Your identity.
Your eyes only.

Trace helps you understand your own digital footprint. This page explains what the app processes, what leaves your browser, and the limits of each connection.

It starts with ownership.

Real lookups require an authenticated session with a verified email address or phone number. Supabase handles identity verification, sign-in delivery, and session cookies. A phone verification does not unlock a lookup of someone else’s email address.

Connections are your choice.

Basic Google sign-in verifies identity. Inbox discovery requires a separate Google consent for read-only mailbox access. Trace checks that the inbox matches your verified email, searches for welcome or verification emails, and requests sender metadata from up to 24 matching messages. It does not fetch message bodies, send email, or delete messages.

Google’s permission covers read access to your mailbox. The app uses that permission only for the discovery described above. You can remove access in your Google Account connections. Expired provider tokens require reconnection.

Breach records tell part of the story.

When the deployment has a Have I Been Pwned API key, your verified email address is sent to that provider to check known breach records. Results can include affected services, breach dates, and data categories. A historic breach does not confirm an active account, and no match does not guarantee your information has never been exposed. Phone breach discovery is not supported.

Your CSV stays close.

CSV imports are processed in this browser. Trace extracts website domains and discards password, username, and note fields. The file is never uploaded. Imported results and review marks remain in the current page session and disappear when the page is reloaded.

A little less to keep.

This app does not write scan results to an application database. Results remain in memory for the current visit. Signing in uses Supabase session cookies; your theme preference is stored locally. The service worker caches only the public offline page and icons, never dashboard, authentication, or API responses.

External data providers and the hosting service process requests under their own privacy policies. The app includes no advertising, analytics, or tracking scripts. Downloading a report creates a file on your device, which you control.

The demo is a demo.

The demo uses clearly labeled sample accounts and exposures. It performs no personal lookup. Local CSV imports in the demo still stay in your browser.