Privacy Policy

Tracecove Inc.
Effective date: October 15, 2026
Canonical location: https://tracecove.com/privacy

1. Who we are and what this Policy covers

Tracecove Inc., a Delaware corporation operating as Tracecove ("Tracecove," "we," "us," or "our"), is responsible for the personal information it handles as described in this Policy. This Policy applies to our websites, applications, APIs, developer tools, shared platform services, and related services that we own or operate and make available under it (the "Services"). Our Terms and Conditions are available at https://tracecove.com/terms.

The information involved depends on the Service, the features actually enabled, and your choices. A product notice may explain a particular feature in more detail. We provide additional notice and obtain consent where required before a new use or collection begins. A mention of a possible future feature in this Policy does not mean that it is currently operating or give permission to activate it.

The Services are initially intended for users in the United States and Canada. We may expand availability to the European Union and other countries. Product availability and additional regional notices depend on the actual offering. An intended market does not determine where information is processed or remove protections that apply to our activities under the law.

When we process information only on an organization's instructions, such as data in a partner's application or an organization-managed workspace, that organization may be responsible for its purposes and disclosures under its own privacy notice. Our handling in that role is governed by the applicable processing agreement and law. Contact the organization for its decisions, or contact us and we will help route the request as appropriate. Tracecove remains responsible for processing it controls independently, including its own account administration and legal obligations. Signing in does not by itself authorize access to or sharing of every product's records.

This Policy does not govern an independent website, service, employer, community, or partner merely because it links to or integrates a Service. Its own notice applies to its independent practices.

2. Information you provide and information from others

2.1 Accounts contacts and support

When you register, manage an account, or communicate with us, we handle the information involved in that interaction, such as your name, email address, account identifier, contact details you provide, preferences, and the content of your request. An enabled phone feature also involves your phone number. Account systems handle authentication information needed for the sign-in method in use, such as password-verification records, recovery-verification records, sessions, verification results, and security events. The exact method depends on the product and its available sign-in options.

Support correspondence can include information you choose to send, attachments, the issue described, and our response history. Do not send passwords, recovery keys, authentication codes, government identification, or sensitive health information through ordinary support channels unless an appropriate process specifically asks for it.

2.2 Content collaboration and product records

Where a product accepts content or supports an interaction, we handle the content you submit and the records involved in the features you use. Depending on the product and features offered, examples can include household membership and invitations, chores and schedules, photo submissions and notes, partner reviews, reward choices, credits, and redemption history; workspace membership, invitations, demo metadata and state, and accepted application materials; or submitted text and artwork, designs, saved proofs, approvals, organization records, and order or test-order history. These categories apply when the relevant feature is enabled and the information is provided or collected through it.

Shared content can reveal personal circumstances beyond its label: a photograph may show people, a home, or a location, and a document or artwork may contain sensitive information. Upload only information appropriate for the feature and its stated restrictions. A pilot that prohibits sensitive or production data remains subject to that restriction.

2.3 Transactions and connected services

When a purchase or fulfillment feature is offered, the information needed can include billing and delivery contacts, order contents, payment or transaction references, proof approvals, fulfillment events, returns, and support history. The purchase notice identifies the relevant seller and payment arrangements.

If you authorize an integration, we receive and use the information made available within that connection's scope, which may include account identifiers, selected files or records, permission details, and action history. We explain any additional information needed by the feature before collection where required. We do not treat connecting one account as permission to import unrelated records or contact all of its contacts.

2.4 Information provided by other people

Other users or organizations can provide information about you when they invite you, share a workspace or household with you, submit content involving you, or report a concern. We use it for the relevant permitted purpose, subject to applicable notice, consent, and other legal requirements. Receiving your number from someone else does not by itself establish your SMS consent. We may also receive delivery status, authentication results, or security information from providers involved in a feature you use.

3. Technical usage and communications information

Online requests expose technical information such as an IP address, browser and device characteristics, the requested resource, and request timing to the systems serving them. Where logged or otherwise collected in the applicable Service, we use request and error records, account and session identifiers, security signals, and product activity to operate, protect, and troubleshoot it. Product interaction history can include actions, state changes, and timestamps.

An enabled private-demo feature can involve activity such as navigation, page paths, named click labels, session starts, resets, and state revisions. Its more specific activity notice explains the collection actually involved. This is not a statement that every Service records sessions, captures screen contents, or collects every form entry.

Where messaging is enabled, we handle the recipient and sender details, communication content needed to send or receive the message, timestamps, routing and delivery status, errors, and preference or consent records. A consent record can contain the disclosure version, the subject and channel selected, the recipient's action, and when and how it occurred. An enabled call feature can involve caller and recipient details, call timing, duration, and status. Any recording or transcription requires the applicable advance notice and consent; this Policy does not represent that recording is currently used.

An IP address or information you submit can indicate an approximate location. Precise device location is a different category and requires an enabled feature, an appropriate explanation, and any required permission. Listing event, encounter, health, or location capabilities does not establish that those capabilities currently collect information.

4. Sensitive information and specialized features

Content and specialized features can involve health and wellness observations; account-security or identity-verification information; physical encounter or participation records; professional introductions and relationship information; location; or reports and allegations submitted for review. A verification feature can involve government identification or biometric information where specifically implemented and lawfully supported. The categories and purposes depend on the actual feature. Account authentication alone does not mean that government identification, biometrics, or a background check is involved.

Where a feature lawfully supports sensitive information, we may collect, store, and use it for the purposes disclosed for that feature, including providing the functionality you request, carrying out authorized workflows, or protecting accounts and service integrity, as applicable. The permissible scope depends on the information, purpose, product, your choices, and the law; a general acknowledgement of this Policy does not authorize every possible use. We apply the collection, purpose, retention, and other limits required by law, including any additional protection for minors.

For a specialized feature, we explain the relevant sensitive information, purposes, recipients, and choices through the feature or an applicable notice and obtain any required separate consent before the processing begins. Where law requires a consumer-health-data privacy notice, a biometric notice, a health-provider arrangement, or another specific disclosure or safeguard, that requirement applies in addition to this Policy.

For a health or wellness feature, information remaining solely on your device is distinct from information you transmit to Tracecove or a provider. Local capture, cloud synchronization, AI processing, and sharing with another person or organization are separate capabilities. Applicable feature information explains the storage, transfers, choices, and deletion arrangements relevant to your use, with additional disclosures where required. This Policy makes no claim of HIPAA certification, HIPAA compliance, or healthcare-provider status.

5. Why we use personal information

For the information and features actually involved, our purposes are to provide and administer the Services you request; register and authenticate accounts; enforce product permissions; store and present authorized content; operate collaboration and product histories; send authorized messages and configured reminders; respond to support; and troubleshoot, analyze usage and performance, evaluate, and improve service operation, subject to any required consent or other applicable choice.

Where applicable to an enabled feature, we also use the necessary information to process a transaction or fulfillment request, carry out an authorized integration or automation, investigate abuse or fraud, secure accounts and systems, resolve disputes, keep required records, and comply with law. Service improvement does not automatically authorize unrelated advertising, sensitive-data reuse, or training an AI provider's general-purpose model.

We limit collection and use to the purposes described in the applicable notices and other purposes law permits. If we propose a materially different purpose, we provide the disclosure and any consent or choice the law requires before beginning that use. You can decline optional processing; we explain if declining information necessary for a feature prevents that feature from working.

6. When and with whom information is disclosed

6.1 Providers acting for Tracecove

We use providers for functions such as hosting, storage, network delivery, authentication, security, technical support, and, where implemented, analytics, reliability monitoring, transcription, payment, fulfillment, or authorized AI processing. Information made available depends on the function. Providers acting on our behalf are to process it for the applicable service under appropriate restrictions; they do not receive permission from this Policy to use it for unrelated marketing or other independent purposes. We remain accountable where applicable law requires us to oversee processing for us.

Some participants, such as telecommunications carriers, an independent payment provider, or a service you connect, may also process information for their own legal or operational purposes under their own notices. We distinguish those independent purposes from processing on our instructions when explaining the feature. A general label of "service provider" does not remove a party's actual responsibilities or your legal rights.

6.2 People and organizations within your chosen product context

Information is disclosed to recipients contemplated by the functionality and permissions you use, such as a partner in your household, an invited collaborator, an authorized organization administrator, or a recipient you choose. For a live order, selected design and delivery information may need to reach an authorized seller or fulfillment participant. We provide any additional disclosure and obtain consent required for the feature. Your account in one product does not itself make another product's private content available to its users.

Consider the recipient before sharing. A recipient may save a permitted copy or separately determine how to use information under its own obligations. We do not represent that removing a sharing link recalls all previously obtained copies.

6.3 Legal requirements protection and business changes

We may disclose information when law requires it, in response to valid legal process, or when legally permitted and reasonably necessary to protect rights, safety, or service integrity, investigate misuse, or establish or defend legal claims. The scope should be limited to the purpose and applicable legal authority.

Personal information may be involved in a proposed or completed merger, acquisition, financing, reorganization, or transfer of all or part of a business, subject to applicable confidentiality, purpose, notice, consent, and other legal requirements. Such a transaction does not authorize unrelated reuse, override a product-specific restriction, or make messaging consent a transferable marketing asset.

6.4 Special protection for SMS information and consent

We do not share mobile information with third parties or affiliates for their marketing or promotional purposes. SMS opt-in information is not sold, rented, exchanged, or transferred to give another sender permission to contact you. Consent remains a direct agreement between you and the identified sender for the subjects you selected. For this consent-data restriction, sharing with third parties means disclosure for another party's independent use; limited processing solely to deliver or administer our messages is addressed separately below.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

We use messaging providers and carriers to deliver communications on our behalf and maintain compliance, including processing recipient numbers, delivery information, and consent or suppression evidence when necessary for that function. That limited processing does not give them or another business permission to use your opt-in to send their own messages. A legally compelled disclosure must be assessed under applicable law. No broader disclosure provision in this Policy permits the sale or onward transfer of SMS consent. If a proposed change in business ownership or sender would require a new opt-in, the prior consent is not treated as permission to avoid that requirement.

7. Cookies tracking and advertising choices

We use cookies and similar browser or device technologies, including SDKs where implemented, for functions such as sessions, authentication, security, preferences, and analytics, as applicable to the Service. The technologies actually enabled depend on the Service. The applicable notice and controls distinguish necessary functions from optional analytics. The company website stores your appearance preference in your browser until you change it, clear site data, or the browser removes it. You can use browser or device settings to control storage and permissions; blocking necessary storage may affect sign-in or another requested feature.

Hosting and security providers also use browser-based checks to detect automated or abusive traffic. These checks process technical browser signals and can use security cookies.

Technologies used for analytics and monitoring can collect device or installation identifiers, page or screen activity, feature interactions, performance information, and error records. Providers receive the information involved in their function as described in section 6. Details and choices concerning a particular technology are provided through the relevant Service or a supplemental notice where needed or required by law. Controls available in a browser, device, or Service can differ; a setting for one Service does not necessarily control another.

We do not currently use advertising trackers or sell or share personal information for advertising. This describes current practices, rather than a promise that the Services will never have advertising. Before introducing a relevant advertising, targeted-advertising, sale, or sharing practice, we will provide the disclosures and implement the consent, opt-out, preference-signal handling, and sensitive-data restrictions required by law. The SMS protections in section 6.4 still apply.

Our company website does not currently change its behavior in response to a browser's Do Not Track signal. A product-specific notice describes any different response for that Service. Do Not Track is distinct from Global Privacy Control and other legally recognized opt-out preference signals.

Where applicable law requires recognition of an opt-out preference signal, we honor it for the processing and context the law covers. At present, the advertising sales and sharing described above are not occurring. A preference signal is not an account-deletion request or a request to disable all necessary security functions. We provide any required consent mechanism before enabling nonessential technologies that require consent.

8. AI automated processing and training

Where enabled, our Services use AI inference and automation. Depending on the feature, processing can support generating or transforming content, transcription, summarization, search, recommendations, or actions you authorize. These features can process the inputs and context selected for them, instructions, outputs, connected-service information, and action or approval history. For an enabled voice feature, inputs can include audio and transcripts. On-device processing, direct transmission to an AI provider, and processing through a managed service involve different recipients and storage arrangements. We explain material processing and choices through the feature or an applicable notice, including additional information where required by law. A permission to perform one action does not authorize unrelated account access, disclosure, or model training.

We do not currently send personal information to AI providers to train their general-purpose models. If a future feature proposes training or a materially different reuse involving personal information, we will identify the purpose, applicable provider role, and available choices and obtain any consent or other legal authority required before that activity starts. Some information and products may be subject to restrictions that prohibit or further limit such a use.

Information sent to a provider can be retained to perform the requested processing and for applicable security, abuse-prevention, or legal purposes under the relevant arrangements. Any additional storage or reuse depends on the feature, provider arrangement, your choices, and applicable law. We do not represent that every AI feature processes locally or that every provider retains information for the same period.

We do not rely on this Policy alone to authorize a solely automated significant decision or sensitive profiling that requires additional notice, consent, assessment, or human review. Where applicable law gives you a right to information about automated processing, an objection or opt-out, or an opportunity for human review, you can contact privacy@tracecove.com. Product controls and notices provide additional detail where the feature requires it.

9. Retention and deletion

We retain personal information for the period reasonably needed for its disclosed purpose, subject to applicable law. Relevant criteria include whether you continue to use a feature; the need to maintain an authorized shared record, complete a transaction, investigate a security event, demonstrate consent or an opt-out, handle a dispute, or meet a legal recordkeeping requirement; the sensitivity of the information; and the feasibility and legal requirements of deletion from the systems involved.

An expired session, disabled link, closed account, or reset demo is not necessarily physical erasure of all related records. A record retained for a limited legal or security purpose must not be repurposed merely because it remains stored. Backup copies and provider-held records may follow separate deletion processes, subject to the deadlines and exceptions the law actually permits. We do not promise instant deletion from every copy or an exemption from statutory deletion requirements.

Ask privacy@tracecove.com about access, deletion, or retention for a particular record. We explain any applicable exception to a request. Removing an account may affect shared records, and deleting a local application may not delete information previously transmitted to another service. Product-specific retention information supplements these criteria where applicable.

10. Safeguards and incidents

We use safeguards intended to protect personal information in light of the sensitivity, use, and risks involved. No transmission, storage system, or service can be guaranteed completely secure.

Report a suspected privacy or security issue to privacy@tracecove.com or compliance@tracecove.com without including unnecessary sensitive material. We assess incidents and provide notices to affected people, regulators, or others when required by applicable law. A contractual exclusion does not remove mandatory privacy or breach-notification duties.

11. International processing

Tracecove is based in the United States. We use application hosting and storage in the United States, together with service-provider infrastructure that can involve other countries. The locations involved depend on the Service, provider, and configuration. A storage location does not necessarily determine where network requests, AI processing, logs, backups, or administrative and support access are handled.

Accessing a Service from another country can involve transferring personal information outside your country. Authorized Tracecove personnel and providers may also access or process information from other countries where permitted, subject to applicable requirements. More specific product or regional disclosures provide additional location information where required.

Information processed in another jurisdiction may be subject to its laws and lawful access by its authorities. Where applicable law requires an assessment, contractual protection, transfer mechanism, notice, or consent, that requirement must be met for the transfer. Contact privacy@tracecove.com for information about the safeguards relevant to your information. This Policy does not represent that all data stays in Canada, the United States, or another particular region.

12. Your choices rights and requests

Depending on the law that applies to you and the processing involved, you may have rights to confirm processing; access personal information and information about its use or disclosure; correct inaccurate information; request deletion; receive or transfer a portable copy; withdraw consent; object to or restrict certain uses; opt out of sale, sharing, targeted advertising, or certain profiling; limit specified uses of sensitive information; and appeal a denied request. Rights and exceptions vary. A conditional description does not mean that every statutory regime applies to every Tracecove activity.

To make a request, email privacy@tracecove.com with the Service involved, the right you want to exercise, and enough information to locate the account or record. Do not send a password, recovery key, verification code, full government identification number, or unnecessary health information. You may also write to the address in section 16. Where a product provides a suitable request control, you can use it.

We take reasonable steps to verify identity and authority proportionate to the request, protect other people's information, and respond within applicable legal deadlines. Authorized representatives can submit requests where the law allows; we may need evidence of their authority and, where permitted, verification from the person concerned. We explain a denial or limitation to the extent required by law, including applicable appeal options. A fee is charged only when legally permitted and after any required explanation.

To appeal a decision where applicable, reply to our decision or email privacy@tracecove.com with "Privacy appeal" in the subject and identify the request. We review the appeal and provide the result and any required regulator-complaint information within the applicable period. You can also complain directly to the relevant privacy authority without first waiving a court remedy or agreeing to arbitration. We do not unlawfully discriminate or retaliate against you for exercising a privacy right.

Withdrawal does not undo processing that was lawful before it occurred. If information or permission is necessary for a requested feature, withdrawal can affect that feature, which we explain where relevant. Some records may remain under a valid legal exception. An organization controlling your information may need to address a request itself; our processing role does not remove our own duties to assist where required.

13. Communications preferences

Use supported product settings for available notification choices. For an enabled SMS program, STOP to the shared number +1 (877) 307-2459 blocks all product messages using that sender. Narrower product settings do not override that block. HELP or support@tracecove.com provides assistance. Separate authentication senders have their own request and opt-out rules, described in section 8 of the Terms. A broader request to stop communications is handled according to its scope and applicable law.

If promotional communications are introduced, their enrollment and unsubscribe mechanisms will identify the relevant sender and scope. We keep the limited suppression information needed to honor an opt-out where appropriate; deleting an advertising contact record must not silently re-enroll it. An opt-out from promotions does not itself cancel a requested order or erase a legal obligation to send an appropriate service notice through an allowed channel.

14. Children and teenagers

Our general Services are not directed to children under 13, and individual products or local law may require a higher age. Teenagers who meet the applicable minimum age may use eligible Services with the parent or guardian involvement required by the Terms and law. A general age rule does not itself establish valid consent for a minor's personal information.

If you believe a child below the applicable age has supplied personal information without required authorization, contact privacy@tracecove.com so we can assess and take the action required by law, including deletion where appropriate. Where required, we obtain a parent or guardian's consent before collecting or using a minor's information and provide the applicable parent and minor rights. We do not introduce a child-directed feature through this general Policy without its required notices and safeguards.

15. Regional protections and changes to this Policy

For Canadian activities to which federal or provincial private-sector privacy law applies, processing must have an appropriate purpose and the form of consent or legal exception required for that information and context. Sensitive information can require express consent. Questions and complaints can be directed to our privacy contact, and you may contact the Office of the Privacy Commissioner of Canada or an applicable provincial authority. Information about a transfer is not permission to avoid accountability for processing performed for us.

For people whose information falls under applicable U.S. state privacy laws, section 12 provides a request and appeal channel; any additional legally required notice at collection or regional disclosure will be provided for the covered activity. Rights and additional disclosures depend on the law's coverage, the information, and the processing involved.

If an activity falls within European Union or United Kingdom data-protection law, we identify a lawful basis for each relevant purpose. Depending on the actual activity, that may be performance of a requested contract or precontractual steps, compliance with a legal obligation, consent for an optional activity, or a legitimate interest that is not overridden by your rights. Sensitive information requires any additional legal condition. Before a covered offering begins, the applicable notice must identify the actual purpose-to-basis mapping, relevant interests, transfers, recipients, and any representative or other required information. This conditional framework is not a declaration of an international launch or universal compliance.

We update this Policy when practices or legal requirements change and identify the version by its effective date. For material changes, we give the notice required for the circumstances, using appropriate available channels. We obtain consent where required before a new purpose begins. Continued use or an updated date is not a substitute for required consent, and a new policy does not retroactively authorize an unlawful earlier use.

16. Contact us

Privacy inquiries rights requests and complaints: privacy@tracecove.com
Customer support and communications assistance: support@tracecove.com
Legal and compliance concerns: compliance@tracecove.com
Website: https://tracecove.com

Privacy Officer: James Ferdinand Lukanta
Contact: privacy@tracecove.com

Mailing address:
Tracecove Inc.
217 Dundee Drive
South San Francisco, CA 94080
United States