Privacy Policy

1. Information TraceTray collects

TraceTray may collect the following types of information:

• account information from Clerk or a connected sign-in provider, such as your Clerk user ID, email address, name, profile image, account timestamps, and authentication status;
• account settings, including your generated TraceTray site key, website URL, selected plan, and account creation date;
• website interaction data sent through the TraceTray tracker, including cursor coordinates, cursor movement timing, pauses, clicks, taps, scrolling, page URLs, referrer URLs, session timing, device category, and randomly generated visitor and session identifiers;
• limited information about clicked or tapped page elements, such as the element tag, ID, CSS classes, and up to 50 characters of visible element text;
• analysis data, including calculated interaction features, browsing-pattern groups, statistical results, summaries, suggestions, and historical analysis results;
• bug reports, including the category, description, dashboard section, page URL, browser user agent, account identifiers, and submission time;
• subscription status and billing identifiers if paid plans are introduced, such as Stripe customer and subscription IDs;
• basic technical information that may appear in server or hosting logs, such as IP address, request path, browser information, timestamps, errors, and security events.

2. Account information and Google sign-in

TraceTray uses Clerk for sign-in, account sessions, and account management. When you use Google or another connected sign-in method, TraceTray receives only the account information made available through Clerk for authentication and account setup, generally an account identifier, email address, name, and profile image.

Google account information is used only to provide sign-in, identify your TraceTray account, and operate account-linked features. TraceTray does not use Google account information for advertising, does not sell it, and does not request access to Gmail, Google Drive, Google Calendar, or other unrelated Google services.

3. Behavioural website analytics

TraceTray customers add a JavaScript tracker to pages they choose to analyze. The tracker records interaction events needed to describe how visitors browse those pages. This can include movement coordinates, scroll positions, pauses, clicks, taps, page transitions, and session duration.

The tracker is not designed to record keystrokes, passwords, form-field values, payment details, or full session video. However, click and tap events may include a short excerpt of visible text from the selected page element. Website owners should avoid placing sensitive personal information directly inside clickable labels or elements that they choose to track.

4. Site owner responsibilities

Website owners using TraceTray are responsible for deciding whether the tracker is appropriate for their website and for providing any privacy notice, consent mechanism, cookie banner, opt-out, or other disclosure required by the laws that apply to them and their visitors.

Do not use TraceTray on pages intended to collect highly sensitive information, and do not configure it in a way that intentionally sends passwords, payment information, health information, government identifiers, or other sensitive personal data.

5. How information is used

TraceTray uses information to:

• create and manage accounts and site keys;
• receive, organize, and display website interaction sessions;
• calculate behavioural features and group similar browsing patterns;
• produce dashboard summaries, trends, journeys, comparisons, and areas to review;
• respond to bug reports, support requests, misuse, and security issues;
• operate future subscriptions and confirm plan access;
• maintain, debug, secure, and improve TraceTray.

6. Automated summaries

TraceTray may send summarized analysis information to Anthropic's API to produce readable explanations and suggested areas to review. The prompt may include aggregate cluster statistics, click summaries, page URLs, device comparisons, and calculated behavioural patterns. TraceTray does not intentionally send raw passwords, form entries, or full account credentials to Anthropic.

Automated summaries may be incomplete or incorrect. They are intended to help interpret the measured data, not to make legal, employment, medical, financial, or other high-impact decisions about individual visitors.

7. Third-party providers

TraceTray relies on third-party providers to operate the service. This currently includes Clerk for authentication, Google as an optional sign-in provider, Anthropic for automated analysis summaries, MongoDB for data storage, and hosting or server infrastructure for running the website and API. Stripe may be used for payments and subscriptions when paid plans are launched.

These providers may process information under their own terms and privacy policies. TraceTray does not control their systems, availability, security practices, or independent retention requirements.

8. Cookies, local storage, and session identifiers

Clerk may use cookies or similar browser storage needed for authentication, sessions, and security. The TraceTray tracker stores a randomly generated visitor identifier in local storage so separate page visits can be grouped into a browsing journey. TraceTray also uses browser storage for preferences such as light or dark mode.

TraceTray does not currently use behavioural tracking data for advertising.

9. Data sharing

TraceTray does not sell personal information. Information may be shared with service providers when needed to operate TraceTray, comply with law, investigate misuse, protect users or the service, or complete a business transfer such as a merger or sale.

Account holders can view analytics connected to their own TraceTray site key. TraceTray does not make individual visitor sessions public.

10. Data retention

TraceTray keeps account information, website sessions, analysis results, bug reports, and operational logs for as long as they are reasonably useful for providing the service, showing account history, handling support, investigating misuse, maintaining backups, or meeting legal and security needs.

Retention periods may vary by data type and may change as TraceTray develops. Some information may remain temporarily in backups or logs after deletion from the active database.

11. Your choices and deletion requests

You may stop future tracking on a website by removing the TraceTray tracker from that site. Account holders may reset stored page history from the dashboard where available.

For account deletion, access, correction, or other data requests, contact hello@tracetray.com. TraceTray may need to verify the request before changing or deleting account-linked information.

12. Children

TraceTray is not intended for children. Account holders should not knowingly use TraceTray to collect behavioural data from children where doing so would require parental consent or additional legal safeguards that have not been obtained.

If you believe a child has provided personal information to TraceTray in a way that should be reviewed or removed, contact hello@tracetray.com.

13. Security

TraceTray uses service providers and reasonable technical practices to protect accounts and stored data. No online service can guarantee perfect security. Account holders are responsible for keeping their sign-in method and site key secure.

14. International processing

TraceTray and its providers may process information in countries other than the country where an account holder or website visitor is located. Those countries may have different data-protection laws.

15. Changes to this policy

TraceTray may update this policy as the service, providers, or data practices change. The latest version will be posted on this page with an updated date.

16. Contact

Questions or requests about privacy can be sent to hello@tracetray.com.