GPSTrack is three products under one account system — a live telematics dashboard, Track Me, and Meterless — plus this blog. This page explains what each one does with your data. Every claim here can be checked against the source at github.com, or from a browser's own network tab; nothing below is a promise that only the server can see is kept.
The short version
- Track Me and Meterless never send anything anywhere. Recordings live in your browser's IndexedDB. There is no server call in that path to intercept, retain or hand over to anyone.
- The dashboard has two modes. Open it with no account and every point is relayed through server memory and discarded, never written to disk. Claim a device — which requires an account — and its points are stored, because that is what an account is for.
- An account is an email address, a password, and an optional display name. Nothing about it is sold, shared for advertising, or used for anything other than running GPSTrack.
Using GPSTrack without an account
Opening the dashboard creates a temporary session: a random id and a secret token, good for 30 days from the last time it was used. Points pushed to that session pass through server memory on their way to the browser drawing the map, and are never written to a database or a disk. Closing every tab that holds the session's key, or letting it sit unused for 30 days, is the end of it.
Track Me and Meterless do not talk to the server at all. Both read your phone's location through the browser's Geolocation API, keep it in IndexedDB, and draw the map from that. Turning off networking mid-recording does not stop either of them working, because there is no upload for networking to interrupt.
Accounts
Creating an account takes an email address and a password. The password is never stored: it is passed through scrypt, a slow one-way hash, and only the hash is kept — nobody at GPSTrack, including whoever holds a copy of the database, can recover the original password from it. A display name is optional and is never used as a login identifier.
Signing in sets one cookie, scoped to this domain. It is marked HttpOnly, so a script running on the page cannot read it, and SameSite=Lax, so a cross-site request cannot ride along with it. It carries no information about you beyond an opaque session id, and it is the only cookie GPSTrack sets — there are no third-party advertising or tracking cookies anywhere on the site. It expires 30 days after your last visit and is cleared the moment you sign out.
Your email address is used for two things only: confirming it belongs to you, and letting you reset a forgotten password. Both are sent through Resend, a transactional email provider — the one outside company GPSTrack's data passes through, and only for the message itself. You will never receive marketing mail at that address.
Claimed devices and stored history
Naming and claiming a session turns it into a device, and that is the point at which GPSTrack starts storing what it receives: every point pushed to a claimed device is written to disk, compressed, tied to your account.
That storage is bounded, not indefinite. Each account keeps up to 500MB of compressed history or one year of points, whichever is reached first. When an account is over budget, the oldest points are reduced to a lower resolution before anything is deleted outright, and if points still have to go, the oldest are dropped first — the newest point pushed by a device is never the one that gets removed.
Deleting a device removes its stored history immediately, not on some later sweep. Deleting your account removes every device on it the same way, then the account itself, and signs you out. Both are self-service, from the dashboard and the account page respectively — reaching out is never required to get your data removed.
IP addresses
Sign-up, sign-in and outgoing mail are rate-limited by IP address to stop one script from creating accounts or exhausting the mail quota. That counting happens in memory, resets on every server restart, and is never written to the database — there is no table anywhere in GPSTrack that holds an IP address.
Analytics
If a measurement id is configured, Google Analytics loads on marketing pages only — the homepage, the blog, and the three product landing pages. It never loads on the dashboard, on a shared view link, or while Track Me or Meterless is actually recording, because those URLs can carry a session id or a share id that has no business reaching a third party. Analytics sees a pageview. It never sees a position.
Changes to this policy
If what GPSTrack collects or does with it changes, this page changes in the same release — the date at the top will move. It will not be softened after the fact to match code that changed without it.
Contact
Questions about this policy or about data GPSTrack holds on you can go to contact@gpstrack.dev.