Who we are
Tracehound ("Tracehound", "we", "us") operates the Tracehound website and service. For the personal data described in this policy, we are the controller (for California purposes, the "business"). You can reach us about privacy at support@example.com.
This policy covers people who visit our website, use the demo, create an account, use our API, contact us or submit an opt-out. It also explains what happens to identifiers that users search for.
Summary
- We keep no database of people and we do not sell or share personal data for advertising.
- Search results are processed in memory and sent to the user who searched. They are never written to our database.
- There are no passwords. Sign-in uses a one-time email code or Google.
- Search history stores only the query, its type, the result count, status and time, and users can switch it off.
- Anyone can opt out their identifiers, with or without an account.
Personal data we collect
| Category | What it includes | Source |
|---|---|---|
| Account | Email address and an optional display name; plan, token balance, settings and referral code. | You |
| Google sign-in | If you choose Google: the Google account identifier, name and avatar URL that Google provides. | |
| Sign-in codes | One-time 6-digit codes, stored only as hashes and valid for 10 minutes. | Generated by us |
| Sessions | One record per signed-in device, with IP address, user agent and timestamps. Sessions last 30 days. | Your browser |
| Search history | The query you entered, its type, the number of results, status and time. Not the results. | You (can be switched off) |
| API keys | For each key you create: a SHA-256 digest of the key (never the key itself), its name, its first characters, and when it was created, last used and revoked. | You |
| Billing | Stripe customer and subscription identifiers and subscription status. No card numbers. | Stripe |
| Opt-outs | Keyed one-way hashes of opted-out identifiers. For reviewed requests: the identifier, your contact email and any note you add. | You |
| Messages | Name, email address, topic and message sent through the contact form. | You |
| Request logs | Standard logs kept by our hosting provider, including requested URLs, IP addresses and timestamps. Used for security, abuse prevention (including demo limits) and debugging. | Your browser |
We do not knowingly collect sensitive personal data such as health, biometric or financial account data. We do not use advertising cookies or cross-site trackers. The cookies we set are those needed for sign-in and security.
Identifiers people search for
When a user searches for a username, email address or phone number, that identifier may relate to a person who is not our user. Here is exactly what happens to it:
- It is sent to the third-party public sources we query, in the form those sources need, so they can say whether an account exists.
- The public profile data those sources return is processed in memory, sent to the user who searched, and then discarded. We do not write it to our database or build profiles from it.
- If the searching user has history switched on, the identifier is stored as that user's query, together with its type, the number of results, status and time, until the user deletes it, switches history off or deletes their account.
- It is compared against the opt-out list before any source is contacted.
If you want searches for your identifiers to stop, use the opt-out page. You do not need an account.
How we use personal data, and our legal bases
The legal bases below apply under the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where other laws apply, we use personal data only for these same purposes.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating your account and signing you in | Account, Google sign-in, sign-in codes, sessions | Contract |
| Authenticating API requests and enforcing API limits | API keys, account, request logs | Contract; legitimate interests |
| Running searches and showing results | Account, search history, the searched identifier | Contract; legitimate interests |
| Billing and subscriptions | Account, billing | Contract; legal obligation (tax records) |
| Sending sign-in codes, opt-out codes and service notifications | Account, email address | Contract; legitimate interests |
| Honoring opt-outs | Opt-outs | Legitimate interests (respecting people's wishes); legal obligation where applicable |
| Answering messages | Messages | Legitimate interests |
| Security, abuse prevention and enforcing our terms | Sessions, request logs, search history, account | Legitimate interests; legal obligation |
| Complying with law and responding to lawful requests | Any relevant data | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights. Our interests are providing a working, secure service, preventing misuse that could harm people who are searched for, and honoring opt-outs. You can object at any time (see Your rights).
Who processes data for us
We use a small number of service providers, each bound by contract to process data only on our instructions:
- Stripe: payment processing and subscription management. Card details are entered on and held by Stripe.
- Resend: transactional email, such as sign-in codes, opt-out codes and service notifications.
- Google: sign-in, only if you choose to sign in with Google.
- Our hosting provider: runs the application and keeps standard request logs.
- Our database provider: stores account, session, history, billing identifier and opt-out data.
We also disclose information when required by law, to protect the rights, safety or property of people or of Tracehound, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the data transferred.
We do not sell personal data, and we do not share it for cross-context behavioral advertising.
How long we keep data
- Account data: until you delete your account.
- Sign-in codes: until used or expired (10 minutes).
- Sessions: until they expire after 30 days, you sign out, or you revoke the device.
- Search history: until you delete the entry, clear history, switch history off or delete your account.
- Search results: not retained; processed in memory only.
- Billing records: for as long as tax and accounting law requires.
- Opt-out hashes: for as long as the opt-out is in place, so the block keeps working.
- Reviewed opt-out requests: for as long as needed to handle the request and show that it was handled.
- API keys: until you delete your account. A revoked key stops working immediately; its record (digest, name and dates) stays with your account.
- Messages: for as long as needed to respond.
- Request logs: for the limited period our hosting provider keeps them.
Security
We protect personal data with measures appropriate to the risk, including HTTPS-only access, passwordless sign-in with hashed, short-lived codes, revocable sessions, access controls and hashing of opted-out identifiers. No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the authorities as the law requires. More detail is on our security page.
Your rights
Wherever you live, you can ask us for a copy of your personal data, ask us to correct or delete it, and ask questions about how we use it. Many of these are self-serve: you can edit your account, delete history entries, switch history off, revoke sessions and delete your account in settings. For anything else, email support@example.com.
We will verify requests before acting on them, usually by confirming control of the email address involved, and respond within the time the law requires. We will not discriminate against you for exercising your rights.
EU and UK residents (GDPR and UK GDPR)
If the GDPR or UK GDPR applies to you, you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing, including processing based on legitimate interests;
- receive data you provided in a portable format;
- withdraw consent at any time, where we rely on consent;
- lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first.
These rights also apply to people whose identifiers are searched by our users. Because we do not store search results, we usually hold nothing about you beyond an opt-out hash or a user's history entry containing the identifier.
California residents (CCPA as amended by the CPRA)
In the last 12 months we collected these categories of personal information, from the sources and for the purposes described above: identifiers (email address, name, Google account identifier, IP address, account and session identifiers); commercial information (plan and subscription records); internet or other electronic network activity (request logs, search history metadata); and the contents of messages you send us.
We do not collect sensitive personal information as defined by California law for the purpose of inferring characteristics about you. We disclose personal information to the service providers listed above for business purposes. We have not sold or shared personal information, and we do not knowingly sell or share the personal information of consumers under 16.
You have the right to know what we collect and how we use it, to delete it, to correct it, to opt out of sale or sharing (which we do not do), and not to be discriminated against for exercising these rights. You may use an authorized agent, whom we may ask to show proof of authorization. To make a request, email support@example.com.
Opt-out for people who are not users
You do not need an account to stop searches for your identifiers. On the opt-out page, you can block an email address immediately by confirming a one-time code, or request a block for a username or phone number, which a person reviews. We store opted-out identifiers only as keyed one-way hashes. Opting out does not remove accounts from the sites where they exist.
Children
The Service is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
International transfers
We and our service providers may process personal data in the United States and other countries whose data protection laws differ from yours. Where we transfer personal data from the EU, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum, or on an adequacy decision where one applies.
Changes to this policy
We will update this policy when our practices change. If a change is material, we will tell account holders by email or in the Service before it takes effect. The effective date at the top shows when it last changed.
Contact
Privacy questions and requests: support@example.com, or use our contact form and choose "Privacy, data or opt-out". Tracehound is the controller of the personal data described here.