What we hold, and what we do not

The short version

Your statements are yours. We read them to tell you what you were paid and what went unpaid, and we do not sell, share, or train anything on them. No other customer can see your data, and no third party receives your statements.

What we store

When you upload a royalty statement we keep:

• The cue titles, work IDs, amounts and currencies on it.
• Where each line was earned: society, territory, channel, show, period.
• The performance counts, where the statement carries them.
• The file name, the upload time, and totals derived from the above.

We keep a filtered copy of each original row so a mis-parse can be diagnosed. Columns that identify a person or an account are removed before it is stored, including party and member IDs, recipient names, IPI and CAE numbers, tax IDs and addresses. The names of the removed columns are kept; their contents are not.

Your account itself holds an email address, an optional name, and your billing status. That is all.

Where the file goes

The CSV is read in your browser. The file itself is never uploaded to us and we never hold a copy of it. Only the extracted rows above are sent, over TLS, to our database.

Encryption, stated plainly

Everything is encrypted in transit, between your browser and the site and between the site and the database. The database is encrypted at rest on disk. Passwords are never stored, only a one-way hash held by our authentication provider, and nobody here can read yours.

We will not tell you your statements are end-to-end encrypted, because they are not. Encryption at rest protects against a stolen disk. It does not mean the data is unreadable to us, and a service that has to add up your royalties cannot hold them in a form it cannot read. Anyone claiming otherwise about a reconciliation tool is describing something that would not work.

What we do instead is hold as little as possible and enforce isolation at the database itself, described next.

Who can see it

Every table is protected by row-level security, which is enforced by the database rather than by our application code. Each policy compares the row's owner against the signed-in account. A request for another customer's rows returns nothing, not an error, because the rows are not visible to it at all.

An unauthenticated request has no access to any table. Staff access is used only to operate the service or to answer a support question you have raised.

Who else receives it

Nobody, other than the providers that run the service:

• Supabase hosts the database and handles sign-in.
• Netlify serves the site.
• Resend delivers account emails such as confirmations and password resets.
• Google Fonts serves the two typefaces this site is set in. Loading a page requests them from Google, which means Google sees your IP address and browser version. It receives nothing else: no account, no statement, and no record of what you did here.

There is no analytics, advertising or tracking on the signed-in portal. Your statement data is not sent to any of the above beyond the database that holds it, and it is never used to train a model.

Deleting it

You can remove any statement from the Statements page. Deleting it removes its lines too, immediately and permanently.

To delete your account and everything in it, use Delete everything on your settings page. It removes your statements, their lines, your saved currencies, your account record and your sign-in together, at once, and it cannot be undone. You can also ask for a copy of everything we hold about you at hello@ontrk.app.

How long we keep it

Your statements stay until you delete them or close your account. Royalty data is useful for years, and a gap in a settled quarter can only be found by comparing against periods that came before it, so we do not expire it on a timer.

Questions

hello@ontrk.app. If something on this page is not true of what you see in the product, tell us and we will fix whichever one is wrong.