Overview
Trace is a code-reading game. This policy explains what information Trace uses to run the game, accounts, subscriptions, support, and player features.
Player identity and accounts
Trace can create a Guest player for an installation. Guest play uses a random player identifier and a device credential. The credential is kept in secure device storage where supported; Trace stores a one-way digest rather than the credential itself.
You can create or sign in to an account with Google or email and password through Supabase Auth. We use your account email and authentication session to provide account access and recovery. A new account can attach to the same Trace player as your Guest progress; signing in to an existing account selects that account and does not merge a different local Guest player.
Public player profile
Your username, display name, and avatar URL are public player-profile information. They may be shown to other players in future Ghost, Battle, leaderboard, or other multiplayer features. Your email, authentication identifiers, billing data, and device credentials are not public profile information.
Gameplay and progression data
Trace stores Practice and Ghost session records, puzzle references, submitted answers, timing, correctness, skips, session history, XP, levels, streak dates, and player statistics. We use this information to run sessions, save progress, replay eligible Ghost runs, calculate results, and show your history and stats.
Trace also keeps internal rating and difficulty-selection information to choose suitable Practice puzzles over time. This information is not a public player stat and is not used as a public ranking.
Operational information and diagnostics
Trace processes limited operational information such as platform, app/build version, timezone, and information needed to protect the service and investigate errors. Supabase processes app database and authentication data.
Trace uses Sentry for crash, error, and performance diagnostics. Trace scrubs credentials, authorization headers, submitted answers, canonical answers, full generated code, and email from Sentry events before they are sent. We do not intentionally send passwords, device secrets, or authentication tokens to Sentry.
Trace Plus and purchases
Trace offers Trace Plus. Google Play processes purchases, subscriptions, and payment-card details under its own terms and privacy practices. Trace does not receive your payment-card credentials.
RevenueCat processes subscription and purchase state needed to verify Trace Plus entitlements. Trace uses that verified state to provide subscription features. Purchase offers, prices, renewals, and cancellation controls are shown by Google Play at the time of purchase.
Support and deletion requests
When you use a Trace support or account-deletion request form, the topic, email address, and message you provide are submitted through Formly.email for delivery to Trace support. Trace does not automatically attach your password, authentication tokens, device credentials, gameplay answers, hidden rating, or diagnostic payloads to those requests.
You can request deletion of a Trace account and associated data through the dedicated Delete account flow. We may retain information where required or permitted for legitimate purposes, such as security, fraud prevention, resolving disputes, enforcing agreements, or legal obligations. Deleting an account or uninstalling Trace does not cancel an active Google Play subscription; manage or cancel subscriptions in Google Play.
Retention, security, and international processing
We retain account, gameplay, and support information for as long as needed to operate Trace, preserve your account and game records, meet the purposes described here, and comply with applicable obligations. Guest progress is tied to the installation; uninstalling an app may remove it, although secure storage can persist in some platform circumstances.
Trace uses reasonable technical and organizational safeguards, including credential hashing and restricted server-side access. No method of transmission or storage is completely secure.
Supabase, Sentry, RevenueCat, Formly.email, and Google Play may process information on Trace's behalf or under their own services in countries outside yours. Their processing is governed by their applicable terms and privacy practices.
Changes and contact
We may update this policy as Trace changes. Material updates will appear in the app and on the canonical online policy with a revised date. Use Contact Trace for privacy questions or the dedicated Delete account flow for deletion requests.