Privacy Policy

Tracer is operated by 11beats Grzegorz Dłubacz, Ks. Jana Twardowskiego 22/2, 81-198 Pogórze, Poland, NIP 9462378074 ("we", "us").

We are the controller of your personal data within the meaning of the GDPR. For anything in this policy, write to gdlubacz@gmail.com.

• —We do not sell your data.
• —Most images never leave your browser. Some do, and we say exactly which below.
• —We keep the minimum needed to run an account and take a payment.
• —You can delete your account and your data at any time.

When you create an account

Your email address, a hashed password and sign-in timestamps, held by our authentication provider. We never see your password. Alongside that we store a display name and the date your profile was created.

When you buy a plan

Your plan tier, its status, the current billing period end and identifiers from our payment provider. Your email address is passed to Stripe at checkout.

We do not receive or store your card number. Payments are handled entirely by Stripe, which acts as an independent controller for payment data.

When you trace an image

What happens depends on the preset:

• —Monochrome presets (Logo / Line art, Sketch, Tattoo / Stencil) run entirely in your browser. The image is never uploaded.
• —Colour presets (Auto on a colour image, Clean / Flat, Detailed) send the image to our tracing service. It is processed in memory and discarded. Nothing is written to disk and no copy is kept.
• —DXF, EPS and PDF export is generated on our server from the vector result, not from your original image. That too happens in memory, with nothing stored.

Your recent images are stored in your own browser, in IndexedDB. They never reach us and clearing your browser data removes them.

To put it plainly: we do not store your images or your vectors anywhere.

Technical data

Our hosting providers keep standard request logs, which generally include your IP address, browser and device type, pages requested and timestamps. Our authentication provider records IP addresses in its sign-in logs. Our rate limiter holds your IP address for a few minutes to count requests, after which it expires.

Our error monitoring is configured not to collect personally identifying information: no user identifiers, no email addresses and no IP addresses. It receives the error itself, the page it happened on, and the browser and operating system.

Cookies and browser storage

We currently use only cookies necessary for the service to work: keeping you signed in. These do not require consent. If we add analytics, we will use a tool that does not store anything on your device, and will update this policy. Your browser also keeps a small flag if you dismiss the language suggestion bar, so it does not come back. It holds no identifier and never reaches us.

We use the following providers. Each processes data on our behalf, under a data processing agreement:

Some of these are based outside the European Economic Area. Where that is the case, transfers are covered by the European Commission's Standard Contractual Clauses.

We do not sell your data and we do not share it for advertising.

• —Account data: until you delete your account.
• —Invoicing records: five years from the end of the tax year, as required by Polish law.
• —Error reports and logs: up to 90 days.
• —Images sent for colour tracing: not kept at all. They are processed in memory and discarded as soon as the vector is returned.
• —Rate-limiting records: a few minutes.
• —Your recent images: in your browser only, until you clear them.

Under the GDPR you may:

• —ask what we hold about you and get a copy
• —correct anything inaccurate
• —have your data deleted
• —restrict or object to processing
• —receive your data in a portable format
• —withdraw consent, where processing is based on consent

Write to gdlubacz@gmail.com and we will respond within one month.

You can also complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

Tracer is not intended for people under 16. We do not knowingly collect data from children.

If we change this policy we will update the date at the top. If the change is significant, we will tell account holders by email before it takes effect.