Privacy policy
What we collect, what we do not, and what you can delete.
Last updated September 13, 2026
Overview
ImmigraMate ("we", "us", "our"), developed by Trovyn Tech LLC, is committed to protecting your privacy. This policy explains how we collect, use, store, and share your information when you use the ImmigraMate mobile app or the ImmigraMate website. By using either, you agree to the practices described here. This policy covers both. Where something applies to only one of them, it says so.
Information We Collect
We collect the minimum needed to deliver the features you use. We do not collect your name, phone number, geolocation, contacts, or government identification, and we do not upload documents or photographs from your device. Account information • Email address — required to create an account. It identifies your account, verifies it, and lets you reset your password. If you sign in with Google or Apple instead, we receive your email address and a provider identifier from them; we do not receive your password. • Username and display name — you choose these. They appear next to anything you post on the community board unless you post anonymously. You can use the case lookup on the website without an account. Tracking cases, the community board, saved records and ImmigraMate Plus all require one. Case information • Receipt numbers — the case identifiers you enter. For a case you ask us to track, the receipt number is stored on our server, because re-checking it with USCIS on a schedule is the feature. For a one-off lookup, it is not stored. • Case status and history — what USCIS returns for your cases, plus any nickname you give a case. • Saved records — calendar events, expenses, budgets, document reminders and CPT authorisations you create. Documents are reminders and metadata only: the file or photograph stays on your device and is never uploaded. Community board • Posts, comments and reactions you write, and the category you file them under. These are visible to other signed-in users. • Accounts you block, and content you report. Blocks are private to you. Reports are visible to our moderators. Other • Feedback you submit — your message, an optional email address, a rating, a category, your platform and the app or site version. • Push notification token — a device identifier used to send you case alerts, if you enable them. • Subscription records — which plan you hold and whether it is active. Card details are handled by Stripe, Apple or Google and are never seen by us. • Advertising identifier and ad interaction data (mobile free tier only) — accessed by Google to serve contextual banner ads. Not stored or read by us. The website carries no advertising, and ImmigraMate Plus subscribers see none anywhere.
How Your Data Is Used
We use what we collect to run the features you have chosen: • Receipt numbers are sent to the official USCIS Case Status API to retrieve case status. • Tracked cases are re-checked on a schedule so we can tell you when one moves. • Your email address is used to sign you in, verify your account, reset your password, and send you alerts you have asked for. We do not send marketing email. • Posts and comments are shown to other signed-in users on the community board. • Saved records are stored so they are there on your other devices. • Push tokens are used to send case alerts. • Feedback is used to read, understand and reply to you. • Subscription records verify your ImmigraMate Plus entitlement. We do not use your data for marketing or advertising profiles, and we do not sell it. We have never sold user data and will not. One use is worth stating plainly, because it goes beyond your own account: see "Aggregated Case Statistics" below.
Aggregated Case Statistics
ImmigraMate Plus includes case insights — typical timings for a form, drawn from real cases rather than from published estimates. Those figures are computed from the case histories in our system, including yours. How this is kept safe: • The figures are statistical only — how long a stage typically takes, and what proportion of cases reach it. No individual case, receipt number, account or person is identifiable from them. • A form is only reported on once at least 25 cases exist for it, and a stage only once at least 10 cases have reached it. Below those thresholds the app says there is not enough data rather than drawing a chart from a handful of people. • The response deliberately omits case counts and cohort sizes, so a figure cannot be narrowed down by watching it change. If you would prefer your cases not to contribute, email us and we will exclude them.
The Community Board
The community board is a public space for signed-in users. Please treat anything you write there as visible to every other signed-in user. • You can post under your display name or anonymously. An anonymous post does not show your name to other users, but it remains linked to your account in our database so that moderation, blocking and deletion can work. • You can delete your own posts and comments at any time. A deleted post is removed from the board, from search, and from its link. • You can block another account. You will not see their posts or replies again, and they are not told. • You can report a post or comment. Reports go to our moderators, who can hide content that breaks the rules in the Terms of Service. • Our administrators can view community content, including authorship of anonymous posts, for moderation and abuse investigation. Administrator actions are recorded in an audit log. Do not post anything you would not want a stranger to read, and do not post other people's receipt numbers or personal details.
Notifications
• Mobile, free tier — the app runs a background task on your device that checks your tracked cases and raises notifications locally. • ImmigraMate Plus — adds server-side tracking, so alerts arrive even when the app is closed, plus Visa Bulletin priority-date alerts. This is the only notification feature that stores a push token on our server. • Email — if you enable alerts for a tracked case or a priority date, we send them to your account email address. You can turn any of these off at any time.
Device Permissions
The mobile app may ask for the following. Each is optional and requested only when you use the related feature: • Camera and Photo Library — so you can attach a document photo to a case note. Photos you attach stay on your device and are never uploaded to our servers. • Face ID / biometric authentication — so you can optionally lock the app behind your device's biometrics. • Notifications — so the app can alert you about your cases. You can decline or revoke any of these in your device settings; the rest of the app keeps working.
Third-Party Services
We rely on a small set of providers. Each is bound by its own privacy policy and processes data only to deliver its part of the service. • U.S. Citizenship and Immigration Services (USCIS) — the official Case Status API. Receipt numbers are forwarded to USCIS to retrieve case status. • Supabase — hosts our database and handles account authentication, including sign-in with Google and Apple. https://supabase.com/privacy • Cloudflare — hosts the website and the backend service, and provides network security. https://www.cloudflare.com/privacypolicy/ • Stripe — processes subscription payments made on the website. Stripe receives your payment details directly; we never see your card number. https://stripe.com/privacy • RevenueCat — manages in-app purchases on mobile. Receives an anonymous identifier and your purchase history. https://www.revenuecat.com/privacy • Apple App Store / Google Play — process purchases made inside the mobile app. https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy • Expo Push Notification Service — delivers push notifications. Receives the push token and the message. https://expo.dev/privacy • Resend — delivers account email such as verification and password resets. Receives your email address and the message. https://resend.com/legal/privacy-policy • Google Mobile Ads (AdMob) — serves contextual banner ads to mobile free-tier users. Processes the device advertising identifier. https://policies.google.com/privacy • impact.com — attributes referrals from affiliate links. Receives the fact that a link was followed, not your case data. We do not share your case data, notes, receipt numbers or community posts with advertisers or affiliate partners.
Data Sharing
We do not sell your data. We do not share it with marketers or data brokers. The only flows out of ImmigraMate are the ones listed under "Third-Party Services", each necessary to deliver a feature you have chosen to use. We may disclose information if we are legally required to — for example, a valid court order — or where we believe in good faith that it is necessary to prevent serious harm. We are not aware of having received any such request. Third-party use or disclosure of user information, including de-identified, anonymised or pseudonymised data, is prohibited beyond what is necessary to deliver the contracted service.
Your Choices and Controls
• You can look up a case on the website without an account. • You can stop tracking a case at any time, which deletes its receipt number from our servers. • You can delete your posts, comments, saved records and tracked cases individually. • You can block other accounts, and post anonymously. • You can turn off notifications, in the app or in your device settings. Disabling push removes your push token from our server. • You can avoid advertising entirely by using the website, or by subscribing to ImmigraMate Plus. • You can manage or cancel ImmigraMate Plus through the App Store, Google Play, or the account page on the website, depending on where you subscribed. • You can ask us to exclude your cases from aggregated statistics. • You can ask us to delete your account and everything in it. See "Data Deletion".
Data Storage and Security
Your account, tracked cases, saved records and community posts are stored in our database, hosted by Supabase on infrastructure in the United States. All traffic between you and us, and between us and our providers, is encrypted in transit with HTTPS (TLS). Two deliberate choices are worth naming: • Our shared cache of USCIS responses is keyed by a hash of the receipt number, not the receipt number itself, so the cache cannot be read back into a list of real cases. • Our lookup statistics record a hash only, never the receipt. A receipt number is stored in full only for a case you have asked us to track, because re-checking it with USCIS is what tracking means. Access to production data is limited to administrators who need it, and administrator actions are recorded in an audit log. No system is perfectly secure, and we cannot guarantee absolute security.
Data Retention
• Account data is retained while your account is open. • Tracked cases are retained until you stop tracking them or close your account. • Cached USCIS responses expire automatically, within hours. • Community posts and comments remain until you delete them or close your account. • Saved records remain until you delete them or close your account. • Push tokens are retained while notifications are enabled, and are removed when you disable them, uninstall the app, or when our delivery provider reports the token as invalid. • Subscription and billing records are retained as long as required for tax and accounting purposes, which may outlast the account itself. • Feedback is retained so we can follow up and track what was reported. Data on your device — including any document photographs — remains there until you delete it or uninstall the app.
Data Deletion
You can delete most things yourself, at any time: individual cases, posts, comments, saved records and blocks. To close your account and delete everything associated with it, use Delete account on the account page, in the app or on this website. It takes effect immediately, and we do not ask you to email anyone or wait. If you would rather ask us to do it, email contact@trovyntech.com from the address on the account and we will process it within 30 days. What deletion removes: your email address and username, every case you were tracking and its receipt number, your saved records, your push tokens and your sign-in identities. The account is marked deleted and its email replaced with a placeholder, so nothing in it points back to you. What stays, and why: anything you posted on the community board remains, with no name attached and no link to you. A thread people replied to does not vanish because one person left, and the replies are other people's words. If you want a specific post or comment gone, delete it before you close the account — you can delete any of them at any time. Also retained: billing records we are required to keep for tax and accounting purposes, moderation records where content was removed for breaking the rules, and aggregated statistics, which contain no identifiable information and cannot be unpicked back to an individual. Cancelling a subscription is separate from deleting an account — cancel through the App Store, Google Play, or the account page, depending on where you subscribed.
Your Rights Under CCPA, GDPR, and Other Privacy Laws
If you are a California resident or are otherwise covered by applicable privacy law (including the GDPR), you have the right to: • Know what data we collect and how it is used • Access your data, and receive a copy of it • Request correction or deletion of your data • Opt out of the sale of personal data (we do not sell data) • Withdraw consent at any time • Lodge a complaint with your local data protection authority • Not be discriminated against for exercising your privacy rights To exercise any of these, contact us at contact@trovyntech.com. We respond within 30 days (CCPA: 45 days).
Children's Privacy
ImmigraMate is not directed at children under 13, and accounts are not intended for them. We do not knowingly collect information from children under 13. If we learn that we have, we will delete it promptly.
Data Breach Notification
In the event of a data breach affecting our infrastructure, we will notify affected users by email, in the app, and on this website within 72 hours of discovering it. The notification will describe the nature and scope of the breach, the types of data affected, what we are doing about it, and what we recommend you do.
Transfer of Ownership
If Trovyn Tech LLC undergoes a merger, acquisition, sale, or transfer of assets, we will ensure the acquiring entity's privacy practices provide protections at least equivalent to those described here. If equivalent protections cannot be maintained, we will notify you and give you the opportunity to export and delete your data before the transition. We will give notice of any change in ownership at least 30 days before it takes effect.
Changes to This Policy
We may update this policy. When a change materially affects how we collect, use or share your data, we will: • Notify you by email and in the app • Provide a plain-language summary of what changed • Update the "Last updated" date at the top of this page You will have the opportunity to review the change and decide whether to continue using ImmigraMate under the updated policy.
Contact
If you have questions about this policy or wish to exercise your data rights, email contact@trovyntech.com or use the contact form on this site.