ (for example, their Instagram or Discord handle).
• Any contact details you add to a client are stored encrypted in the database.
• Store only what you need to work with that person and let them know you do, especially if you will show their username on your public profile.

If you are an artist's client and want your username to stop appearing on their public profile, ask them. If you cannot, write to support@mycommissiontracker.net and we will handle it.

4. What we use your data for

We use your data only for these purposes, all of them necessary to provide the service:

• Review your beta access request and reply to you.
• Create and maintain your account, and authenticate you.
• Store and show you your commissions, clients, statistics and settings on any device.
• Publish your public profile with what you choose to show.
• Send you service emails: verification code, second-factor code, password reset link and security alerts.
• Protect the account and the service: detect suspicious access, limit abuse and review reports.
• Keep the service running: monitoring, bug fixing and backups.
• Comply with legal obligations.

There are no secondary purposes. We do not sell or rent your data, we do not show advertising, we do not build behavioral profiles and we do not use any external analytics or tracking tool (such as Google Analytics or similar, which measure what visitors do on a website). If that ever changes, we will update this policy and tell you beforehand.

About the app's statistics. The Statistics section uses your own commission data to calculate summaries of income, categories and earnings per hour. They are calculated on our server only for you: they are not shared with anyone and are not used to analyze people who visit the site.

The legal bases for processing your data are: performance of the service you asked for, our legitimate interest in keeping it secure, your consent when you choose to sign in with Google or send an access request, and compliance with legal obligations.

5. What is public

Only your public profile (mycommissiontracker.net/u/your-username) is visible without signing in, and only if you turn it on. Anyone with the link can see:

• Your artist name, username, bio, pronouns, links, languages, country, images and, if you enable it, your local time.
• Your rest days, your vacation mode and whether your queue is open.
• Your announcements and the terms of service you wrote.
• For each commission you do not hide: the client's username, platform, category, content type (SFW or NSFW), status, stages, delivery date and notes. If you turn on privacy for a commission, the username is not shown: it appears as "Private client" and without notes.

Never shown: prices, amounts, payments, refunds, your client contacts or your private notes. You can hide any commission or turn the profile off whenever you want; a profile that is off answers exactly like one that does not exist.

That page opens a real-time connection with our server to update without reloading; it sends no personal data from the visitor. Announcements may include images the artist links from other sites: in that case the visitor's browser requests the image directly from that site.

6. Who we share data with

We do not share your data with third parties for their own purposes. We use these providers, who process data on our behalf (processors), to run the service:

We also use an uptime monitoring service (UptimeRobot) that only requests public pages, and a public exchange-rate service (Frankfurter) that our server queries for currency figures without sending any data about you.

Some of these providers may process data outside Mexico, for example in the United States or the European Union. When that happens, we rely on the contractual safeguards they offer for personal data processing.

Use of Google user data

Commission Tracker's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use your email, identifier and first name to create your account and let you sign in; we do not transfer them to third parties, we do not use them for advertising or to train models, and no one reads them except for security or legal obligation.

We may disclose data if a competent authority requires it by law.

7. Cookies and local storage

• Necessary cookies. When you use the app we set a session cookie, a cross-site request forgery (XSRF) protection cookie and, if you tick "remember me", a cookie that keeps you signed in. Without them you could not sign in. We do not use them for advertising or tracking.
• Browser local storage. We keep on your device display preferences (theme, language, chosen view, statistics range, custom colors) and a draft of the commission you are typing until you save it. A visitor to a public profile keeps there their language and light or dark mode. We also store that you have seen the cookie notice, so we do not show it to you again. None of this leaves your device, and you can clear it from your browser settings.
• This home page and the legal pages use no cookies and load no third-party resources.

8. How long we keep your data

• Your account data and what you add: as long as your account exists.
• When you delete your account (Settings, Danger zone) your commissions, clients, Finances entries, catalogs, settings, announcements, notes, passkeys, open sessions, recovery tokens and profile images are erased immediately.
• Security records and profile reports (with IP and browser): 12 months at most. Security records are no longer tied to you after the account is deleted.
• Backups: we make a daily copy of the database and keep it for up to 30 days. Data of a deleted account disappears from the backups when they expire.
• The invitation code you used: when you delete your account, the code's record (with its internal label) is kept, but it is no longer tied to you, either as the person who used it or as the person we gave it to so they could invite someone.
• Beta access requests: up to 90 days after we reply; if we accept you, only the code's internal label remains.
• Verification codes: they expire within minutes.

9. How we protect your data

• Encrypted connection (HTTPS) across the whole site.
• Hashed passwords, optional two-step verification and passkeys, and a limit on sign-in attempts.
• Client contact details encrypted in the database.
• Email alerts when someone signs in to your account from a new location, and a device list from which you can close sessions.
• A server with only the necessary ports open, an admin panel with two-step verification and backups in separate storage.

No system is completely invulnerable. If a breach significantly affecting your data occurs, we will tell you by email without undue delay.

10. Your rights

At any time and free of charge you can exercise your rights of access, rectification, cancellation and objection (ARCO), as well as portability, restriction of processing and withdrawal of consent where they apply.

• From the app: edit your data in Settings, export your commissions as CSV (Settings, Data) and delete your account (Settings, Danger zone).
• By email: write to support@mycommissiontracker.net from your account email, stating which right you are exercising and over which data. We aim to reply within 20 business days.

The CSV export in Settings includes your commissions, and Finances has its own CSV with your entries. If you need a copy of the rest of your data (clients, settings, announcements), ask for it by email.

11. Minors

Commission Tracker is for people aged 18 or older (or the age of majority in their country, if higher). We do not knowingly collect data from minors; if we detect an account belonging to a minor, we delete it.

12. Changes to this policy

If we change what we do with your data, we will update this page and the "Last updated" date. If the change is significant, we will tell you in the app or by email before it takes effect.

13. Contact and authority

Write to us at support@mycommissiontracker.net. If you believe your rights were not respected, you can go to the data protection authority of your country; in Mexico, the Secretaría Anticorrupción y Buen Gobierno (which took over the INAI's functions for the private sector). If you are in the European Union, you can go to your local data protection authority.