Trace is a memory app. It draws the places you have been as one continuous line across a world map. This policy explains exactly what it reads, what it keeps, and what it never does.
It is written to be read, not to be survived. If anything below is unclear, that is a fault worth reporting.
The short version
- Trace reads your photo library only after you say yes, and only to find when and where your photographs were taken.
- Trace never changes or deletes a photo on your phone. It opens your library read-only.
- Photographs you choose to add to your map are uploaded to Trace's private storage, where only you can see them.
- Trace has no advertising, no analytics, no tracking, and no third-party profiling. Nothing about you is sold or shared for marketing.
- You can delete your account, and everything in it, from inside the app.
What Trace reads, and why
Your photo library — only with permission
When you choose Discover adventures, Trace asks your phone for access to your photo library. Your phone decides whether to grant it, and you can refuse or grant only a selection. Trace works either way; refusing simply means you add places by hand instead.
With permission, Trace reads three things from each photograph:
| What | Why |
|---|---|
| The date and time it was taken | To group photographs into days out |
| The location saved in the file, if any | To place the memory on the map |
| The file name | To recognise and exclude screenshots |
That is all. Trace does not read the content of your photographs. There is no image recognition, no face detection, and no machine learning of any kind.
Screenshots are deliberately excluded. A boarding pass or a meme is a file you saved, not a moment you lived.
Your library is never modified. Trace opens it read-only and has no ability to write to it, delete from it, or add to it. The permission to save photos back to your library has been explicitly removed from this app.
What leaves your phone
Only what you accept. Trace shows you everything it found before anything is saved, and nothing is uploaded until you choose to add it. When you do, for each memory Trace stores:
- the photograph itself,
- when it was taken, and the timezone of the place it happened,
- where it was taken — or, where the photograph carried no location, an estimate between the ones either side of it in time, which the app marks visibly as an estimate,
- a reference to the photo on your device, so importing twice never creates duplicates.
Photographs are resized before they are uploaded. A copy is made at up to 2048 pixels on its longest edge and it is that copy which is stored — small enough to be sent and shown quickly, and larger than anything Trace ever draws. This affects only Trace's copy. The photograph on your phone is untouched, at full resolution, exactly as your camera recorded it.
Trace deliberately does not store the rest of a photograph's EXIF data. Camera serial numbers, lens information and owner names are read past and discarded.
Your account
Trace stores your email address and password so you can sign in. Passwords are handled by our authentication provider and are never visible to us. You may optionally provide a display name.
Trace also records when you accepted these terms and this policy, and which version you accepted, so that you are not asked again unnecessarily.
When something breaks
If Trace crashes, it records what went wrong: the error message, the technical stack trace, which part of the app was running, your app version, and your operating system version. If you were signed in, the report is linked to your account so that a bug affecting one person can be recognised as such.
A crash report never contains your photographs, your locations, your memories or the contents of anything you have written. These reports are write-only from the app — Trace cannot read them back — and they are used for nothing but fixing the software. They are deleted after 90 days, and if you delete your account, any report attached to it is immediately detached from you and becomes anonymous.
Where your data lives
Trace uses Supabase for its database, authentication and file storage.
Your photographs live in a private storage bucket. They are not public, not indexed, and not reachable by a URL that anybody else could guess or share. When the app needs to show you one it requests a temporary signed link that expires within the hour.
Database access is enforced by row-level security: every row is tied to your account, and the rules are applied by the database itself rather than by the app.
Who else is involved
Trace uses a small number of services it does not operate. None of them receives your photographs or your travel history.
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Database, sign-in, file storage | Your account, and the data described above |
| OpenFreeMap / OpenMapTiles / OpenStreetMap | Map geometry and place names | The part of the map you are looking at |
| Esri | Satellite imagery | The part of the map you are looking at |
| Photon | Turning coordinates into place names | The centre point of a day out, once per day out — never per photograph |
| Cloudflare Turnstile | Confirming a person is creating the account, not a script | Signals from your device during sign-up, sign-in and password reset. No account data |
| Resend | Delivering account emails, such as password resets | Your email address, and the message being sent |
These services receive the map area you are looking at, as any map app requires. They do not receive your account, your photographs, or your history.
Map data
Map imagery and place names come from OpenFreeMap / OpenMapTiles / OpenStreetMap, and satellite imagery from Esri. Place names are looked up through Photon.
What Trace does not do
- No advertising, and no advertising identifiers.
- No analytics or usage tracking.
- No selling or sharing of personal information.
- No cross-app or cross-site tracking.
- No profiling, scoring, or automated decisions about you.
How long things are kept
| What | How long |
|---|---|
| Your account, adventures, memories and photographs | Until you delete them, or delete your account |
| Signed links to your photographs | One hour |
| Crash reports | 90 days, then deleted |
| Records of which terms you accepted | For as long as your account exists |
Trace does not keep a copy of your data after you delete your account. There is no archive, no soft delete and no thirty-day recovery window — which also means deletion cannot be undone.
Deleting your account
Open You — the level badge at the top left of the map — and choose Delete my account, under Leaving.
This permanently deletes:
- your account and your sign-in credentials,
- every adventure, journey and memory you have added,
- every photograph you have uploaded to Trace,
- your profile, including your display name and your record of accepting these terms.
It cannot be undone, and there is no recovery period. You will be asked to confirm twice.
The photos on your phone are not touched. They were never Trace's to delete.
Any crash report previously linked to your account is detached from it at the same moment and kept only as an anonymous record of a software fault.
Children
Trace is not directed at children under 13 and does not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.
Your rights
You may access, correct, export or delete your information. Deletion is available in the app as described above; for anything else, contact us at the address below and we will respond within 30 days.
Depending on where you live, you may have additional rights under the GDPR or the CCPA, including the right to object to processing, the right to data portability, and the right to complain to your local supervisory authority. Trace's position is the same either way: the data is yours, we hold as little of it as the app can function with, and you can take it back at any time.
Legal basis for processing, for those to whom the GDPR applies: Trace processes your data to perform the contract you entered into by creating an account. Crash reports are processed under our legitimate interest in the software working. There is no processing for marketing, and therefore no consent to withdraw for it.
Where your data is processed
Trace's database and storage are hosted by Supabase. Data may be processed in the region where your project is hosted and in other countries where our processors operate. Where data leaves the United Kingdom or the European Economic Area, it is transferred under the safeguards those processors provide, including standard contractual clauses.
Changes
If this policy changes materially, the app will say so and ask you to accept the new version before you continue. The date at the top always reflects the current version.
Contact
Email: support@northforge.company
For privacy requests, use the same address with PRIVACY in the subject line. We aim to respond within five working days, and within 30 days for formal data requests.