Privacy Policy

Privacy Policy

Last Updated: September 3, 2026

1. Introduction

Welcome to TraceOverlay ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website traceoverlay.com, our hosted services, or our native mobile app.

TraceOverlay has two related experiences with different data boundaries:

  • Hosted website and services: The account, subscription, support, and analytics features described below.
  • Native mobile app: A no-account tracing tool. Camera frames and selected reference images are processed locally on the device. The native app does not use the hosted account or Stripe subscription system.

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access our website or use our services.

Contact Information:

2. Information We Collect

2.1 Personal Information You Provide to Us

We collect information you provide directly to us, including:

  • Account Information: Name, email address, and profile information
  • Payment Information: Billing address and payment method details (processed securely by Stripe)
  • Communications: Messages, feedback, and support inquiries

For the native mobile app's one-time Unlock purchase, Apple or Google Play processes the payment and provides the store transaction or entitlement status needed to enable the feature. TraceOverlay does not receive your payment-card details.

2.2 Information Automatically Collected

When you use our hosted website and services, we automatically collect certain information:

  • Device Information: Browser type, operating system, device identifiers
  • Usage Information: Features used, time spent, error reports
  • Log Data: Access logs, timestamps

2.3 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your activities on our website. See our Cookie Policy for details.

2.4 Native App Camera and Image Handling

Images stay local to your device. The native mobile app processes camera frames and selected reference images on-device for tracing and for the local reference shelf. TraceOverlay does not upload or retain those images, and TraceOverlay staff cannot view them. The app's purchase flow is handled by Apple or Google Play; it does not send camera frames or reference images to TraceOverlay.

2.5 Native App Analytics

The native app sends privacy-focused product-interaction analytics to our Umami service, including app and feature interactions and purchase or restore outcomes. It does not send StoreKit receipts, transaction identifiers, payment details, image names, image contents, or camera frames. The app stores a randomly generated installation identifier in app-local storage so separate app opens from the same installation can be counted together. This identifier is not derived from your name, account, advertising ID, hardware/device identifier, store account, images, or purchase records. Clearing app data or uninstalling the app resets it. Umami also processes request metadata such as IP address, user agent, device type, operating system, timestamps, and approximate location. The app does not use analytics cookies or use this data to track you across other companies' apps or websites.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Provision

  • To provide, maintain, and improve our services
  • To process hosted-service subscriptions when you use the website
  • To provide customer support
  • To communicate about updates and security

3.2 Security and Fraud Prevention

  • To verify your identity and prevent fraud
  • To protect against abuse and unauthorized access
  • To comply with legal obligations

3.3 Analytics and Improvement

  • To analyze usage patterns and improve our services
  • To develop new features

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal information on the following legal bases:

  • Contract: To fulfill our obligations under our Terms of Service
  • Legitimate Interest: To prevent fraud, ensure security, and improve our services
  • Consent: For marketing communications and non-essential cookies
  • Legal Obligation: To comply with legal requirements

5. Information Sharing and Disclosure

5.1 Third-Party Service Providers

We share your information with trusted third parties who assist us in operating our services:

  • Payment Processor: Stripe for secure payment processing
  • Mobile app stores: Apple and Google Play process native-app purchase transactions and provide entitlement status under their own privacy policies
  • Hosting Provider: Vercel for cloud infrastructure
  • Analytics: Umami (privacy-focused product analytics)
  • Authentication: Google OAuth (if you choose to sign in with Google)

5.2 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred.

5.3 Legal Requirements

We may disclose information if required to do so by law or in response to valid legal requests.

6. Data Retention

We retain your personal information for as long as necessary to provide our services:

  • Account Information: Retained while your account is active, then deleted within 30 days of account closure
  • Transaction Records: Retained for 7 years for tax and legal purposes
  • Support Communications: Retained for 2 years for quality assurance
  • Analytics Data: Retained for up to 2 years
  • Native app installation identifier: Retained with native analytics for up to 2 years; the local copy remains until app data is cleared or the app is uninstalled
  • Native app images and camera frames: Kept on your device under your control; TraceOverlay does not retain them
  • Native app purchase records: Store transaction data is retained by Apple or Google Play under their respective policies

7. Your Privacy Rights

7.1 General Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal information
  • Rectification: Request correction of inaccurate information
  • Deletion: Request deletion of your personal information
  • Portability: Request transfer of your data to another service
  • Objection: Object to processing of your information

7.2 How to Exercise Your Rights

To exercise your rights, contact us at:

We will respond to your request within 30 days.

7.3 California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA). See our Do Not Sell My Info page.

7.4 European Union Rights (GDPR)

If you are located in the EEA, you have additional rights under GDPR, including the right to:

  • Withdraw consent at any time
  • Lodge a complaint with a supervisory authority
  • Receive information about data breaches

8. Children's Privacy

The native TraceOverlay app is a general-audience creative tool and may be used by people of any age. It does not require an account, and its camera frames and selected reference images stay local to the device. The app does not knowingly collect personal information from children. Apple or Google Play may process account and purchase information when a store transaction is made under their own policies.

The hosted website and services may require an account or payment and are not directed to children under 13. If you are a parent or guardian and believe a child has provided personal information through the hosted services, please contact us.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer your information, we ensure appropriate safeguards are in place to protect your privacy.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

  • Encryption: Data encrypted in transit (HTTPS) and at rest
  • Access Controls: Limited access to personal information
  • Security Audits: Regular security assessments

However, no method of transmission over the internet is 100% secure.

11. Data Breaches

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you:

  • Without undue delay and within 72 hours (GDPR)
  • In the most expedient time possible (CCPA)

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised "Last Updated" date.

We will notify you of material changes by:

  • Posting a notice on our website
  • Sending an email notification

13. Governing Law

This Privacy Policy is governed by the laws of California, United States, without regard to its conflict of law provisions.

14. Contact Us

If you have questions about this Privacy Policy, please contact us:

Privacy Policy Version: 1.2 Effective Date: September 3, 2026

Privacy PolicyTerms of ServiceCookie PolicyDo Not Sell My InfoAcceptable Use

© 2026 TraceOverlay. All rights reserved.