Privacy Policy

What we never ask for

We don't ask for your name, A-number, full receipt number, email, phone number, address, or date of birth, and there are no accounts or logins. Please don't include any of these in feedback or request messages.

What we collect

When you submit a timeline: the first 3–4 digits of your receipt number (the IOE prefix), receipt date, approval date, current work permit expiration date, status (pending or approved), filing method (online or mail), service center, whether biometrics were reused, country of origin, and where the case came from (your own case, Reddit, Facebook, or other). Only the receipt date, status, and source are required (plus the approval date for approved cases); everything else is optional.

When you send feedback, a quick rating, or a lost-token request: the text and fields you type in.

A hashed IP address. With every submission, update, deletion, feedback message, or lost-token request, we store a one-way hash of your IP address, made with a secret key kept only on our server. We don't store the IP itself, and the hash is designed so we can't practically recover your IP from it. We use it only to spot spam and duplicate submissions.

Update tokens. When you submit your own case, we create a random token that lets you update it later. We store the token linked to your submission and show it to you once. Anyone with the token can update that submission, so keep it private.

Site analytics. We use Vercel Web Analytics and Cloudflare Web Analytics to count page views. Neither uses cookies or tracks you across other sites.

Your browser. We save a few small flags in your browser's local storage, such as whether you dismissed a banner or the feedback popup. They never leave your device.

What is public

Timeline details (the fields listed under “When you submit a timeline”), plus the date each entry was added and its data-quality score, appear in the Explore table and feed the dashboard and trend charts. Hashed IP addresses, update tokens, feedback, and lost-token requests are never shown publicly. Only the site's server can read them.

How we protect it

The site is hosted on Vercel and the database on Supabase, and data is encrypted both in transit (HTTPS) and at rest.

How we use it

We use what we collect only to show processing trends, catch spam and duplicates, let you update your own submission, and improve the site. We don't sell, rent, or share it for advertising, and we don't run ads.

Government requests

We don't share data with USCIS, ICE, or any government agency. We don't collect names or A-numbers, and the project does not retain IP addresses. The most we hold is the timeline you see in Explore.

How long we keep it

Timelines stay up for as long as the tracker runs, because older data is what makes the trends useful, unless you delete yours. Feedback and lost-token requests are kept only as long as we need them to respond or improve the site.

Removing a submission

If you have your update token, you can delete your case yourself. Go to Update, look up your case, and choose “Delete my case.” It's removed right away and permanently, and the token stops working. You can delete one case per day. To prevent abuse, we keep a record that a deletion happened (the time and a hashed IP address, with no case details) for 90 days.

If you don't have a token, or the entry wasn't submitted by you, we can remove it for you. Because we don't know who submitted what, we can't look up “your” data by name. Find the timeline in the Explore table and send us its entry number, receipt date, and approximate submission date through the feedback form. We'll check the request against the original entry before removing it.

Not legal advice

This site is informational only and is not affiliated with USCIS or any government agency. It doesn't provide legal advice. Always consult an immigration attorney about your case.

Changes to this policy

If we change what we collect or how we use it, we'll update this page.