Privacy Policy

• We never receive your consulate username or password. They are encrypted on your own machine, and the app signs in through your own browser.
• We never see your card details. Payments are handled entirely by Stripe.
• We cannot tell which consulate account a license belongs to. The app sends us a one-way cryptographic hash, not your account.
• We do not sell or share your data for advertising, and we run no advertising trackers.

Your email address. Collected by Stripe at checkout and stored alongside your license so you can sign in and recover your key. Signing in sends a one-time link to that address; the link is valid for 15 minutes.

A session cookie. When you sign in we set a signed, HTTP-only cookie that contains only your email address. It lasts 30 days and is used solely to keep you signed in. It is not used for tracking or advertising.

Anything you type into a form. If you contact us or request a consulate, we receive what you send so we can reply.

When you activate a license, our server records:

• your license key;
• an account hash — a one-way HMAC-SHA256 of the consulate account identifier the app read from your signed-in session. This is what ties one license to one case. It cannot be reversed back into your login, and we never receive the underlying value;
• an activation log entry: the action taken, the time, and the IP address the request came from. We keep these to detect license sharing and abuse;
• your purchase record from Stripe — email, amount, currency, and Stripe's own identifiers. We do not store card numbers, and we never receive them.

If you use Telegram alerts, we also store the Telegram chat IDs you pair, so the service knows where to send alerts. You can remove a recipient at any time from inside the app.

Your consulate credentials. If you choose to save them, they are encrypted on disk with ChaCha20-Poly1305 using a key derived from your own machine, in a file readable only by your user account. They are sent only to the official consulate scheduling site, over your own browser session, and never to us. You do not have to save them at all — the app works from a session you sign in to yourself.

Your appointment data. Available dates, your case details, and your scheduling history are read in your browser and used to decide whether to alert you. They are not transmitted to us or stored on our servers.

Your browsing. The app drives your own Chrome profile. We have no visibility into it.

We keep this list short on purpose. Currently:

• Stripe — payment processing. Stripe collects and stores your payment details under its own privacy policy; we receive only your email, amount, and transaction identifiers.
• Resend — sends your license key, sign-in links, and replies.
• Fly.io — hosts the licensing service and its database.
• Telegram — delivers alerts, if you enable them. Messages are sent through Telegram's infrastructure and are subject to Telegram's own policies.

We do not currently run analytics, advertising pixels, or third-party trackers on this site. If that changes, we will update this page before doing so.

Because licenses do not expire, we keep your license record and purchase record for as long as the license exists — that is what lets you recover your key years later. Activation logs are kept for abuse detection. Support emails are kept as long as needed to handle the conversation.

You can ask us to delete your data at any time. Deleting your license record means the license can no longer be validated or recovered, so we will confirm before doing it.

Most people using this product are outside the United States, so we apply the same rights to everyone regardless of where you live. You can ask us to:

• tell you what data we hold about you;
• correct it if it is wrong;
• delete it;
• send you a copy in a portable format;
• stop processing it.

Email info@k1slottracker.com and we will respond within 30 days. If you are in the EU or UK and are unhappy with our response, you may complain to your local data protection authority.

Our legal basis for processing is performance of a contract (delivering and validating the license you bought) and our legitimate interest in preventing licence abuse.

Sign-in links and session cookies are cryptographically signed. License tokens are signed with Ed25519 and verified offline by the app. Credentials on your machine are encrypted at rest. That said, no system is perfectly secure — if you believe your license or account has been misused, email us and we will revoke and reissue.

This product is intended for adults pursuing a visa application. It is not directed at children, and we do not knowingly collect data from anyone under 16.

If we change this policy materially, we will update the date at the top and, for significant changes affecting existing customers, email you.

K-1 Slot Tracker
[BUSINESS ADDRESS]
info@k1slottracker.com

See also our Terms of Service.