Every network call Retrace makes

Your memory stays on your Mac. The pages you read, what you search for, what you ask, the answers you get and the people in them are stored and processed on your Mac. Retrace never sends them to us or to anyone else on its own.

Retrace does still use the network for a few jobs: your licence, sign-in, daily usage counts, the on-device model, updates, and feedback you choose to send. This page lists every one of those calls, so you can check them with a network monitor such as Little Snitch.

Each row names its entry in our outbound-payload catalog (docs/privacy/outbound-payload-catalog.json in the Retrace source), the file that makes the call, and the check that holds it there. A test fails our build if the catalog gains an entry this page does not name, or if a file named here stops existing.

What Retrace sends, and when

"Content" means anything you read, searched for, asked or were told: a page address, a title, page text, a search, a question, an answer, or the name of a person in them. Your email is your account, not content.

Part	Goes to	When	What is sent	Content?	How to check
Extension: licence check	`api.sauvrn.ai`	When you sign in, then every 6 hours	Your licence token.	No	`license-verify`. The extension's build fails if network code appears outside seven named files (`apps/retrace-extension/scripts/check-network-primitives.mjs`); this one is `apps/retrace-extension/src/domain/license/verify-transport.ts`, and it sends your token to no host but `api.sauvrn.ai` (`apps/retrace-extension/src/domain/safety/network-policy.ts`).
Mac helper (nm-host): licence check	`api.sauvrn.ai`	Once each time you sign in	Your licence token.	No	`license-verify`. The Mac helpers' build fails if a network client appears outside two named files (`apps/core/scripts/check-native-egress.mjs`); this one is `apps/core/crates/core-lib/src/receipt_verify.rs`.
Extension: your account photo	`api.sauvrn.ai`	At most once a day	Your licence token. Our server reads the photo from your sign-in provider and returns it to you only.	No	`license-verify`. Same file as the licence check.
Extension: sign-in	`api.workos.com` (our sign-in provider), then Google if you pick Google, then `api.sauvrn.ai`	When you sign in	The email you typed, so the sign-in page can fill it in, then a one-time code.	No. The email is your account.	`workos-oidc`. The sign-in address is fixed in `apps/retrace-extension/src/surfaces/overlay/retrace-auth-driver.ts`; the code goes through the named file `apps/retrace-extension/src/domain/license/workos-exchange-transport.ts`.
Extension: usage counts	`api.sauvrn.ai`	One row about the previous day; each setup step once; a crash marker when a part crashes	Whole numbers: finds, asks, reopens, pages remembered, speed bands, error counts by type, clicks per app from our built-in list, tab and window counts. Which setup steps you finished, and which Retrace part crashed, never why. On for every install during the alpha, linked to your account, kept 90 days.	No	`telemetry-egress`. Your browser stages a row only if every value in it is a number, a yes/no, or a short lowercase token from a fixed list, with no space, dot, slash or @ (`apps/retrace-extension/src/domain/memory/telemetry/telemetry-egress-queue.ts`, pinned by `apps/retrace-extension/tests/telemetry-egress-flush.test.ts`). Our server refuses any row outside its fixed shape as well. Settings › Account › Telemetry shows every row your browser sent.
Mac helper (core-daemon): model download	`models.sauvrn.ai`	Once, when you set up Ask	Nothing but the model's fixed file name. The file is checked against a fingerprint built into the app.	No	`granite-model-download`. One of the two named files: `apps/core/crates/core-lib/src/model_download.rs`.
Mac helper (core-daemon): update check	`storage.googleapis.com` (our download bucket)	When you open Settings, and about every 6 hours while the Mac app is open	Nothing. It reads which version is published.	No	`desktop-app-update`. `apps/core/crates/core-lib/src/app_update.rs`, through the same named file as the model download.
Mac helper and extension: update and installer download	`sauvrn.ai`, which sends the request on to `storage.googleapis.com`	When you press Update, or download the app during setup	Nothing. The installer is checked against its fingerprint.	No	`desktop-app-update`, `desktop-installer-download`. The installer address is fixed in `apps/retrace-extension/src/surfaces/onboarding/onb-vault-download.ts`. No scanner reads a download's address; that file is the only one that starts this download.
Extension: feedback	`api.sauvrn.ai`	Only when you press Send in the feedback form	What you typed and the screenshots you added. If you tick them (all are unticked to start): the extension version, browser and OS, the host name of the site you are on, the app log, and the setup log. You see all of it before you send.	Yes, by your hand. The words and screenshots you choose to send. Nothing else: the app log withholds addresses, host names, file paths, keys and quoted text, and the setup log holds one-word steps.	`feedback-egress`. The named file `apps/retrace-extension/src/domain/feedback/feedback-transport.ts`; the fields the form may attach are pinned by `apps/retrace-extension/tests/feedback-diagnostic-catalog-parity.test.ts`; the app log is scrubbed in `apps/core/crates/core-lib/src/log_ring.rs`.
Extension: Google Docs, Sheets and Slides text	`docs.google.com`	When you have one open	That document's id, with your own Google session. Google draws the text on a canvas, so Retrace asks Google for the document's text export.	No. It goes to Google, who already has the document, and nothing is sent to us.	`google-workspace-export-capture`. Three of the extension's seven named files, each building the address from a checked document id only (`apps/retrace-extension/src/domain/memory/capture/google-export-fetch.ts`).
Extension: the web app asks whether it is connected	`app.sauvrn.ai`, the page open in your browser	When you open `app.sauvrn.ai`	The extension's version, and whether it is signed in.	No	Only `app.sauvrn.ai` may ask (`externally_connectable` in `apps/retrace-extension/manifest.json`); the reply is built in `apps/retrace-extension/src/surfaces/license-bootstrap.ts`.
Mac app (Retrace.app)	Nowhere	Never	Nothing. It reaches the helpers on your Mac only.	No	The Mac helpers' scan covers the app too: its Rust source and lock file may hold no network client, and its window's content policy may name no outside address (`apps/core/scripts/check-native-egress.mjs`, pinned by `scripts/tests/native-egress-scans-the-mac-app.test.mjs`).

Where feedback goes next

When you send feedback, our server files it in our issue tracker (Linear, linear and linear-asset-upload) with your account email and any screenshots, posts it to our team chat (Slack, slack-feedback-firehose) with your name and email, and emails you a copy (Resend, resend-emails). The app log and the site's host name stay on our own server: Linear gets only the log's line count, and Slack gets neither.

We delete our copy of a feedback report 90 days after you send it, or sooner if you delete your account. The copies filed in Linear and posted to Slack are not deleted with it. The form tells you where a report goes as you press Send.

Calls our server makes for you

Your photo. Our server reads your account photo from Google (profile-photo-google) or from our sign-in provider (profile-photo-workos) and keeps it in memory for up to an hour.
Payments. If you pay, the web app sends your billing email and name to Stripe (stripe-customers). The extension and the Mac app never talk to Stripe.
Email. Welcome, invitation, licence and feedback emails go out through Resend (resend-emails).

None of these carries an address, title, page text, search, question or answer.

Calls that go to other services, not to us

Google Docs, Sheets and Slides. In the table above: the request goes to Google, who already has the document.
Opening a page. When you open a result, or press Remember on pages from your Chrome history, your browser loads each page from its own site, as it would if you opened it yourself.
Chrome and macOS. Chrome checks the Chrome Web Store for extension updates. macOS checks the app's signature with Apple. If you use Chrome Sync with saved tab groups, Chrome syncs the names of your Spaces' tab groups. These follow your own Chrome and macOS settings.

What a web page can see

Find and Ask draw in their own frame, so the page you have open cannot hear the keys you type into them. On the rare page that runs itself in a strict browser sandbox, where Chrome will not give Retrace a frame of its own, Retrace opens on its own page instead, so that page cannot hear you either.

On your Mac

Retrace never stores a link whose address runs into something its password scrubber removed.
The log files in ~/Library/Logs/Retrace name an error by its kind, never by its text, so they hold no search, page or answer. They stay on your Mac. The app log you can attach to feedback withholds addresses, host names, file paths, keys and quoted text as well.

What Retrace never does

No advertising, analytics or crash-reporting services. Retrace includes no third-party tracking code.
No cloud AI. Search and Ask run on your Mac.
No copy of your memory on our servers. There is no sync and no backup to us.

How to check this yourself

Use a network monitor. Retrace's browser extension talks only to api.sauvrn.ai, api.workos.com (sign-in), sauvrn.ai and storage.googleapis.com (the installer), and Google Docs. The Mac app's background helpers talk only to api.sauvrn.ai, models.sauvrn.ai, storage.googleapis.com and sauvrn.ai. The Mac app's own window talks to nothing.
Read the code that enforces it. The extension's build fails if network code appears outside seven named files (apps/retrace-extension/scripts/check-network-primitives.mjs). The Mac helpers' build fails if a network client appears outside two named files, and the Mac app's if one appears anywhere in it (apps/core/scripts/check-native-egress.mjs). Both checks run on every change, in the required repo-health check.
What no check reads. A scanner sees network code, not every address a browser can be sent to: the sign-in page and the installer are fixed addresses in the files named above, and an image whose address is held in a variable is outside the extension's scan. Those rows are kept true by review.
See your own usage counts. Settings › Account › Telemetry lists every field and every row sent.