Standalone application tracker at /tracker with GDPR integration

- /tracker route: vault-gated encrypted application tracking
- Add/edit/delete applications with company, position, platform, status
- Status flow: Applied, Screening, Interview, Offer, Rejected, Withdrawn
- Desktop table view, mobile card view, search/filter by company
- Stats panel: total, by status, this week/month
- GDPR actions: Generate DSAR (Article 15), Request Erasure (Article 17)
- GDPR buttons labeled for EU users, universal tracker for everyone
- Migrated legacy gdpr-applications to shared tracker namespace
- TrackerApplicationRecord extends ApplicationRecord with positionTitle, status
- Audit events: application_created, application_updated, application_deleted
- Nav entry between Scan and Audit with clipboard icon
- Fourth feature card on landing page
- Privacy note: all data encrypted locally, never sent to any server

Author: cameronhopkin

apps/web/src/app.css

@@ -325,7 +325,7 @@ button {
   inset: auto 0 0;
   z-index: 30;
   display: grid;
-  grid-template-columns: repeat(5, minmax(0, 1fr));
+  grid-template-columns: repeat(6, minmax(0, 1fr));
   gap: 0.5rem;
   padding:
     0.75rem 0.75rem

apps/web/src/lib/components/AppShell.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import {
+    ClipboardList,
     FileText,
     Radar,
     ScanSearch,
@@ -25,6 +26,7 @@
   const navItems: NavItem[] = [
     { href: '/resumes', label: 'Resumes', icon: FileText },
     { href: '/scan', label: 'Scan', icon: ScanSearch },
+    { href: '/tracker', label: 'Tracker', icon: ClipboardList },
     { href: '/audit', label: 'Audit', icon: Radar },
     { href: '/settings', label: 'Settings', icon: Settings },
     { href: '/attack-mode', label: 'Attack Mode', icon: ShieldAlert, tone: 'danger' },

apps/web/src/lib/resume-vault.ts

@@ -1,5 +1,5 @@
 import { appendEntry, getEntries, initAudit, type AuditEvent } from '@shieldcv/audit';
-import type { ApplicationRecord } from '@shieldcv/compliance';
+import type { ApplicationRecord, TrackerApplicationRecord } from '@shieldcv/compliance';
 import { createBlankResume, normalizeResumeDocument, type ResumeDocument } from '@shieldcv/resume';
 import { EncryptedStore } from '@shieldcv/storage';
 import { writable } from 'svelte/store';
@@ -8,6 +8,7 @@ import { ATTACK_MODE_AUDIT_DATABASE_NAME, ATTACK_MODE_AUDIT_FLAG } from '$lib/de
 const DATABASE_NAME = 'shieldcv-local-vault';
 const RESUME_NAMESPACE = 'resume';
 const GDPR_APPLICATION_NAMESPACE = 'gdpr-applications';
+const TRACKER_APPLICATION_NAMESPACE = 'tracker';
 export const MAX_RESUME_SIZE = 500_000;
 export type VaultLockReason = 'manual' | 'inactivity';
 
@@ -71,6 +72,53 @@ function fireAndForgetAudit(event: AuditEvent, details: string): void {
   });
 }
 
+function normalizeTrackerApplication(record: ApplicationRecord | TrackerApplicationRecord): TrackerApplicationRecord {
+  return {
+    ...record,
+    positionTitle:
+      'positionTitle' in record && typeof record.positionTitle === 'string' ? record.positionTitle : '',
+    status:
+      'status' in record &&
+      typeof record.status === 'string' &&
+      ['applied', 'screening', 'interview', 'offer', 'rejected', 'withdrawn'].includes(record.status)
+        ? record.status
+        : 'applied',
+  };
+}
+
+async function migrateLegacyGdprApplications(store: EncryptedStore): Promise<void> {
+  const trackerIds = await store.list(TRACKER_APPLICATION_NAMESPACE);
+  const legacyIds = await store.list(GDPR_APPLICATION_NAMESPACE);
+
+  if (legacyIds.length === 0) {
+    return;
+  }
+
+  const trackerIdSet = new Set(trackerIds);
+
+  await Promise.all(
+    legacyIds.map(async (id) => {
+      if (trackerIdSet.has(id)) {
+        await store.delete(GDPR_APPLICATION_NAMESPACE, id);
+        return;
+      }
+
+      const legacyRecord = await store.get<ApplicationRecord>(GDPR_APPLICATION_NAMESPACE, id);
+
+      if (!legacyRecord) {
+        return;
+      }
+
+      await store.put(
+        TRACKER_APPLICATION_NAMESPACE,
+        legacyRecord.id,
+        normalizeTrackerApplication(legacyRecord),
+      );
+      await store.delete(GDPR_APPLICATION_NAMESPACE, id);
+    }),
+  );
+}
+
 export async function unlockVault(passphrase: string): Promise<void> {
   vaultStatus.set('unlocking');
 
@@ -164,27 +212,83 @@ export async function deleteResume(id: string): Promise<void> {
   fireAndForgetAudit('resume_deleted', `Deleted resume ${id}`);
 }
 
-export async function listGdprApplications(): Promise<ApplicationRecord[]> {
+export async function listGdprApplications(): Promise<TrackerApplicationRecord[]> {
+  const records = await listTrackerApplications();
+  return records;
+}
+
+export async function saveGdprApplication(record: ApplicationRecord): Promise<ApplicationRecord> {
+  return saveTrackerApplication(normalizeTrackerApplication(record));
+}
+
+export async function deleteGdprApplication(id: string): Promise<void> {
+  await deleteTrackerApplication(id);
+}
+
+export async function listTrackerApplications(): Promise<TrackerApplicationRecord[]> {
   const store = await resumeStore();
-  const ids = await store.list(GDPR_APPLICATION_NAMESPACE);
+  await migrateLegacyGdprApplications(store);
+  const ids = await store.list(TRACKER_APPLICATION_NAMESPACE);
   const records = await Promise.all(
-    ids.map((id) => store.get<ApplicationRecord>(GDPR_APPLICATION_NAMESPACE, id)),
+    ids.map((id) => store.get<TrackerApplicationRecord>(TRACKER_APPLICATION_NAMESPACE, id)),
   );
 
   return records
-    .filter((record): record is ApplicationRecord => record !== undefined)
+    .filter((record): record is TrackerApplicationRecord => record !== undefined)
+    .map((record) => normalizeTrackerApplication(record))
     .sort((left, right) => right.dateApplied.localeCompare(left.dateApplied));
 }
 
-export async function saveGdprApplication(record: ApplicationRecord): Promise<ApplicationRecord> {
+export async function saveTrackerApplication(
+  record: TrackerApplicationRecord,
+): Promise<TrackerApplicationRecord> {
   const store = await resumeStore();
-  await store.put(GDPR_APPLICATION_NAMESPACE, record.id, record);
+  await migrateLegacyGdprApplications(store);
+  await store.put(TRACKER_APPLICATION_NAMESPACE, record.id, normalizeTrackerApplication(record));
   return record;
 }
 
-export async function deleteGdprApplication(id: string): Promise<void> {
+export async function deleteTrackerApplication(id: string): Promise<void> {
+  const store = await resumeStore();
+  await migrateLegacyGdprApplications(store);
+  await store.delete(TRACKER_APPLICATION_NAMESPACE, id);
+}
+
+export async function createTrackerApplication(
+  record: TrackerApplicationRecord,
+): Promise<TrackerApplicationRecord> {
+  const normalized = normalizeTrackerApplication(record);
+  await saveTrackerApplication(normalized);
+  fireAndForgetAudit(
+    'application_created',
+    `Created application for ${normalized.company} - ${normalized.positionTitle} on ${normalized.platform}.`,
+  );
+  return normalized;
+}
+
+export async function updateTrackerApplication(
+  record: TrackerApplicationRecord,
+): Promise<TrackerApplicationRecord> {
+  const normalized = normalizeTrackerApplication(record);
+  await saveTrackerApplication(normalized);
+  fireAndForgetAudit(
+    'application_updated',
+    `Updated application for ${normalized.company} - ${normalized.positionTitle} on ${normalized.platform}.`,
+  );
+  return normalized;
+}
+
+export async function removeTrackerApplication(id: string): Promise<void> {
   const store = await resumeStore();
-  await store.delete(GDPR_APPLICATION_NAMESPACE, id);
+  await migrateLegacyGdprApplications(store);
+  const existing = await store.get<TrackerApplicationRecord>(TRACKER_APPLICATION_NAMESPACE, id);
+  await store.delete(TRACKER_APPLICATION_NAMESPACE, id);
+  fireAndForgetAudit(
+    'application_deleted',
+    existing
+      ? `Deleted application for ${existing.company} - ${existing.positionTitle} on ${existing.platform}.`
+      : `Deleted application ${id}.`,
+  );
 }
 
 function clearBrowserStorage(): void {

apps/web/src/routes/+page.svelte

@@ -2,6 +2,7 @@
   import {
     ArrowRight,
     ChartNoAxesColumn,
+    ClipboardList,
     ExternalLink,
     ScanSearch,
     Shield,
@@ -38,6 +39,14 @@
       linkLabel: 'Enter Attack Mode',
       icon: ShieldAlert,
     },
+    {
+      title: 'Application Tracker',
+      description:
+        'Track every job application in one encrypted place. Know which companies have your data. Exercise your GDPR rights with one click.',
+      href: '/tracker',
+      linkLabel: 'Start tracking',
+      icon: ClipboardList,
+    },
   ] as const;
 
   const securityProperties = [

apps/web/src/routes/audit/+page.svelte

@@ -2,6 +2,7 @@
   import { onMount } from 'svelte';
   import {
     AlertTriangle,
+    BriefcaseBusiness,
     Download,
     FileText,
     Search,
@@ -59,6 +60,10 @@
       return { colorClass: 'audit-event--resume', icon: FileText, label: event.replaceAll('_', ' ') };
     }
 
+    if (event.startsWith('application_')) {
+      return { colorClass: 'audit-event--resume', icon: BriefcaseBusiness, label: event.replaceAll('_', ' ') };
+    }
+
     if (event.startsWith('scan_')) {
       return { colorClass: 'audit-event--scan', icon: Search, label: event.replaceAll('_', ' ') };
     }

apps/web/src/routes/scan/+page.svelte

@@ -28,12 +28,13 @@
   } from '$lib/ats-match';
   import { ATS_DEMO_JOB_DESCRIPTION } from '$lib/fixtures/demo-job-description';
   import {
-    deleteGdprApplication,
+    createTrackerApplication,
     isVaultUnlocked,
     listGdprApplications,
     listResumes,
-    saveGdprApplication,
+    removeTrackerApplication,
     unlockVault,
+    updateTrackerApplication,
     vaultStatus,
   } from '$lib/resume-vault';
   import type { ResumeDocument } from '@shieldcv/resume';
@@ -44,6 +45,7 @@
     GdprEducationContent,
     PhiFinding,
     ScanResult,
+    TrackerApplicationRecord,
   } from '@shieldcv/compliance';
 
   type AiModule = typeof import('@shieldcv/ai');
@@ -98,7 +100,7 @@
   let cmmcScannedLabel = '';
 
   let gdprEducation: GdprEducationContent | null = null;
-  let applications: ApplicationRecord[] = [];
+  let applications: TrackerApplicationRecord[] = [];
   let platformOptions: string[] = [];
   let gdprPlatform = 'LinkedIn';
   let gdprCompany = '';
@@ -560,14 +562,14 @@
       return;
     }
 
-    const record = compliance?.createApplicationRecord(gdprPlatform, gdprCompany);
+    const record = compliance?.createTrackerApplicationRecord(gdprPlatform, gdprCompany, '');
 
     if (!record) {
       return;
     }
 
     const appliedAt = new Date(`${gdprDateApplied}T00:00:00.000Z`).toISOString();
-    await saveGdprApplication({
+    await createTrackerApplication({
       ...record,
       dateApplied: appliedAt,
     });
@@ -577,7 +579,7 @@
     copyStatus = `Saved ${gdprPlatform} application for ${applications[0]?.company ?? 'company'}.`;
   }
 
-  async function generateGdprEmail(record: ApplicationRecord, kind: 'dsar' | 'erasure') {
+  async function generateGdprEmail(record: TrackerApplicationRecord, kind: 'dsar' | 'erasure') {
     if (!compliance) {
       return;
     }
@@ -594,7 +596,7 @@
     );
 
     const now = new Date().toISOString();
-    const updatedRecord: ApplicationRecord =
+    const updatedRecord: TrackerApplicationRecord =
       kind === 'dsar'
         ? {
             ...record,
@@ -608,7 +610,7 @@
             erasureDate: now,
           };
 
-    await saveGdprApplication(updatedRecord);
+    await updateTrackerApplication(updatedRecord);
     applications = await listGdprApplications();
 
     if (kind === 'dsar') {
@@ -621,7 +623,7 @@
   }
 
   async function removeApplication(id: string) {
-    await deleteGdprApplication(id);
+    await removeTrackerApplication(id);
     applications = await listGdprApplications();
     copyStatus = 'Removed application from the encrypted GDPR tracker.';
   }