Privacy Policy

Last Updated: September 14, 2026

1. Introduction

Welcome to TraceOverlay ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website traceoverlay.com, our hosted services, or our native mobile app.

TraceOverlay has two related experiences with different data boundaries:

Hosted website and services: The account, subscription, support, and analytics features described below.
Native mobile app: A no-account tracing tool. Camera frames and selected reference images are processed locally on the device. The native app does not use the hosted account or Stripe subscription system.

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access our website or use our services.

Contact Information:

Email: [email protected]
Website: traceoverlay.com

2. Information We Collect

2.1 Personal Information You Provide to Us

We collect information you provide directly to us, including:

Account Information: Name, email address, and profile information
Payment Information: Billing address and payment method details (processed securely by Stripe)
Communications: Messages, feedback, and support inquiries

For the native mobile app's one-time Unlock purchase, Apple or Google Play processes the payment and provides the store transaction or entitlement status needed to enable the feature. TraceOverlay does not receive your payment-card details.

2.2 Information Automatically Collected

When you use our hosted website and services, we automatically collect certain information:

Device Information: Browser type, operating system, and device category
Usage Information: Pages and features used, tracing-session milestones, and categorized success or failure outcomes
Log Data: Request metadata, including IP address, user agent, and timestamps

The hosted website uses our self-hosted Umami service to measure visits, feature use, and the steps leading to paid access. Website analytics uses Umami session measurements without sending an account or customer identifier. Our server separately reports payment and access outcomes in aggregate; it does not send Stripe customer, subscription, checkout, or transaction identifiers to Umami. Analytics includes bounded context such as platform, app version, build, release channel, source surface, event schema version, and test classification. It excludes names, email addresses, typed input, image names or contents, camera frames, payment details, raw error messages, and URLs containing query strings or secrets.

2.3 Cookies and Tracking Technologies

We use cookies for hosted authentication and browser storage for settings and selected reference images. Umami analytics does not use analytics cookies. Our website also stores limited journey state for attribution and event deduplication. See our Cookie Policy for details.

2.4 Native App Camera and Image Handling

Images stay local to your device. The native mobile app processes camera frames and selected reference images on-device for tracing and for the local reference shelf. TraceOverlay does not upload or retain those images, and TraceOverlay staff cannot view them. The app's purchase flow is handled by Apple or Google Play; it does not send camera frames or reference images to TraceOverlay.

2.5 Native App Analytics

The native app sends pseudonymous product-interaction analytics to our self-hosted Umami service, including permission and import outcomes, usable tracing and session milestones, app and feature interactions, and purchase, restore, or access outcomes. Events include platform, app version, build, release channel, source surface, event schema version, and test classification. It does not send store receipts, transaction identifiers, payment details, email addresses, typed input, image names, image contents, camera frames, raw error messages, or URLs containing query strings or secrets.

The app stores a randomly generated installation identifier in app-local storage so separate app opens from the same installation can be counted together. This identifier is not derived from your name, account, advertising ID, hardware/device identifier, store account, images, or purchase records. Clearing app data or uninstalling the app resets it. This installation identifier is pseudonymous: it distinguishes an installation over time even though it does not name you.

Umami also processes request metadata such as IP address, user agent, device type, operating system, timestamps, and approximate location. The app keeps a limited queue of analytics events locally while offline and retries delivery when a connection is available. Tracing continues to work when analytics is unavailable. The app does not use analytics cookies or use this data to track you across other companies' apps or websites.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Provision

To provide, maintain, and improve our services
To process hosted-service subscriptions when you use the website
To provide customer support
To communicate about updates and security

3.2 Security and Fraud Prevention

To verify your identity and prevent fraud
To protect against abuse and unauthorized access
To comply with legal obligations

3.3 Analytics and Improvement

To analyze usage patterns and improve our services
To develop new features

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal information on the following legal bases:

Contract: To fulfill our obligations under our Terms of Service
Legitimate Interest: To prevent fraud, ensure security, and improve our services
Consent: For marketing communications and non-essential cookies
Legal Obligation: To comply with legal requirements

5. Information Sharing and Disclosure

5.1 Service Providers and Infrastructure

We use the following services and infrastructure to operate TraceOverlay:

Payment Processor: Stripe for secure payment processing
Mobile app stores: Apple and Google Play process native-app purchase transactions and provide entitlement status under their own privacy policies
Hosting infrastructure: We operate the hosted application and analytics service on our own managed infrastructure
Analytics infrastructure: Our self-hosted Umami service processes website and native-app analytics as described above
Authentication: Google OAuth (if you choose to sign in with Google)

5.2 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred.

5.3 Legal Requirements

We may disclose information if required to do so by law or in response to valid legal requests.

6. Data Retention

We retain your personal information for as long as necessary to provide our services:

Account Information: Retained while your account is active, then deleted within 30 days of account closure
Transaction Records: Retained for 7 years for tax and legal purposes
Support Communications: Retained for 2 years for quality assurance
Analytics Data: Retained for up to 2 years
Native app installation identifier: Retained with native analytics for up to 2 years; the local copy remains until app data is cleared or the app is uninstalled
Native app images and camera frames: Kept on your device under your control; TraceOverlay does not retain them
Native app purchase records: Store transaction data is retained by Apple or Google Play under their respective policies

7. Your Privacy Rights

7.1 General Rights

Depending on your location, you may have the following rights:

Access: Request a copy of your personal information
Rectification: Request correction of inaccurate information
Deletion: Request deletion of your personal information
Portability: Request transfer of your data to another service
Objection: Object to processing of your information

7.2 How to Exercise Your Rights

To exercise your rights, contact us at:

Email: [email protected]
Subject Line: "Privacy Rights Request"

We will respond to your request within 30 days.

7.3 California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA). See our Do Not Sell My Info page.

7.4 European Union Rights (GDPR)

If you are located in the EEA, you have additional rights under GDPR, including the right to:

Withdraw consent at any time
Lodge a complaint with a supervisory authority
Receive information about data breaches

8. Children's Privacy

The native TraceOverlay app is a general-audience creative tool and may be used by people of any age. It does not require an account, and its camera frames and selected reference images stay local to the device. The app collects the pseudonymous installation and usage data described in section 2.5; it does not ask users for their age or identity. Apple or Google Play may process account and purchase information when a store transaction is made under their own policies.

The hosted website and services may require an account or payment and are not directed to children under 13. If you are a parent or guardian and believe a child has provided personal information through the hosted services, please contact us.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer your information, we ensure appropriate safeguards are in place to protect your privacy.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

Encryption: Data encrypted in transit (HTTPS) and at rest
Access Controls: Limited access to personal information
Security Audits: Regular security assessments

However, no method of transmission over the internet is 100% secure.

11. Data Breaches

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you:

Without undue delay and within 72 hours (GDPR)
In the most expedient time possible (CCPA)

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised "Last Updated" date.

We will notify you of material changes by:

Posting a notice on our website
Sending an email notification

13. Governing Law

This Privacy Policy is governed by the laws of California, United States, without regard to its conflict of law provisions.

14. Contact Us

If you have questions about this Privacy Policy, please contact us:

Email: [email protected]
Website: traceoverlay.com

Privacy Policy Version: 1.3 Effective Date: September 14, 2026