Privacy Policy

1. Who we are

Trace (“Trace,” “we,” “us,” or “our”) is an ingredient-science application that helps you explore the compounds in food, their documented interactions, and build and save recipes. Trace is available on the web at tracebio.app and as mobile applications for iOS and Android. This Policy covers all of them.

Trace is operated by Off The Clock Studio LLC, a Georgia limited liability company. For any privacy question or request, contact us at privacy@tracebio.app.

This Privacy Policy explains what personal information we collect, why, who we share it with, how long we keep it, and the choices and rights you have.

2. Who may use Trace

Trace is intended only for adults aged 18 and older. We do not direct the Service to children and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us at privacy@tracebio.app and we will delete it.

3. Information we collect

3.1 Information you provide

• Account information. Your email address and a password. Passwords are handled by our authentication provider (Supabase) and stored only in hashed form — we never see or store your plaintext password.
• Profile information. A display name and any other profile details you choose to add.
• Content you create. Recipes you build or save, meal plans, ingredients you save, and anything you choose to publish to community features.
• Recipe Import submissions. The recipe URL you submit is fetched and parsed to extract a structured recipe. See section 5.
• Subscription and purchase information. If you buy a subscription or a one-time purchase, our payment and subscription providers process the transaction and tell us what you are entitled to — your plan, its status, and when it renews or expires. We never receive or store your full card number. See section 6 for who those providers are.
• Communications. If you email us, we receive your message and contact details.

3.2 Information collected automatically

• Technical and log data. Our hosting and backend providers record standard technical data such as your IP address, device and browser type, operating system, timestamps, and the pages you access. Used for security, reliability, and debugging.
• Bot-protection data. When you sign up, sign in, or request a password reset, our human-verification provider (Cloudflare Turnstile) receives your IP address and browser signals to distinguish real users from automated abuse. This is not used to track you and does not build an advertising profile.
• On-device storage.To keep you signed in, we store an authentication session token in your browser’s local storage. It stays on your device.

3.3 What we do not collect

• No payment information. Trace does not currently offer paid subscriptions and does not collect payment details of any kind.
• No advertising identifiers, no ads, and no cross-app or cross-site tracking. We do not use your data to track you across other companies’ apps or websites.
• No precise (GPS) location.
• No third-party product-analytics SDKs. If we add analytics in the future, we will update this Policy first.

4. How we use your information

• Provide and operate the Service — create and authenticate your account, save your recipes and content, and deliver core features.
• Maintain security and prevent abuse — detect and prevent fraudulent, automated, or unlawful activity, and enforce our Terms of Service.
• Communicate with you — send account and service messages such as confirmation and password-reset emails, and respond to your requests.
• Improve and maintain the Service — diagnose problems using technical and log data.
• Comply with law — meet legal obligations and respond to lawful requests.

5. AI processing of content you submit

Trace does not send content you submit to any third-party AI provider. When you use Recipe Import, the recipe page you provide is parsed using the structured recipe data published by the source website. That processing happens on our own servers and the content is not transferred to an AI vendor.

Separately, we use AI tools to enrich our own ingredient and compound catalog — our reference data. That process operates on our catalog, not on your personal information.

If we introduce AI processing of content you submit, we will update this Policy and the subprocessor table below before doing so.

6. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only with service providers who process data on our behalf, under contract, to run the Service:

This list is current as of September 7, 2026. We may add or change providers; when we do, we will update this table and the “Last updated” date above. All providers listed process data in the United States.

Ingredient images are sourced from Unsplash and displayed with the required photographer credit. We do not send your personal data to Unsplash.

We may also disclose information:

• For legal and safety reasons — when required by law or legal process, or to protect the rights, safety, and property of Trace, our users, or others.
• In a business transfer — if the Company is involved in a merger, acquisition, financing, or sale of assets, subject to this Policy.

7. How long we keep information

• Account and content data is retained while your account is active and until you delete it.
• Technical and log data is retained for a limited period by our hosting providers under their standard retention practices.
• We may retain limited information where necessary to comply with legal obligations, resolve disputes, or enforce our agreements. Residual copies may persist in routine backups for a limited period before being overwritten.

8. Where your information is processed

The Service is operated from the United States, and your information is processed and stored there. If you access Trace from the European Economic Area, the United Kingdom, or elsewhere, your information will be transferred to and processed in the United States. Where required, such transfers rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

9. Your rights and choices

9.1 Everyone

• Access and update most of your account and profile information directly in the app.
• Delete your account. You can delete your account and its associated data from within the app, under Settings → Delete account. You can also request deletion at any time by emailing privacy@tracebio.appwith the subject “Delete my account.” When you delete your account we remove your profile and the content associated with it; some data may remain in backups for a limited period, and we may retain limited records where the law requires.

9.2 EEA and UK (GDPR)

You have the right to access, rectify, erase, restrict, or object to processing of your personal data, and the right to data portability. Where we rely on consent, you may withdraw it at any time. You may lodge a complaint with your local supervisory authority.

Our legal bases are: performance of a contract (to provide the Service you request), our legitimate interests (to secure, maintain, and improve the Service), consent (where we ask for it), and compliance with legal obligations.

9.3 California (CCPA/CPRA)

California residents have the right to know what personal information we collect and how we use it, to access, delete, and correct it, and to be free from discrimination for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

9.4 How to exercise your rights

Email privacy@tracebio.app. We will verify your request, typically by confirming control of your account email, and respond within the timeframe required by applicable law.

10. Security

We protect your information using industry-standard measures, including encryption in transit (TLS), hashed passwords, and database row-level security that restricts access to your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Third-party links

The Service may link to third-party sites or display third-party content, such as Unsplash photographer profiles or external data sources. We are not responsible for their privacy practices; review their policies separately.

12. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the Service after an update means you accept the revised Policy.

13. Contact us

Off The Clock Studio LLC
privacy@tracebio.app