Trace is a memory app published by NorthForge. It draws the places you have been as one continuous line across a world map. This policy explains exactly what it reads, what it keeps, and what it never does.
NorthForge is the data controller for the information described below.
The short version
- Your memories are kept on your phone. Trace works with no account, and by default nothing you add to your map ever leaves the device.
- An account is optional. It exists to back your map up and bring it to a new phone, and only what you ask to be backed up is uploaded.
- Trace reads your photo library only after you say yes, and only to find when and where your photographs were taken.
- Trace never changes or deletes a photo on your phone. It opens your library read-only.
- Trace has no advertising, no analytics, no tracking, and no third-party profiling. Nothing about you is sold or shared for marketing.
- You can delete your account, and everything in it, from inside the app — and you can remove everything held on the device by uninstalling it.
What Trace reads, and why
Your photo library — only with permission
When you choose Import from photos, Trace asks your phone for access to your photo library. Your phone decides whether to grant it, and you can refuse or grant only a selection. Trace works either way; refusing simply means you add places by hand instead.
With permission, Trace reads three things from each photograph:
| What | Why |
|---|---|
| The date and time it was taken | To group photographs into days out |
| The location saved in the file, if any | To place the memory on the map |
| The file name | To recognise and exclude screenshots |
That is all. Trace does not read the content of your photographs. There is no image recognition, no face detection, and no machine learning of any kind.
Screenshots are excluded. They are saved files rather than places you went, and they carry no location.
Your library is never modified. Trace opens it read-only and has no ability to write to it, delete from it, or add to it. The permission to save photos back to your library has been explicitly removed from this app.
What Trace keeps, and where
Only what you accept. Trace shows you everything it found before anything is saved. When you accept a day out, for each memory Trace records:
- a copy of the photograph, resized smaller than the original,
- when it was taken, and the timezone of the place it happened,
- where it was taken — or, where the photograph carried no location, an estimate between the ones either side of it in time, which the app marks visibly as an estimate,
- a reference to the photo on your device, so importing twice never creates duplicates.
All of this is written to private storage on your phone, inside the app's own space, which no other app can read. Nothing above is sent anywhere unless you create an account and ask for a backup.
Trace keeps its own resized copy rather than pointing at your library. A photograph you later delete, move or take offline would otherwise leave a blank space on your map. The photo in your library is untouched, at full resolution.
Trace deliberately does not keep the rest of a photograph's EXIF data. Camera serial numbers, lens information and owner names are read past and discarded.
What leaves your phone
By default, nothing you add to your map. Trace has no account requirement, and the map, the import, the passport and everything else work with no network at all beyond the map tiles you are looking at.
Two things do go out, and both are described in full below: map tiles and place-name lookups, which are needed to draw a map, and crash reports, which are how a fault gets fixed.
Your account — optional
An account exists for one reason: to keep a copy of your map somewhere other than the phone in your pocket, so that losing or replacing it does not lose your travel with it.
If you create one, Trace stores your email address and password so you can sign in. Passwords are handled by our authentication provider and are never visible to us. You may optionally provide a display name.
When you ask for a backup, the adventures, memories and photographs already on your phone are copied to Trace's private storage, where only you can see them. The copies on your phone are not deleted — a backup adds somewhere for your data to be, it never moves it.
Trace also records when you accepted these terms and this policy, and which version you accepted, so that you are not asked again unnecessarily. Without an account that record is kept on the device instead.
When something breaks
If Trace crashes, it records the error, which part of the app was running, and your app and operating system versions. This happens whether or not you have an account; if you are signed in, the report is linked to it, and if you are not, it is linked to nothing.
A crash report never contains your photos, your locations, your memories, or anything you have written. Reports are used only for fixing the software, are deleted after 90 days, and are detached from your account if you delete it.
Where your data lives
On your phone, by default. Your adventures, memories and photographs are written to the app's own private storage, which the operating system keeps separate from every other app. Uninstalling Trace removes all of it.
Android may include an app's private storage in its own device backup, to the Google account already signed in on the phone. That is your backup, made by your operating system, under your own account — Trace neither reads it nor receives it, and it can be turned off in the phone's backup settings.
In your account, if you make one. Trace uses Supabase for its database, authentication and file storage.
Photographs stored there are private. They are not public, not indexed, and not reachable by a URL anybody else could guess. Links used to display them expire within the hour.
Access is enforced by the database rather than by the app: every record is tied to your account.
Services Trace relies on
Trace uses a small number of outside services to work. Each is listed by what it does; the company providing it is named last, for completeness.
| What it does | What it receives | Provider |
|---|---|---|
| Accounts and backup — signing in, and holding a copy of your map if you ask for one | Your email address, and the data described above. Nothing at all, if you have no account | Supabase |
| Maps — drawing the map you look at | The area of the map currently on screen | OpenFreeMap, OpenMapTiles, OpenStreetMap, Esri |
| Terrain — giving mountains and coastlines their real shape | The area of the map currently on screen | Terrarium terrain tiles, hosted on Amazon Web Services |
| Place names — turning coordinates into "Rome, Italy" | The centre point of a day out, once per day out. Never per photograph | Photon |
| Email delivery — sending account emails such as address verification and password resets | Your email address, and the message being sent | Resend |
| Spam protection — checking during sign-up, sign-in and password reset that a person is doing it rather than a script | Signals from your device. No account data | Cloudflare Turnstile |
None of these receives your photographs or your travel history.
Map data
Map imagery and place names come from OpenFreeMap / OpenMapTiles / OpenStreetMap, and satellite imagery from Esri. Place names are looked up through Photon. Elevation, which is what gives mountains their height and coastlines their shape, comes from Terrarium terrain tiles hosted on Amazon Web Services.
These are map tile requests. They carry the part of the world currently on screen and nothing else — no account, no photographs, no travel history.
What Trace does not do
- No advertising, and no advertising identifiers.
- No analytics or usage tracking.
- No selling or sharing of personal information.
- No cross-app or cross-site tracking.
- No profiling, scoring, or automated decisions about you.
How long things are kept
| What | How long |
|---|---|
| Adventures, memories and photographs on your phone | Until you delete them, or uninstall Trace |
| The same, once backed up to an account | Until you delete them, or delete your account |
| Signed links to your photographs | One hour |
| Crash reports | 90 days, then deleted |
| Records of which terms you accepted | For as long as your account exists |
Trace does not keep a copy of your data after you delete your account. There is no archive, no soft delete and no thirty-day recovery window — which also means deletion cannot be undone.
Deleting your data
From your phone
Uninstalling Trace removes everything it holds: every adventure, memory and photograph, the record of what you agreed to, and its own copies of your pictures. Nothing is left with us and there is nothing to ask us for. If your phone's own backup has a copy, that is yours to remove in its settings.
Photos in your camera roll are not affected. Trace never had the ability to change them.
From your account
Open Settings, choose Account, then Delete account.
This permanently deletes:
- your account and your sign-in credentials,
- every adventure, journey and memory you have added,
- every photograph backed up to Trace,
- your profile, including your display name and your record of accepting these terms.
It cannot be undone, and there is no recovery period. You will be asked to confirm twice.
Photos on your phone are not affected, and neither is the copy of your map Trace keeps on the device — deleting an account removes the backup, not the app.
Any crash report previously linked to your account is detached from it at the same moment and kept only as an anonymous record of a software fault.
If you no longer have the app installed and had an account, you can still ask us to delete it. Write to support@northforge.company with DELETE in the subject line, from the address the account uses. There are instructions at northforge.company/delete-account.html.
Children
Trace is not directed at children under 13 and does not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.
Your rights
You may access, correct, export or delete your information. Deletion is available in the app as described above; for anything else, contact us at the address below and we will respond within 30 days.
Depending on where you live, you may have additional rights under the GDPR or the CCPA, including the right to object to processing, the right to data portability, and the right to complain to your local supervisory authority. Trace's position is the same either way: the data is yours, we hold as little of it as the app can function with, and you can take it back at any time.
Legal basis for processing, for those to whom the GDPR applies: Trace processes your data to perform the contract you entered into by creating an account. Where you have no account, there is no processing on a server to have a basis for — what is on your phone is yours and never reaches us. Crash reports are processed under our legitimate interest in the software working. There is no processing for marketing, and therefore no consent to withdraw for it.
Where your data is processed
Data kept on your phone is not processed anywhere but your phone. For anything you back up to an account, NorthForge's database and storage for Trace are hosted by Supabase, and data may be processed in the region where that project is hosted and in other countries where our processors operate. Where data leaves the United Kingdom or the European Economic Area, it is transferred under the safeguards those processors provide, including standard contractual clauses.
Changes
If this policy changes materially, the app will say so and ask you to accept the new version before you continue. The date at the top always reflects the current version.
Contact
Email: support@northforge.company
For privacy requests, use the same address with PRIVACY in the subject line. We aim to respond within five working days, and within 30 days for formal data requests.