See https://www.tracefiction.com/privacy

This policy describes how we collect, use, and share information when you use Trace (“the Service”). Trace is operated as a sole-trader service based in England. By using Trace you agree to the practices described below. If you do not agree, please do not use the Service.

Information we collect

Trace does not host fan fiction stories. We store only metadata and content you create yourself:

Account information provided via Auth0 (email address, display name, profile picture).
Library metadata you add or import (story URLs, titles, authors, tags, chapter counts, word counts, and similar publicly available fields from AO3 and FanFiction.net).
Claim records — metadata snapshots from different sources associated with catalog entries, stored to maintain data accuracy and provenance.
Your personal data that you create within Trace (reading status, personal notes, ratings, and reading progress).
Technical logs (IP address, user-agent string, request timestamps) for security, abuse prevention, and service diagnostics.
Browser extension processing when you install and use the Trace browser extension — including local extension storage, optional on-page labels on supported archive sites, and metadata or reading progress sent to our servers. Details are in the Browser extension section below.
Manually entered and user-contributed metadata

When you manually add stories or metadata, we treat that information as user-contributed. It may be updated or reconciled over time when more authoritative sources — such as the browser extension reading metadata from the story page on a supported archive — provide matching information for the same work.

Cookies & tracking

Trace uses cookies and local storage solely to maintain your authenticated session (via Auth0) and to remember user preferences such as theme selection. We do not use third-party advertising cookies.

We may enable Plausible Analytics on our public marketing pages for privacy-first, aggregated website analytics. When the Plausible script is not loaded for your visit, no data is sent to Plausible. Where it is enabled, Plausible does not use cookies for analytics, does not track individual users across the web, and does not collect personal information. That measurement approach is designed to be GDPR-friendly and typically does not require a separate cookie consent banner for analytics alone.

Browser extension

Trace offers a browser extension (Chrome, Safari, and Firefox) that works together with the website and your account. This section describes what the extension accesses, what stays on your device, and what is sent to Trace’s servers.

Sites the extension uses. The extension runs scripted features only on supported Archive of Our Own and FanFiction.net pages (for import, reading progress, and optional on-page library labels) and on Trace’s own websites so it can stay linked to the same signed-in session as the web app and open Import or help pages. It does not read or modify arbitrary websites outside those purposes.

Data stored locally in the extension. Depending on how you use Trace, the extension may keep in browser extension storage: a credential or token Trace provides so the extension can call Trace’s APIs on your behalf; your preferences (such as automatic progress updates and whether to show on-page labels); and a cached map of your library status fetched from Trace so labels can render without contacting our servers on every keystroke. This local data is tied to your browser profile and is removed when you remove the extension or when Trace invalidates your session, subject to browser behaviour.

Data sent to Trace’s servers. When you use import or automatic reading-progress features on supported archive pages, the extension sends metadata from the page you are viewing (for example title, author, identifiers, chapter counts, tags, ratings, and similar fields that appear on the page) and reading progress you generate by reading there. It does not send full story body text or other complete chapter content. The extension may also call Trace’s APIs to refresh your library-status cache and to confirm account capabilities. All of this is transmitted over HTTPS to Trace, not to unrelated third parties for advertising or resale.

On-page display. When enabled, the extension may show small labels or controls on supported archive pages (for example your library status or shortcuts to add a work) using data from Trace and the local cache described above. You can turn off relevant features where Trace provides a control in the extension or app settings.

Catalog and shared metadata. Metadata the extension sends from archive pages may also be used to reconcile and improve the shared Trace catalog (for example titles, authors, and counts that appear publicly on those sites), consistent with the “Manually entered and user-contributed metadata” section above. We still do not collect full story text through the extension.

We do not sell personal information through the extension, and the extension does not load third-party advertising or behavioral analytics scripts. If you do not install or use the extension, none of this extension-specific processing applies.

How we use your information

Provide, operate, and improve the Service — including syncing your library across devices.
Process transactions and send related notices (see “Payment processing” below).
Prevent fraud, abuse, and service disruptions.
Comply with legal obligations and enforce our Terms of Service.
Payment processing

Payments for Trace Pro are processed by Stripe, Inc. When you subscribe, Stripe collects your payment information (card number, billing address) directly. Trace does not receive or store your full card details. Stripe’s use of your data is governed by the Stripe Privacy Policy.

Data retention & deletion

We retain your data for as long as your account is active or as needed to provide the Service. You can export your data and delete your account at any time from the Account page. Deletion removes your library and account data from our database. Certain technical logs may be retained for a limited period after deletion for security and legal compliance purposes.

Sharing

We do not sell your personal data. We share information only with the service providers necessary to operate Trace:

Auth0 (authentication)
Stripe (payment processing)
Plausible Analytics (when enabled on our marketing site: privacy-first, aggregated website analytics)
Cloud hosting providers (database and application hosting)
Each provider receives only the minimum data necessary to perform its function.

International transfers

Trace is based in England, but some of our service providers (Auth0, Stripe, cloud hosting) process data in the United States. Where personal data is transferred outside the United Kingdom, we rely on UK International Data Transfer Agreements, standard contractual clauses, or other lawful transfer mechanisms to ensure your data receives an adequate level of protection.

Your data protection rights

Trace is the data controller for the personal data described in this policy. We process your data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We extend the same rights to all users regardless of location:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — request deletion of your data (you can also delete your account directly from the Account page).
Portability — receive your data in a structured, machine-readable format.
Restriction & objection — ask us to limit or stop processing your data in certain circumstances.
Our legal bases for processing are: a) performance of our contract with you (providing the Service), b) our legitimate interests (security, service improvement), and c) your consent where applicable.

To exercise any of these rights, contact us at support@tracefiction.com. If you are in the UK and are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Your rights under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

Right to know — you may request the categories and specific pieces of personal information we have collected about you.
Right to delete — you may request deletion of your personal information.
Right to opt out of sale — Trace does not sell personal information. We have not sold personal information in the preceding 12 months.
Non-discrimination — we will not discriminate against you for exercising your CCPA rights.
Categories of personal information we collect include: identifiers (email, name), internet activity information (IP address, user-agent), and commercial information (subscription status). To make a verifiable request, email support@tracefiction.com.

Age restrictions

Trace is not directed to children under 13. We do not knowingly collect personal information from children under 13.

Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice within the app or by other appropriate means. Continued use of Trace after changes take effect constitutes acceptance of the updated policy.