PRIVACY POLICY

Trace is a reverse face search tool. The thing you give us is a photograph of a face, which under the GDPR and the KVKK is a special category of personal data. This page says exactly what happens to it, in plain language, with no clause that means the opposite of what it appears to.

Who we are

Trace is operated by Trace Labs ("we"). You can reach us at social@traceaifacescan.app or through the support form. Trace Labs is the data controller for everything described below.

What we collect

The photograph you upload. Cropped in your browser to a square around the face before it is sent, so what leaves your device is the face you framed, not the whole picture.
The results of your search. Match scores, the platform and handle of each match, the link, and a small preview thumbnail of each matching image.
Your account. An account ID and a hash of your recovery key. We do not have your recovery key itself — only a hash, which cannot be turned back into the key.
Your credit balance and the ledger of purchases and searches behind it.
A hashed form of your IP address, used to rate-limit free scans and account creation. We do not store raw IP addresses.
Your Telegram user ID, but only if you pay with Telegram Stars — it is how a payment is matched to your account and how support can sign you back in later.
A payment record if you pay by card: the amount, the card's brand and last four digits, the payment identifier, and the email address you enter on the payment page. We never see your card number. The page is hosted by Pocketsflow, which is the merchant of record for that sale — they take the payment and handle the tax, under their own privacy policy, and the billing details they need for that never reach us.
A payment record if you pay with cryptocurrency: the amount, the coin and the payment identifier our crypto processor gives us. We never see a wallet address, and the processor hosts the payment page — we do not handle the transfer ourselves.

We do not ask for your name, your phone number or a password, because Trace has no sign-up form. There is nothing to give us. The one exception is an email address, and only if you choose to pay by card: the payment page asks for one so it can send you a receipt, and it arrives with the payment record. It is not used to sign you in and we never send marketing to it; deleting your account erases it from the payment record, along with the address the payment came from.

Where your photograph goes

Trace runs the search on its own engine, on our own server — our own index, our own face model, our own scoring. It is not a thin wrapper around somebody else's search box.

But the photograph does still leave our server, and we would rather say so plainly than let "our own engine" be read as "it never goes anywhere". To find where a face appears, the engine queries public image search engines on your behalf, and when its own result comes back thin it also queries a commercial face search service. Roughly half of paid searches reach that second step. Ask us through the support form and we will tell you which services those are. Those engines fetch the image themselves rather than accepting an upload, so for the duration of one search — up to about ten minutes — the cropped square is served from a signed, unguessable web address. It is not listed anywhere, it is not indexed by us, and the address stops working when the window closes. It is a deliberate trade-off, and it is the only way this kind of search works at all.

What we cannot promise is what happens to that copy on their side. Those engines keep their own logs and caches and we have no control over them; their own policies apply. If you want to know exactly which engines a search queries, ask us through the support form and we will tell you.

All of this is set out on the scan screen itself, above the button that starts the search, and before your first search a dialog opens with the full text of what you are agreeing to. Nothing is searched until you accept it. If that text changes the dialog opens again, and your account records which version you accepted and when.

We share your data with nobody else. We do not sell it, we do not use it for advertising, and we do not build an identity profile of you or of anyone whose face you search.

The face index we keep

This is the part most face search services do not spell out, so here it is plainly. When a search confirms a match with high confidence, we write that face into our own index: the numerical measurement of the face, a small crop of it, and the public web address it was found on. The next search for the same person can then be answered from that index instead of paying a search engine again — which is why searches get faster and cheaper over time.

What that means, said directly: we hold face measurements of people who never came here and never asked to be in it. Every service of this kind does; most do not tell you. The index is built only from images that were already published on the open web, it holds no name we were given, no contact details and no profile, and only faces we could attribute with confidence are written at all.

If your face is in it, you can take it out. The removal page deletes every entry that matches your face and adds it to a permanent do-not-index list, so a later search cannot put it back. It needs one photograph and no account, and the photograph you send is not stored — we read the measurement and discard the file. It does not remove anything from the websites that published your photos; only they can do that.

How long we keep it

Uploaded photographs and result previews: 30 days, then deleted automatically. They are kept that long only so you can reopen a scan you already paid for.
Deleting a scan deletes its images immediately, and deleting your account deletes all of them at once — including the copy the search engine held while it was working. Neither is a "mark as hidden": the files are removed.
Accounts with no credits, no scans and no payments are deleted after 30 days of inactivity.
Payment records are kept as long as tax and accounting law requires, because we have no lawful way to delete them sooner. Deleting your account cuts the record loose from you: the link to the account and the address it was paid from are erased, and what is left is an amount, a date and the reference a refund needs.

Trace Watch: your own face

Trace Watch is an optional, paid service for watching your own face. It is the one place where we keep a face for longer than a search, so it has its own rules.

What you give us: one cropped photo of your face and a tick confirming it is yours. We derive a numeric face signature from it on our own engine.
What we do with it: every search started on Trace is compared with the signatures on watch, and once a month we run a regular Trace search with your photo. When a match or a new page is found, we message you in Telegram. The message never names, shows or describes the person who searched; we do not know who they are and would not tell you if we did.
How long: the photo and the signature are kept while the service is active and for 30 days after it ends, so that renewing does not require uploading again. Stopping the watch from the panel deletes both immediately. Deleting your account deletes them too.
Telegram: to deliver the alerts we store the numeric ID of the Telegram chat you connect. We send text only — never your photo, never a list of addresses.
Legal basis is your explicit consent, given by ticking the box; biometric data is processed only for the purpose you asked for and you can withdraw consent at any time by stopping the watch.

Where it is stored

On our own server in Germany, operated by Hetzner Online GmbH, inside the EU. Uploaded images are stored outside the web root and are served only through a signed link tied to your account — knowing a URL is not enough to open someone else's image. The one exception is the usage analytics described under Cookies, which PostHog processes in the United States and which never contains an image.

Your legal basis, and your rights

We process the photograph on the basis of the explicit consent you give in that dialog, before the first search runs, on a screen that states what is being accepted and links to this policy. That text also asks you to confirm that you are 18 or over and that you are not a citizen or resident of an EU member state; Trace is not offered to people in the EU. You can withdraw it at any time by deleting the scan or your account; that does not undo searches already run, but it removes what we hold. If this policy changes in a way that affects what happens to your photograph, we ask again rather than relying on the old acceptance.

Under the GDPR and the KVKK you have the right to access, correct, delete and export your data, and to object to processing. Trace is built so that most of this is a button rather than an email: the panel lets you see everything on your account, delete individual scans, and wipe the account entirely. For anything the panel cannot do, contact us through the support form.

Cookies

The panel sets two cookies and neither is for tracking: a session cookie, and a long-lived device cookie that keeps you signed in without a password. There is no advertising cookie and no cross-site tracking anywhere inside the panel.

To see where people get stuck, the panel and the public pages use PostHog, a product analytics service that processes usage data on servers in the United States. It records which pages you open and which buttons you press, and a replay of those interactions, linked to an internal account number that is not your account ID. It stores nothing on your device: no cookie, no local storage. The replay never contains an image — your photograph, the crop area and every result preview appear as blank boxes — and the result list itself, your recovery key, your API keys and your account ID are left out of it entirely. Form fields are masked. PostHog never receives a name you searched for, a match or a link to a result. Blocking posthog.com or using any ad blocker removes it, and everything works the same without it.

The public pages outside the panel — this one, the home page and the comparison pages — load Google Analytics and a Google Ads conversion signal, so that we can tell which advertisement brought somebody here. Both are configured to store nothing on your device: no analytics cookie, no advertising cookie, no identifier that follows you to another site. They measure pages, not people, and neither ever receives a photograph, a search, a result or your account ID.

The one thing the public pages may store is a single entry in your browser's local storage, written only when you close the price notice so it does not reappear. It holds the name of the notice you closed — no identifier, nothing about you — it is never sent to us, and clearing your browser data removes it. That is why this site still has no cookie banner: nothing is stored to recognise or follow you, and the one entry that exists is there because you asked for it. If you would rather not be counted at all, blocking googletagmanager.com or using any ad blocker removes both, and everything works exactly the same without them.

When you arrive from an advertisement, the link carries a click identifier in the address. If you go on to create an account, that identifier is written to your account row so we can see which advertisement paid for itself. It is not a profile and it is not shared: it lives in our own database, it is never sent back to an advertising network, and it is deleted together with the account.

Searching other people

If you upload a photograph of someone else, you are processing their personal data and you are responsible for having a lawful basis to do so. Trace exists to verify who you are dealing with and to let you find your own images; it must not be used to identify, locate, monitor or harass anyone. See the Terms of Use.

If you believe someone has searched your face through Trace and you want to exercise your rights, the fastest route is the removal page: it takes your face out of our index and keeps it out, without an account and without an email to us. What it cannot tell you is who searched you, and neither can we — a search is stored against the account that ran it, not against the face it was looking for, so we have no way to go from a photograph to a list of searches. For anything else, write to us through the support form.

Children

Trace is not for anyone under 18 and we do not knowingly hold data from a minor.

Changes

If this policy changes in a way that affects what happens to your photograph, we will ask for consent again rather than quietly updating the date at the top.