Privacy Policy

Last updated: November 6, 2026

CoreTrack Hub ("we", "the app") is a media-buyer tracking and campaign-management portal available at trackwork.online. This page explains what data we collect, why, and what we do with it — including data we access through your Google account.

1. Who this applies to

This policy covers every person who logs into CoreTrack Hub as a media buyer, and anyone who clicks a tracking link generated by the app.

2. Data we collect

Account data — your display name and a bcrypt-hashed access code. We never store your access code in plain text.
Offers, rotators and campaign mappings you create, including the target URLs and parameters you configure.
Click data for links you create — timestamp, device type, country (from your CDN/proxy header), the Google click identifier (gclid/gbraid/wbraid) if present, and a one-way keyed hash of the visitor's IP and user agent used only for 24-hour duplicate detection. We never store the raw IP address or user agent.
Conversion postbacks your own tracker sends us (click id, payout, currency, event name).
Google Ads data, described in the next section.

3. Google user data

When you click "Link New Google Account," Google asks you to approve the https://www.googleapis.com/auth/adwords scope. If you approve, we receive an OAuth token that we use only to:

list the Google Ads accounts you can access (including client accounts under any manager account you use),
read campaign names, status and performance statistics for campaigns you choose to map to an offer,
start or pause those specific campaigns when you use the app's controls or its autopilot schedule,
upload offline conversions to a conversion action you select, for clicks that carried a gclid Google itself issued.

We do not read, modify or delete anything in your Google account beyond what is listed above. We do not sell, rent or share your Google data with any third party, and we do not use it to serve ads or for any purpose other than operating the features you directly use inside CoreTrack Hub.

Your OAuth tokens are encrypted at rest (AES-256-GCM) and are never sent to your browser. You can revoke access at any time from inside the app ("Traffic Sources" → unlink) or directly from your Google Account at myaccount.google.com/permissions. Unlinking deletes the stored token and pauses any mapping that depended on it.

CoreTrack Hub's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How long we keep data

Click logs are kept for a configurable retention window (120 days by default) and then deleted automatically. Google OAuth tokens and account data are kept until you unlink the account or delete your login.

5. Security

Access codes are hashed with bcrypt; sessions use short-lived tokens with server-side revocation; Google tokens and the postback key are encrypted at rest; all traffic to the app is served over HTTPS.

6. Your choices

You can unlink any Google account, delete offers/rotators/mappings you created, or ask us to delete your login and associated data entirely by contacting us (below).

7. Changes to this policy

If this policy changes, we will update the "Last updated" date above.

8. Contact

Questions about this policy or your data: contact@trackwork.online

← Back to CoreTrack Hub · Terms of Service