Trace
Privacy Policy
Effective date: 1 August 2025 · Last updated: 1 August 2025
Trace ("we", "our", or "us") is a personal investment-tracking app. This Privacy Policy explains what information we collect, how we use it, and your rights over it. By using Trace you agree to the practices described here.
1. Information We Collect
- Account data — email address and password hash when you register.
- Portfolio data — stock symbols, quantities, prices, and trade notes you enter manually.
- Device tokens — Expo push-notification tokens so we can send you market alerts.
- Usage data — request logs (IP address, timestamp, HTTP method/path) for debugging and abuse prevention. Logs are retained for 30 days and then deleted.
We do not collect payment information, precise location, contacts, or any data from your device camera or microphone.
2. How We Use Your Information
- Authenticate you and secure your account.
- Display your portfolio, P&L calculations, and trade history.
- Send push notifications for market open/close summaries (you can opt out by disabling notifications on your device).
- Diagnose crashes and fix bugs using anonymised request logs.
We do not sell, rent, or share your personal data with advertisers or data brokers.
3. Third-Party Services
- Expo / FCM / APNs — push notification delivery. Your device token is transmitted to Expo's servers to route notifications. See Expo's Privacy Policy.
- Yahoo Finance (unofficial) — live and historical market prices fetched server-side. No personal data is sent to Yahoo.
- NSE India — market internals and sector data fetched server-side.
4. Data Storage and Security
Your data is stored in a PostgreSQL database hosted on a private server. We use TLS for all network transport, bcrypt for password hashing, and JWT (HS256) for session tokens. Access to the database is restricted to backend services only.
5. Data Retention
We keep your account and portfolio data for as long as your account is active. Request logs are purged after 30 days. If you delete your account all associated data is permanently removed within 7 days.
6. Your Rights
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion of your account and all associated data.
- Opt out of push notifications at any time via your device settings.
To exercise any of these rights email us at chhekur@gmail.com.
7. Children's Privacy
Trace is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.
8. Changes to This Policy
We may update this policy occasionally. We will notify you of material changes via an in-app notice or push notification. The "Last updated" date at the top will always reflect the current version.
9. Contact
Questions or concerns? Email chhekur@gmail.com.