Trace · Legal

Privacy Policy

Last updated: 2026-10-29

What Trace reads

The Trace extension reads

Metadata from supported AO3 and FanFiction.net pages you choose to save or import.
Reading progress you generate while using Trace on supported archive pages.
Your Trace library data: status, notes, tags, ratings, collections, and preferences.

The Trace extension does not read or do

Your AO3 or FFN password.
Full story text or complete chapter content.
Arbitrary browsing outside supported fanfic pages and Trace's own account-connection pages.
Advertising profiles, ad trackers, or data for sale.

Trace Reader can sync

Public story metadata, such as title, author, summary, AO3 tags, and chapter counts, when you connect Trace.
Your status, rating, personal tags, private note, chapter progress, and a minimal reading position when you connect Trace.
Account, subscription, reliability, and optional product analytics data described in the full policy below.

Trace Reader keeps on your device

Your EPUB files and story or chapter text.
Local file paths and the complete reader locator.
Anything in a signed-out Reader library until you choose to connect Trace.

This policy describes how Trace collects, uses, shares, retains, and deletes information when you use Trace (“the Service”). Trace is run by Zachary Lambert, a sole trader based in England. This notice is provided for transparency; the contractual terms for using Trace are set out separately in the Trace Terms of Service. It applies to the Trace website, browser extension, Trace iPhone app, Trace Reader, and the account and sync services they share.

Information Trace collects

Trace does not host or redistribute fanfiction EPUBs or story text. Trace Reader displays user-selected EPUBs on the device. Trace’s servers store account data, public story metadata, and the reader details you choose to sync:

Account information provided via Auth0 (email address, display name, profile picture, account identifier, and authentication security logs such as IP-derived approximate location).
Library metadata you add or import (story URLs, titles, authors, tags, chapter counts, word counts, and similar publicly available fields from AO3 and FanFiction.net).
Claim records — metadata snapshots from different sources associated with catalog entries, stored to maintain data accuracy and provenance.
Your personal data that you create within Trace (reading status, personal notes, ratings, and reading progress).
Account activity and analytics events such as account creation, library actions, extension sync success or failure, rate-limit events, and aggregated product metrics used to operate and improve Trace.
Subscription and entitlement data such as Stripe customer or subscription identifiers, Apple App Store transaction identifiers, product identifiers, subscription status, expiry dates, and webhook event identifiers.
Notification data if you enable iOS push notifications, including APNs device tokens, app bundle, environment, notification preferences, bounded delivery records, and suggestion dismissal or snooze records.
Technical logs (IP address, user-agent string, request timestamps) for security, abuse prevention, and service diagnostics.
Error diagnostics when error monitoring is enabled, including stack traces, release/environment details, request context, and your Auth0 subject identifier where needed to investigate account-specific failures. Trace does not intentionally send notes, full story text, or payment card details to error monitoring services.
Story updates data if you set up private email forwarding or Connect Outlook, including setup and delivery timestamps, extracted AO3 work and chapter announcement details, acknowledgement state, and non-reversible deduplication values, plus, for Connect Outlook, an encrypted Microsoft sign-in and the connected email address. Details are in the Story updates section below.
Browser extension processing when you install and use the Trace browser extension — including local extension storage, optional on-page labels on supported archive sites, and metadata or reading progress sent to Trace’s servers. Details are in the Browser extension section below.
Trace iPhone app crash reports and setup progress, as described in the Trace iPhone app section below.
Trace Reader processing when you connect the reader to Trace, as described in the Trace Readersection below.

If you sign in with Google or Apple, Trace receives your name, your email address, your profile picture where the provider supplies one, and the provider’s identifier for your account. With Apple’s Hide My Email, Trace receives the relay address Apple gives it instead of your own. Trace never receives your Google or Apple password. I use this information only to create your Trace account, sign you in, show your name and picture in your account, and contact you about your account. I do not sell it or use it for advertising, and I share it only with the service providers listed under Sharing below. To delete it, use Delete account on the Account page, which removes it from Trace and deletes your sign-in identity, as described under Data retention & deletion. You can also remove Trace’s access at any time in your Google or Apple account settings.

Manually entered and user-contributed metadata

When you manually add stories or metadata, Trace treats that information as user-contributed. It may be updated or reconciled over time when more authoritative sources — such as the browser extension reading metadata from the story page on a supported archive — provide matching information for the same work.

Story updates

Story updates works through Gmail forwarding, an iCloud Mail rule or, for Outlook.com, Hotmail and Live addresses, Connect Outlook (both described below). Gmail forwarding uses a private Trace receiving address. If you choose it, you add that address in Gmail, complete Gmail’s forwarding-address verification, and create a filter that forwards only supported AO3 subscription messages. Keep whole-mailbox forwarding off. Trace does not receive access to your Gmail account, a Google OAuth credential, or permission to search your mailbox, and it does not scan or import older messages.

Amazon SES and SNS receive and deliver a forwarded message to Trace, which processes the message in memory. During a setup session, Trace reads only the Gmail forwarding-verification message needed to return its allowlisted link or code to your account. That temporary verification result is available once and is removed after it is read or after ten minutes. For a supported AO3 announcement, Trace stores the extracted work and chapter details, receipt time, source-unconfirmed state, and non-reversible values used to prevent duplicates. Trace does not store the complete email or a readable copy of your private receiving address. AWS may temporarily retain delivery material while retrying delivery under its service behaviour.

Trace matches an announcement to your private Library only by its canonical AO3 work identity, never by title or author alone. It cannot change reading status, progress, completion, or source-confirmed chapter totals, and Story updates state is not included in public Collections. Detailed announcements and replay receipts expire after 30 days. For a matched Library story, Trace retains only the latest announcement, whether you acknowledged it, and the minimum method state needed for deletion until you delete Story updates history, delete the Library entry, disconnect forwarding, or delete your account.

iCloud Mail. If your AO3 emails go to an iCloud Mail address, you can instead create an iCloud Mail rule that forwards email from do-not-reply@archiveofourown.org to your private Trace address. iCloud rules can only match the sender, so this rule forwards all of AO3’s emails, not just updates. Trace reads the subject line of each one and discards any without an update subject line (“[AO3] … posted …”) without reading or storing it. Before that, Amazon SES and SNS deliver it to Trace like any forwarded message, and AWS may briefly retain it while retrying delivery. Trace never receives access to your iCloud account or Apple Account. To stop, delete the rule in Settings › your name › iCloud › Mail › iCloud Mail Rules, or disconnect forwarding in Trace.

Connect Outlook. If your AO3 emails go to an Outlook.com, Hotmail or Live address, you can instead sign in to your personal Microsoft account from Trace. Microsoft then asks you to let Trace read your email, keep that access, sign you in and see your email address. Microsoft has no permission limited to AO3’s emails, so its “Read your email” permission technically lets Trace read every email in your mailbox until you remove it, though it does not let Trace send or change email. What Trace actually does: every 5 minutes it asks Microsoft only for emails from do-not-reply@archiveofourown.org that arrived after you connected, in any folder, Junk included. For those emails Trace sees the subject line and when each one arrived, and it downloads only AO3’s update emails (subject lines like “[AO3] … posted …”), never AO3’s other emails. It checks subject lines in memory without storing them, and processes a downloaded update email in memory, keeping only the extracted work and chapter details, never the email itself. When you connect, Trace also checks that the account has an Outlook.com mailbox and whether it already holds any email from AO3, using message ids only: it opens nothing and keeps only the yes-or-no answer. Apart from that check, Trace never looks at email from before you connected, and it never sends, deletes, moves or marks your email.

For Connect Outlook, Trace stores your Microsoft sign-in (a refresh token) and the connected email address encrypted; a non-reversible key for the Microsoft account, so one mailbox can be connected to only one Trace account; the connection’s status; and when you connected, when Trace last checked and when updates arrived. To avoid handling an email twice, it keeps non-reversible values made from Microsoft’s message ids, never the ids themselves, for 30 days. Updates read through Outlook are matched and kept like forwarded ones (above): each detailed update for 30 days, and for a matched Library story only the minimal latest state. Logs and error reports never include your sign-in, email address or subject lines. Trace connects one inbox at a time, and switching between Gmail forwarding and Outlook keeps your update history.

Disconnecting Outlook in Trace stops the checks at once and deletes the stored sign-in and these records, along with the update history seen only through Outlook (including any history kept when you switched to it). Deleting your Trace account deletes all of it too. Trace can’t withdraw a personal Microsoft account’s permission itself, so disconnecting doesn’t remove it at Microsoft. To remove it, go to account.live.com/consent/Manage and remove Trace. If you remove it there first, the checks stop and Trace asks you to sign in again; disconnect in Trace to delete what it stores.

Story updates notifications are optional and off by default. A notification is generic unless you separately opt in to title previews. Trace associates an APNs device token and registration receipt with your account to deliver the alert; Story updates delivery-attempt records expire after seven days and may be removed sooner when they are no longer eligible. Turning Story updates notifications off removes unsent alerts. Disconnecting forwarding removes its stored Story updates data and unsent alerts, but you must also remove the forwarding filter in Gmail (or the iCloud Mail rule). Account deletion removes device tokens and leaves only a random, content-free registration-operation identifier so an old retry cannot reclaim a device registration.

Cookies & tracking

Trace uses cookies, session storage, local storage, and extension storage to maintain your authenticated session (via Auth0), return you to the right page after login, connect the web app to the browser extension or iOS shell, and remember preferences such as theme, filters, dismissed billing notices, and the timing of occasional feedback, review, or sharing invitations. Trace does not use third-party advertising cookies.

I may enable Plausible Analytics on Trace’s public marketing pages for privacy-first, aggregated website analytics. When the Plausible script is not loaded for your visit, no data is sent to Plausible. Where it is enabled, Plausible does not use cookies for analytics, does not track individual users across the web, and does not collect personal information. That measurement approach is designed to be GDPR-friendly and typically does not require a separate cookie consent banner for analytics alone.

Browser extension

Trace offers a browser extension (Chrome, Safari, and Firefox) that works together with the website and your account. This section describes what the extension accesses, what stays on your device, and what is sent to Trace’s servers.

Sites the extension uses. The extension runs scripted features only on supported Archive of Our Own and FanFiction.net pages (for import, reading progress, and optional on-page library labels) and on Trace’s own websites so it can stay linked to the same signed-in session as the web app and open Import or help pages. It does not read or modify arbitrary websites outside those purposes, and it does not ask for or receive your AO3 or FanFiction.net password.

Data stored locally in the extension. Depending on how you use Trace, the extension may keep in browser extension storage: a credential or token Trace provides so the extension can call Trace’s APIs on your behalf; your preferences (such as automatic progress updates and whether to show on-page labels); and a cached map of your library status fetched from Trace so labels can render without contacting Trace’s servers on every keystroke. This local data is tied to your browser profile and is removed when you remove the extension or when Trace invalidates your session, subject to browser behaviour.

Data sent to Trace’s servers. When you use import or automatic reading-progress features on supported archive pages, the extension sends metadata from the page you are viewing (for example title, author, identifiers, chapter counts, tags, ratings, and similar fields that appear on the page) and reading progress you generate by reading there. It does not send full story body text or other complete chapter content. The extension may also call Trace’s APIs to refresh your library-status cache and to confirm account capabilities. In Safari, when you are signed in and open Trace on an AO3 or FanFiction.net story page, the extension reads that page to show the story’s title and fetches your library status from Trace to show whether the story is already in your library. This saves nothing, and the library check is skipped when automatic saving is off. If you then ask Trace to check again, the extension sends that one story’s site and work ID; Trace uses it only to answer and does not log or keep it. All of this is transmitted over HTTPS to Trace, not to unrelated third parties for advertising or resale.

On-page display. When enabled, the extension may show small labels or controls on supported archive pages (for example your library status or shortcuts to add a work) using data from Trace and the local cache described above. You can turn off relevant features where Trace provides a control in the extension or app settings.

Catalog and shared metadata. Metadata the extension sends from archive pages may also be used to reconcile and improve the shared Trace catalog (for example titles, authors, and counts that appear publicly on those sites), consistent with the “Manually entered and user-contributed metadata” section above. Trace still does not collect full story text through the extension.

Source code. The extension’s source is published at github.com/tracefiction/trace-browser-extension under the PolyForm Noncommercial License so anyone can independently verify what the extension reads from supported pages, what it sends to Trace, and what it stores in browser extension storage.

I do not sell personal information through the extension, and the extension does not load third-party advertising or behavioral analytics scripts. If you do not install or use the extension, none of this extension-specific processing applies.

Trace iPhone app

The Trace iPhone app also sends crash reports and setup progress, never what you read, so I can fix problems.

Crash reports. If the app crashes, it sends a stripped crash stack to Sentry. It sends a similar report, holding only the error code, if Trace’s server fails unexpectedly. These reports aren’t linked to your Trace account. They contain no account details, IP address, story details, notes, or URLs: only the app version and build and the technical details I need to find the fault.

Setup progress. When you create an account in the app, it notes which setup steps you reached: account created, setup skipped, Safari guide opened, Safari or Settings opened, Trace turned on in Safari, Trace allowed on AO3 and FanFiction.net, first story arrived, and continued to your Library. Trace in Safari notes two more: that you opened Trace on a page and whether it was a story page, and your answer when Safari asked to allow Trace (allowed, declined, partly allowed, or no answer). Trace’s server notes when your first story is saved with the Trace extension, in Safari or any other browser, and whether a second story followed within a week of it. Each step records only which step it was, when, whether it worked, a short code for how it was detected, the app build and setup version, whether the app came from the App Store or TestFlight, and the iOS version. Setup progress is linked to your Trace account, and I use it only to see where setup gets stuck and to improve it. Setup steps never include story titles, URLs, or anything you read. The app and Trace in Safari record steps for a week after you sign up. Trace’s server records your first saved story if it arrives within 30 days of sign-up, and a second one if it follows within a week of the first, so the last step can come up to 37 days after sign-up.

Which stories you added. To tell whether a second story followed, Trace’s server keeps a private list of the stories you add from sign-up until a week after your first story is saved with the extension (or until 30 days after sign-up, if none is). That list is then deleted. Setup steps are kept for 12 months after you sign up; after that, only daily totals with no account attached remain. Deleting your account deletes your setup steps and this list of stories sooner; the daily totals stay.

Trace Reader

Trace Reader is useful without a Trace account. When you are signed out, imported EPUBs, story text, reading position, status, ratings, personal tags, and private notes stay in the Reader library on your device. You can read, organize, edit, export, and restore that local library without connecting Trace.

Data sent when you connect Trace. Reader can send a story’s canonical AO3 identity and public metadata, including its title, authors, summary, rating, warnings, categories, fandoms, relationships, characters, AO3 tags, language, dates, counts, and completion state. It can also sync your reading status, rating, personal tags, private note, chapter progress, and a minimal reading position tied to that EPUB version. This data is private to your Trace account unless you deliberately use a separate sharing feature.

Data that stays on your device. Reader never uploads the EPUB file, story or chapter text, local file paths, or the complete reader locator. Trace Free and Trace Unlimited only change how many eligible stories can sync. They do not limit the size or features of your on-device Reader library.

Product analytics and reliability. Optional product analytics are off until you opt in. Those events use coarse action names and categories, not story identifiers, titles, authors, fandoms, tags, summaries, notes, URLs, locators, fingerprints, file paths, or story text. Signed-out analytics do not include a user or device identifier; signed-in analytics are linked to the Trace account. When signed in, Reader also sends limited operational events needed to run and troubleshoot sync, such as outcomes, failure categories, coarse library-size or duration bands, retry state, and plan or capacity bands. These operational events are linked to the Trace account and are used for app functionality, not advertising.

Crash reports. Release builds may send stripped crash stacks to Sentry so I can fix crashes. Reader crash reports are not linked to a Trace account and do not include user or request data, story details, notes, URLs, reading locators, file paths, screenshots, view hierarchy, replay, or performance traces. They may include the device class, major operating-system version, app release, build, and release channel.

How Trace uses your information

Provide, operate, and improve the Service — including syncing your library across devices.
Process transactions and send related notices (see “Payment processing” below).
Send weekly library check-in push notifications if you enable them.
Receive and process supported AO3 subscription messages you choose to forward, or that Trace reads from your Outlook.com mailbox if you use Connect Outlook, match announcements to your private Library, and send optional Story updates notifications.
Measure reliability, product usage, feature limits, and errors so I can maintain and improve Trace.
Prevent fraud, abuse, and service disruptions.
Comply with legal obligations and enforce the Trace Terms of Service.

Payment processing

Payments for Trace Unlimited on the web are processed by Stripe, Inc. When you subscribe through Stripe, Stripe collects your payment information (card number, billing address) directly. Trace does not receive or store your full card details. Stripe’s use of your data is governed by the Stripe Privacy Policy.

If you subscribe through an Apple platform, Apple processes the purchase through the App Store. Trace receives and stores only the transaction and subscription information needed to verify and maintain your Pro entitlement.

Data retention & deletion

Trace keeps account, library, notes, tags, reading progress, extension metadata, notification preferences, and subscription entitlement records for as long as your account is active, unless you delete them sooner or Trace needs to retain limited records for security, legal, accounting, dispute, or abuse-prevention purposes.

Account export. The Account page provides a downloadable library export. If you need a broader copy of personal data held about you, contact Trace using the details below. Trace Reader also provides a local metadata backup for its on-device library.
Account deletion. The Account page immediately deletes server-held Trace account records and user-owned library data, signs you out, and durably schedules Stripe cancellation and deletion of your Auth0 login identity. It does not delete the separate Reader library held on your device. Trace retains a protected, non-readable deletion marker so a deleted login cannot recreate an account, and retains encrypted provider identifiers only until that cleanup finishes. Some processor records, backups, security logs, webhook ledgers, and billing records may persist for a limited period where required or permitted by law or by the processor’s platform rules. You can contact Trace to request a full erasure review across connected processors.
Reader data on your device. Signing out or deleting a Trace account leaves the local Reader library in place. You can remove individual records in Reader. Deleting the app removes its local database and app-owned EPUB copies; source EPUBs that you keep separately in Files remain under your control.
Story updates. Temporary forwarding-verification data is removed after one successful read or ten minutes. Detailed announcements and replay receipts expire after 30 days; the minimal latest state for a matched Library story can remain until you delete Story updates history, delete the Library entry, disconnect forwarding, or delete your account. Story updates push delivery records expire after seven days. Disconnecting does not remove the forwarding rule from Gmail or iCloud Mail; you must remove that rule there as well.
Connect Outlook. The encrypted Microsoft sign-in and connected email address are kept until you disconnect Outlook or delete your account. A sign-in you don’t finish expires within 15 minutes. The non-reversible records of emails already handled expire after 30 days, and updates read through Outlook follow the Story updates retention above. Disconnecting does not remove Trace’s permission at Microsoft; remove it at account.live.com/consent/Manage.
Words read with Trace. Trace keeps a running total of the words you have read with it for as long as you have an account. With it Trace keeps the date you passed each round number (10,000 words, 25,000, and so on) and your best week, month and year, each as two dates and a number of words. Trace also keeps the time zone those dates are counted in. To work these out, Trace also keeps one number of words for each day you read, for twelve months, on the same schedule as user statistics events. A day is deleted when it is twelve months old, or up to a week later, and only its words remain in the total. None of this records which stories or chapters you read, or at what time of day. Deleting your account deletes all of it.
Operational retention targets. Trace aims to retain user statistics events for no more than 12 months, or up to a week longer while their words are being added to your running total; application analytics events, notification tokens, webhook ledgers, and error monitoring records only for as long as needed for operations, security, accounting, or dispute handling; and backups only until they expire through the normal backup rotation.

Sharing

Your Trace library is private by default. No public profile or public library is created for you automatically.

Shared Collections and your rec page. If you turn on a link for a Collection, anyone with that link can see the Collection’s title, description and stories, your notes if you choose to include them, and the credit you choose (anonymous, or your public name, handle and link). If you turn on a rec page, anyone with its link can see the shared Collections you choose for it, credited to your public name. Neither shows your email, your reading status, progress, ratings or the rest of your library. Both are unlisted: they are asked to stay out of search engines and are not listed anywhere on Trace. Turning off a link or the page, or replacing its link, stops the old link working; deleting your account deletes them.

Trace does not sell your personal data. Trace shares information only with the service providers necessary to operate Trace, process payments, deliver notifications, monitor reliability, and comply with legal obligations:

Auth0 (authentication)
Stripe (web payment processing and billing portal)
Apple (App Store subscriptions, Apple server notifications, and APNs push notification delivery)
Amazon Web Services (SES/SNS receipt and delivery of email you forward for Story updates)
Microsoft (only if you use Connect Outlook: Microsoft sign-in, and the requests Trace makes to your Outlook.com mailbox for AO3’s emails)
Sentry (error monitoring and diagnostics, when configured)
Plausible Analytics (when enabled on Trace’s marketing site: privacy-first, aggregated website analytics)
Cloud hosting providers (database and application hosting)

Each provider receives only the minimum data necessary to perform its function.

International transfers

Trace is based in England, but some of Trace’s service providers (including Auth0, Stripe, Apple, Amazon Web Services, Sentry, and cloud hosting providers, and Microsoft if you use Connect Outlook) may process data in the United States or other countries outside the United Kingdom. Where personal data is transferred outside the United Kingdom, Trace relies on adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, UK International Data Transfer Agreements, standard contractual clauses, data processing agreements, or other lawful transfer mechanisms to protect the transfer.

Your data protection rights

Trace is run by Zachary Lambert, a sole trader, who is the data controller for the personal data described in this policy. Trace processes your data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Trace extends the same rights to all users regardless of location:

Access — request a copy of the personal data Trace holds about you.
Rectification — ask Trace to correct inaccurate data.
Erasure — request deletion of your data (you can also delete your account directly from the Account page).
Portability — receive your data in a structured, machine-readable format.
Restriction & objection — ask Trace to limit or stop processing your data in certain circumstances.

Trace’s legal bases for processing are: a) performance of Trace’s contract with you (providing the Service, account features, sync, export, and subscription entitlement), b) legitimate interests (security, abuse prevention, service diagnostics, reliability, and product improvement), c) legal obligation (tax, accounting, disputes, and compliance), and d) your consent where applicable (for example, optional push notifications and any non-essential storage or access technologies that require consent).

To exercise any of these rights, contact Trace at support@tracefiction.com. If you are in the UK and are not satisfied with the response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Your rights under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

Right to know — you may request the categories and specific pieces of personal information Trace has collected about you.
Right to delete — you may request deletion of your personal information.
Right to opt out of sale — Trace does not sell personal information. Trace has not sold personal information in the preceding 12 months.
Non-discrimination — Trace will not discriminate against you for exercising your CCPA rights.

Categories of personal information Trace collects include: identifiers (email, name, account ID, and profile picture), approximate location derived from authentication security logs, internet or other electronic activity information (IP address, user-agent, product interactions, and reading activity), user content (such as private notes and personal tags), and commercial information (subscription status). To make a verifiable request, email support@tracefiction.com.

Age restrictions

Trace is not directed to children under 13. Trace does not knowingly collect personal information from children under 13, and children under 13 must not create an account or use Trace. If I learn that Trace has collected personal information from a child under 13, I will take appropriate steps to delete it.

Because Trace may be accessible to younger readers, Trace applies privacy-protective defaults to all users: no behavioral advertising, no public user profiles, no sale of personal data, no location tracking, optional push notifications only, extension collection limited to supported story metadata and reading progress, and no Reader EPUB or story text uploaded to Trace. Users under 18 should use Trace only if they are old enough to understand this policy and the Trace Terms, and with parent or guardian involvement where required by law.

Changes to this policy

I may update this Privacy Policy from time to time. If changes are material, I will provide notice within the app or by other appropriate means. Continued use of Trace after changes take effect constitutes acceptance of the updated policy.

Contact

Questions or requests? Email support@tracefiction.com.