Privacy Notice

Effective September 27, 2026. TraceDojo is operated by Syed Arman in New York, United States.

For privacy requests, contact syed@tracedojo.com.

What we collect and why

• Your email and authentication records to create accounts, deliver sign-in codes, and maintain secure sessions.
• Project names, uploaded reports, scenario results, and test metadata to store and compare your evidence.
• Subscription identifiers, billing status, and payment-related records to manage subscriptions, account limits, and accounting obligations.
• Technical request, security, and error information to operate, troubleshoot, and protect the service.
• Support messages and information you choose to send us to respond to your requests.

Hosted usage records include account identifiers, project-creation and upload timestamps, upload-batch counts, and days when an account reaches its storage allowance. They help us understand setup and plan usage and do not contain copies of your reports, model prompts, or credentials.

Local tests and model providers

Local CLI tests do not send background usage telemetry or automatically upload reports. Uploading is an explicit action. Your adapter may send data directly to a model provider according to your code and configuration; that provider’s policies apply. The hosted dashboard does not execute uploaded adapters. Review reports for sensitive information before sharing them; automated redaction is not comprehensive.

Service providers and processing locations

• Vercel hosts the web application and processes web requests and operational logs.
• Supabase provides authentication and the hosted database. Our production database is in Ohio, United States.
• Resend delivers sign-in emails.
• Stripe processes payments. Card details are entered through Stripe components; TraceDojo does not receive your full card number.
• Porkbun forwards messages sent to our support address to Google’s Gmail service, where we handle support correspondence.

These providers process information needed for their services and may process it outside your country. The database region does not mean all provider or support records stay in that region. We do not sell personal information, share it for cross-context behavioral advertising, or use uploaded reports to train AI models. We may disclose information when required by law or reasonably necessary to protect users, investigate abuse, or resolve disputes.

Retention and deletion

Hosted reports remain until you delete them or your account is deleted. Downgrading does not automatically delete reports. You can export projects and delete hosted reports in the dashboard. Hosted usage milestones remain while the account exists and are removed from the active database with account deletion; deleting an individual report does not erase those milestones.

Request account deletion from your account email at syed@tracedojo.com. We may verify your identity before acting. Account closure includes stopping future subscription renewals and removing the account and its reports from active storage, except records that must be retained for legal, accounting, security, or dispute-resolution purposes. Export needed evidence first. Canceling a subscription alone does not delete data.

Database recovery uses scheduled daily Supabase backups, with a current seven-day backup availability window. Deleting active data does not immediately remove it from existing backups. Backups are used for recovery; completed deletion requests must be reapplied before restored data is returned to normal service. Provider security and legal records may follow different retention schedules.

Operational logs follow the configured provider retention and are used for troubleshooting and security. Support correspondence is retained as needed to resolve the request, maintain a support history, and address disputes. Financial records are retained as needed for accounting and legal obligations. We assess retention using those purposes, the account relationship, and applicable legal requirements; we do not promise immediate erasure from every provider system. Automatic customer-configured retention is not available.

Cookies and security

Authentication cookies keep you signed in. Disabling them can prevent access to your workspace. Payment providers may use cookies or similar technologies to process payments and prevent fraud. Security controls reduce risk but cannot guarantee absolute security. See our Security page for the implemented boundaries.

Your choices and rights

You can export or delete reports and contact us to request access, correction, or deletion of personal information. Depending on where you live, additional rights may include restriction, objection, portability, or a complaint to your privacy regulator. We respond under applicable law and may need to verify a request. Where relevant, we process information to provide the requested service, meet legal obligations, and pursue legitimate interests in maintaining and securing the service.

TraceDojo is intended for developers and business use, not children under 13. Contact us if you believe a child has provided personal information. Material changes to this notice will be communicated through the service or account email. The effective date identifies the current version.

See Terms and Contact.