Trace · Legal

Privacy Policy

Last updated: 2026-10-13

What Trace reads

The Trace extension reads

Metadata from supported AO3 and FanFiction.net pages you choose to save or import.
Reading progress you generate while using Trace on supported archive pages.
Your Trace library data: status, notes, tags, ratings, collections, and preferences.

The Trace extension does not read or do

Your AO3 or FFN password.
Full story text or complete chapter content.
Arbitrary browsing outside supported fanfic pages and Trace's own account-connection pages.
Advertising profiles, ad trackers, or data for sale.

Trace Reader can sync

Public story metadata, such as title, author, summary, AO3 tags, and chapter counts, when you connect Trace.
Your status, rating, personal tags, private note, chapter progress, and a minimal reading position when you connect Trace.
Account, subscription, reliability, and optional product analytics data described in the full policy below.

Trace Reader keeps on your device

Your EPUB files and story or chapter text.
Local file paths and the complete reader locator.
Anything in a signed-out Reader library until you choose to connect Trace.

This policy describes how we collect, use, share, retain, and delete information when you use Trace (“the Service”). Trace is operated as a sole-trader service based in England. This notice is provided for transparency; the contractual terms for using Trace are set out separately in our Terms of Service. It applies to the Trace website, browser extension, Trace iPhone app, Trace Reader, and the account and sync services they share.

Information we collect

Trace does not host or redistribute fanfiction EPUBs or story text. Trace Reader displays user-selected EPUBs on the device. Our servers store account data, public story metadata, and the reader details you choose to sync:

Account information provided via Auth0 (email address, display name, profile picture, account identifier, and authentication security logs such as IP-derived approximate location).
Library metadata you add or import (story URLs, titles, authors, tags, chapter counts, word counts, and similar publicly available fields from AO3 and FanFiction.net).
Claim records — metadata snapshots from different sources associated with catalog entries, stored to maintain data accuracy and provenance.
Your personal data that you create within Trace (reading status, personal notes, ratings, and reading progress).
Account activity and analytics events such as account creation, library actions, extension sync success or failure, rate-limit events, and aggregated product metrics used to operate and improve Trace.
Subscription and entitlement data such as Stripe customer or subscription identifiers, Apple App Store transaction identifiers, product identifiers, subscription status, expiry dates, and webhook event identifiers.
Notification data if you enable iOS push notifications, including APNs device tokens, app bundle, environment, notification preferences, bounded delivery records, and suggestion dismissal or snooze records.
Technical logs (IP address, user-agent string, request timestamps) for security, abuse prevention, and service diagnostics.
Error diagnostics when error monitoring is enabled, including stack traces, release/environment details, request context, and your Auth0 subject identifier where needed to investigate account-specific failures. We do not intentionally send notes, full story text, or payment card details to error monitoring services.
Story updates data if you set up private email forwarding, including setup and delivery timestamps, extracted AO3 work and chapter announcement details, acknowledgement state, and non-reversible deduplication values. Details are in the Story updates section below.
Browser extension processing when you install and use the Trace browser extension — including local extension storage, optional on-page labels on supported archive sites, and metadata or reading progress sent to our servers. Details are in the Browser extension section below.
Trace iPhone app crash reports and setup progress, as described in the Trace iPhone app section below.
Trace Reader processing when you connect the reader to Trace, as described in the Trace Readersection below.

If you sign in with Google or Apple, Trace receives your name, your email address, your profile picture where the provider supplies one, and the provider’s identifier for your account. With Apple’s Hide My Email, we receive the relay address Apple gives us instead of your own. We never receive your Google or Apple password. We use this information only to create your Trace account, sign you in, show your name and picture in your account, and contact you about your account. We do not sell it or use it for advertising, and we share it only with the service providers listed under Sharing below. To delete it, use Delete account on the Account page, which removes it from Trace and deletes your sign-in identity, as described under Data retention & deletion. You can also remove Trace’s access at any time in your Google or Apple account settings.

Manually entered and user-contributed metadata

When you manually add stories or metadata, we treat that information as user-contributed. It may be updated or reconciled over time when more authoritative sources — such as the browser extension reading metadata from the story page on a supported archive — provide matching information for the same work.

Story updates

Story updates uses a private Trace receiving address. If you turn it on, you add that address in Gmail, complete Gmail’s forwarding-address verification, and create a filter that forwards only supported AO3 subscription messages. Keep whole-mailbox forwarding off. Trace does not receive access to your Gmail account, a Google OAuth credential, or permission to search your mailbox, and it does not scan or import older messages.

Amazon SES and SNS receive and deliver a forwarded message to Trace, which processes the message in memory. During a setup session, Trace reads only the Gmail forwarding-verification message needed to return its allowlisted link or code to your account. That temporary verification result is available once and is removed after it is read or after ten minutes. For a supported AO3 announcement, Trace stores the extracted work and chapter details, receipt time, source-unconfirmed state, and non-reversible values used to prevent duplicates. Trace does not store the complete email or a readable copy of your private receiving address. AWS may temporarily retain delivery material while retrying delivery under its service behaviour.

Trace matches an announcement to your private Library only by its canonical AO3 work identity, never by title or author alone. It cannot change reading status, progress, completion, or source-confirmed chapter totals, and Story updates state is not included in public Collections. Detailed announcements and replay receipts expire after 30 days. For a matched Library story, Trace retains only the latest announcement, whether you acknowledged it, and the minimum method state needed for deletion until you delete Story updates history, delete the Library entry, disconnect forwarding, or delete your account.

Story updates notifications are optional and off by default. A notification is generic unless you separately opt in to title previews. Trace associates an APNs device token and registration receipt with your account to deliver the alert; Story updates delivery-attempt records expire after seven days and may be removed sooner when they are no longer eligible. Turning Story updates notifications off removes unsent alerts. Disconnecting forwarding removes its stored Story updates data and unsent alerts, but you must also remove the forwarding filter in Gmail. Account deletion removes device tokens and leaves only a random, content-free registration-operation identifier so an old retry cannot reclaim a device registration.

Cookies & tracking

Trace uses cookies, session storage, local storage, and extension storage to maintain your authenticated session (via Auth0), return you to the right page after login, connect the web app to the browser extension or iOS shell, and remember preferences such as theme, filters, dismissed billing notices, and the timing of occasional feedback, review, or sharing invitations. We do not use third-party advertising cookies.

We may enable Plausible Analytics on our public marketing pages for privacy-first, aggregated website analytics. When the Plausible script is not loaded for your visit, no data is sent to Plausible. Where it is enabled, Plausible does not use cookies for analytics, does not track individual users across the web, and does not collect personal information. That measurement approach is designed to be GDPR-friendly and typically does not require a separate cookie consent banner for analytics alone.

Browser extension

Trace offers a browser extension (Chrome, Safari, and Firefox) that works together with the website and your account. This section describes what the extension accesses, what stays on your device, and what is sent to Trace’s servers.

Sites the extension uses. The extension runs scripted features only on supported Archive of Our Own and FanFiction.net pages (for import, reading progress, and optional on-page library labels) and on Trace’s own websites so it can stay linked to the same signed-in session as the web app and open Import or help pages. It does not read or modify arbitrary websites outside those purposes, and it does not ask for or receive your AO3 or FanFiction.net password.

Data stored locally in the extension. Depending on how you use Trace, the extension may keep in browser extension storage: a credential or token Trace provides so the extension can call Trace’s APIs on your behalf; your preferences (such as automatic progress updates and whether to show on-page labels); and a cached map of your library status fetched from Trace so labels can render without contacting our servers on every keystroke. This local data is tied to your browser profile and is removed when you remove the extension or when Trace invalidates your session, subject to browser behaviour.

Data sent to Trace’s servers. When you use import or automatic reading-progress features on supported archive pages, the extension sends metadata from the page you are viewing (for example title, author, identifiers, chapter counts, tags, ratings, and similar fields that appear on the page) and reading progress you generate by reading there. It does not send full story body text or other complete chapter content. The extension may also call Trace’s APIs to refresh your library-status cache and to confirm account capabilities. All of this is transmitted over HTTPS to Trace, not to unrelated third parties for advertising or resale.

On-page display. When enabled, the extension may show small labels or controls on supported archive pages (for example your library status or shortcuts to add a work) using data from Trace and the local cache described above. You can turn off relevant features where Trace provides a control in the extension or app settings.

Catalog and shared metadata. Metadata the extension sends from archive pages may also be used to reconcile and improve the shared Trace catalog (for example titles, authors, and counts that appear publicly on those sites), consistent with the “Manually entered and user-contributed metadata” section above. We still do not collect full story text through the extension.

Source code. The extension’s source is published at github.com/tracefiction/trace-browser-extension under the PolyForm Noncommercial License so anyone can independently verify what the extension reads from supported pages, what it sends to Trace, and what it stores in browser extension storage.

We do not sell personal information through the extension, and the extension does not load third-party advertising or behavioral analytics scripts. If you do not install or use the extension, none of this extension-specific processing applies.

Trace iPhone app

The Trace iPhone app also sends crash reports and setup progress, never what you read, so we can fix problems.

Crash reports. If the app crashes, it sends a stripped crash stack to Sentry. It sends a similar report, holding only the error code, if Trace’s server fails unexpectedly. These reports aren’t linked to your Trace account. They contain no account details, IP address, story details, notes, or URLs: only the app version and build and the technical details we need to find the fault.

Setup progress. When you create an account in the app, it notes which setup steps you reached: account created, Safari guide opened, Safari opened, Trace turned on in Safari, and first story arrived. Trace’s server also notes whether that first story came in through Safari and whether a second one followed within a week. Each step records only which step it was, when, whether it worked, and the app build and iOS version. Setup progress is linked to your Trace account, and we use it only to fix setup problems. It never includes which stories you saved, their titles or URLs, or anything else you read. The app stops recording steps a day after you sign up, and all of it is deleted with your account.

Trace Reader

Trace Reader is useful without a Trace account. When you are signed out, imported EPUBs, story text, reading position, status, ratings, personal tags, and private notes stay in the Reader library on your device. You can read, organize, edit, export, and restore that local library without connecting Trace.

Data sent when you connect Trace. Reader can send a story’s canonical AO3 identity and public metadata, including its title, authors, summary, rating, warnings, categories, fandoms, relationships, characters, AO3 tags, language, dates, counts, and completion state. It can also sync your reading status, rating, personal tags, private note, chapter progress, and a minimal reading position tied to that EPUB version. This data is private to your Trace account unless you deliberately use a separate sharing feature.

Data that stays on your device. Reader never uploads the EPUB file, story or chapter text, local file paths, or the complete reader locator. Trace Free and Trace Unlimited only change how many eligible stories can sync. They do not limit the size or features of your on-device Reader library.

Product analytics and reliability. Optional product analytics are off until you opt in. Those events use coarse action names and categories, not story identifiers, titles, authors, fandoms, tags, summaries, notes, URLs, locators, fingerprints, file paths, or story text. Signed-out analytics do not include a user or device identifier; signed-in analytics are linked to the Trace account. When signed in, Reader also sends limited operational events needed to run and troubleshoot sync, such as outcomes, failure categories, coarse library-size or duration bands, retry state, and plan or capacity bands. These operational events are linked to the Trace account and are used for app functionality, not advertising.

Crash reports. Release builds may send stripped crash stacks to Sentry so we can fix crashes. Reader crash reports are not linked to a Trace account and do not include user or request data, story details, notes, URLs, reading locators, file paths, screenshots, view hierarchy, replay, or performance traces. They may include the device class, major operating-system version, app release, build, and release channel.

How we use your information

Provide, operate, and improve the Service — including syncing your library across devices.
Process transactions and send related notices (see “Payment processing” below).
Send weekly library check-in push notifications if you enable them.
Receive and process supported AO3 subscription messages you choose to forward, match announcements to your private Library, and send optional Story updates notifications.
Measure reliability, product usage, feature limits, and errors so we can maintain and improve Trace.
Prevent fraud, abuse, and service disruptions.
Comply with legal obligations and enforce our Terms of Service.

Payment processing

Payments for Trace Unlimited on the web are processed by Stripe, Inc. When you subscribe through Stripe, Stripe collects your payment information (card number, billing address) directly. Trace does not receive or store your full card details. Stripe’s use of your data is governed by the Stripe Privacy Policy.

If you subscribe through an Apple platform, Apple processes the purchase through the App Store. Trace receives and stores only the transaction and subscription information needed to verify and maintain your Pro entitlement.

Data retention & deletion

We keep account, library, notes, tags, reading progress, extension metadata, notification preferences, and subscription entitlement records for as long as your account is active, unless you delete them sooner or we need to retain limited records for security, legal, accounting, dispute, or abuse-prevention purposes.

Account export. The Account page provides a downloadable library export. If you need a broader copy of personal data held about you, contact us using the details below. Trace Reader also provides a local metadata backup for its on-device library.
Account deletion. The Account page immediately deletes server-held Trace account records and user-owned library data, signs you out, and durably schedules Stripe cancellation and deletion of your Auth0 login identity. It does not delete the separate Reader library held on your device. We retain a protected, non-readable deletion marker so a deleted login cannot recreate an account, and retain encrypted provider identifiers only until that cleanup finishes. Some processor records, backups, security logs, webhook ledgers, and billing records may persist for a limited period where required or permitted by law or by the processor’s platform rules. You can contact us to request a full erasure review across connected processors.
Reader data on your device. Signing out or deleting a Trace account leaves the local Reader library in place. You can remove individual records in Reader. Deleting the app removes its local database and app-owned EPUB copies; source EPUBs that you keep separately in Files remain under your control.
Story updates. Temporary forwarding-verification data is removed after one successful read or ten minutes. Detailed announcements and replay receipts expire after 30 days; the minimal latest state for a matched Library story can remain until you delete Story updates history, delete the Library entry, disconnect forwarding, or delete your account. Story updates push delivery records expire after seven days. Disconnecting does not remove the forwarding rule from Gmail; you must remove that rule there as well.
Words read with Trace. Trace keeps a running total of the words you have read with it for as long as you have an account. With it Trace keeps the date you passed each round number (10,000 words, 25,000, and so on) and your best week, month and year, each as two dates and a number of words. Trace also keeps the time zone those dates are counted in. To work these out, Trace also keeps one number of words for each day you read, for twelve months, on the same schedule as user statistics events. A day is deleted when it is twelve months old, or up to a week later, and only its words remain in the total. None of this records which stories or chapters you read, or at what time of day. Deleting your account deletes all of it.
Operational retention targets. We aim to retain user statistics events for no more than 12 months, or up to a week longer while their words are being added to your running total; application analytics events, notification tokens, webhook ledgers, and error monitoring records only for as long as needed for operations, security, accounting, or dispute handling; and backups only until they expire through the normal backup rotation.

Sharing

Your Trace library is private by default. No public profile or public library is created for you automatically.

We do not sell your personal data. We share information only with the service providers necessary to operate Trace, process payments, deliver notifications, monitor reliability, and comply with legal obligations:

Auth0 (authentication)
Stripe (web payment processing and billing portal)
Apple (App Store subscriptions, Apple server notifications, and APNs push notification delivery)
Amazon Web Services (SES/SNS receipt and delivery of email you forward for Story updates)
Sentry (error monitoring and diagnostics, when configured)
Plausible Analytics (when enabled on our marketing site: privacy-first, aggregated website analytics)
Cloud hosting providers (database and application hosting)

Each provider receives only the minimum data necessary to perform its function.

International transfers

Trace is based in England, but some of our service providers (including Auth0, Stripe, Apple, Amazon Web Services, Sentry, and cloud hosting providers) may process data in the United States or other countries outside the United Kingdom. Where personal data is transferred outside the United Kingdom, we rely on adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, UK International Data Transfer Agreements, standard contractual clauses, data processing agreements, or other lawful transfer mechanisms to protect the transfer.

Your data protection rights

Trace is the data controller for the personal data described in this policy. We process your data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We extend the same rights to all users regardless of location:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — request deletion of your data (you can also delete your account directly from the Account page).
Portability — receive your data in a structured, machine-readable format.
Restriction & objection — ask us to limit or stop processing your data in certain circumstances.

Our legal bases for processing are: a) performance of our contract with you (providing the Service, account features, sync, export, and subscription entitlement), b) legitimate interests (security, abuse prevention, service diagnostics, reliability, and product improvement), c) legal obligation (tax, accounting, disputes, and compliance), and d) your consent where applicable (for example, optional push notifications and any non-essential storage or access technologies that require consent).

To exercise any of these rights, contact us at support@tracefiction.com. If you are in the UK and are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Your rights under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

Right to know — you may request the categories and specific pieces of personal information we have collected about you.
Right to delete — you may request deletion of your personal information.
Right to opt out of sale — Trace does not sell personal information. We have not sold personal information in the preceding 12 months.
Non-discrimination — we will not discriminate against you for exercising your CCPA rights.

Categories of personal information we collect include: identifiers (email, name, account ID, and profile picture), approximate location derived from authentication security logs, internet or other electronic activity information (IP address, user-agent, product interactions, and reading activity), user content (such as private notes and personal tags), and commercial information (subscription status). To make a verifiable request, email support@tracefiction.com.

Age restrictions

Trace is not directed to children under 13. We do not knowingly collect personal information from children under 13, and children under 13 must not create an account or use Trace. If we learn that we have collected personal information from a child under 13, we will take appropriate steps to delete it.

Because Trace may be accessible to younger readers, we apply privacy-protective defaults to all users: no behavioral advertising, no public user profiles, no sale of personal data, no location tracking, optional push notifications only, extension collection limited to supported story metadata and reading progress, and no Reader EPUB or story text uploaded to Trace. Users under 18 should use Trace only if they are old enough to understand this policy and our Terms, and with parent or guardian involvement where required by law.

Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice within the app or by other appropriate means. Continued use of Trace after changes take effect constitutes acceptance of the updated policy.

Contact

Questions or requests? Email support@tracefiction.com.