Retrace's privacy commitment
Retrace never phones home with your data.
This is the load-bearing claim that distinguishes Retrace from every other "AI for your browser." It is not marketing. It is a constraint we hold ourselves to in the code:
- The Retrace extension does not send your captured pages to any server we run.
- The Retrace extension does not send your queries to any server we run.
- The Retrace extension does not send your embeddings or any derived representation of your content to any server we run.
- The Retrace extension and desktop app do not send your model invocations — your Ask questions or answers — to any server we run.
- The Retrace extension does not send the comments on the pages it captured, nor who wrote them or who they mention — names, Google user ids and email addresses read from the page — to any server we run. They are kept on your device, encrypted with the rest of your memory.
What does cross the network:
- Authentication — when you sign in, the web app talks to our auth provider (WorkOS). When you sign in from inside the extension, the extension opens a sign-in window against that same provider (
api.workos.com) and then exchanges a one-time sign-in code with our backend (api.sauvrn.ai) to activate your license. No browsing data is involved in either. - License verification — every six hours, the extension calls our backend to confirm your license is still active. The request contains your license token. It does not contain anything about what you've read or asked.
- Installer download (extension, one time) — during setup, the extension downloads the Retrace desktop-app installer once from our own site (
sauvrn.ai), over HTTPS. This is the only file the extension itself fetches from us; it carries nothing about what you've read or asked, and the extension looks up only the installer it started, never your download history. - Model download (desktop app, one time) — when you set up the Retrace desktop app, it downloads the three AI models Retrace runs locally — the answering model, the search embedding model, and the answer-verification model — from our own CDN (
models.sauvrn.ai), over HTTPS only. Every file is verified against a SHA-256 hash compiled into the app itself; a file that doesn't match is rejected and the download fails closed. The request carries no account identifier and nothing about what you've read or asked. After this one-time download, the models run entirely on your machine. The browser extension downloads no models at all and runs none — the desktop app's local core does all the embedding and indexing of your captured pages, on your device. - Google Docs, Sheets, and Slides content capture — Google renders these documents onto a canvas, so the text is not in the page DOM where Retrace can read it. To capture it, the content script makes a single credentialed
GETto Google (docs.google.comexport endpoints), reusing your existing Google session, the same way File → Download does. The request goes to Google, not to us, and only fetches a document you are already signed in to and viewing. The returned text goes straight into your local on-device memory; it is never sent to Sauvrn servers. (A reviewer with DevTools open on one of these tabs will see this request.) - Opt-in feedback — if you click "Send feedback" inside the extension and type a message, that message is sent to us, filed in our issue tracker (Linear) and posted to our internal team channel (Slack), and we email you back an acknowledgment you can reply to. We sanitize it before it lands in our system to scrub tokens you may have pasted accidentally. The form also offers three optional diagnostics, each with its own checkbox: your extension version and build, your browser and OS, and the current site's host name — the host only, never the full address. All three are unchecked by default, you see the exact payload before you send, and nothing is attached unless you tick its box. The in-product feedback form tells you this before you submit.
- Opt-in telemetry — off by default — if (and only if) you explicitly opt in, the extension sends content-free usage events (feature counters and timings — never page content, titles, URLs, queries, or answers) to
api.sauvrn.ai. Consent is checked on your device before any request is constructed, and re-checked on our server. If you never opt in, nothing is ever sent.
That's the entire list. If you ever see network activity from Retrace that does not match the list above, that's a bug — please report it via the in-extension feedback form, or email support@sauvrn.ai.
How long it's kept. Retrace also remembers how you read a captured page — what you select or copy, how far you scroll — and keeps that as long as it keeps any version of the page, so on a page you revisited, what you did before your chosen retention window survives with the newer copy.
Third-party processors
When you take specific actions inside Sauvrn or its web app, narrowly-scoped data crosses to these processors. None of them receive your browsing data, captured pages, queries, or anything Retrace has indexed:
| Processor | Data sent | When (trigger) | How you're told |
|---|---|---|---|
| Stripe (US) | Billing email, organization name, internal sauvrn_org_id metadata — not from the extension, only from the web app at checkout |
At checkout or subscription change. Billing receipts are sent by Stripe. | Stripe's hosted checkout page links to Stripe's privacy policy. |
| Resend (US) | Recipient email address, first/last name, body of the transactional email | When we send a transactional email — a welcome email on first sign-up, workspace invitations, and license-revocation notices | Implicit in the account email setting. Resend's privacy policy. |
| Linear (US) | Your account email, the feedback body, sanitized diagnostic JSON (no tokens, no page contents) | When you submit the in-extension "Send feedback" form | The feedback form copy states the message is shared with our team via our issue tracker. Linear's privacy policy. |
| Slack (US) | Your account name and email, the feedback body, and the build metadata you attached — one message to our internal team channel. No diagnostic JSON blob. | Same trigger as the Linear row | Same in-product disclosure as Linear. Slack's privacy policy. |
The full list of processors (cloud host, auth provider, uptime monitor, DNS) is documented in the Sauvrn privacy policy.
Limited use
We use the data we collect only to provide and improve the Service and to fulfill the purposes described in this policy. We do not sell your data, do not use it for advertising, do not transfer it to data brokers, and do not use it to train AI models. Our use of data obtained through your Google account (for Google Docs, Sheets, and Slides content capture) complies with the Google API Services User Data Policy, including its Limited Use requirements; that content is fetched directly to your device and is never sent to Sauvrn servers.
Why this matters
Sending browsing data to a server "for AI" is a one-way trip. Once it lands somewhere we host, it sits in logs, backups, and shared dashboards forever. Even with the best intentions, that data can leak. Retrace is built so the leak surface does not exist.
It also means we can never read your data ourselves, even if we wanted to. We made that trade on purpose.
Open questions we're still working on
- Cross-device sync. Today, Retrace's memory is per-device. Syncing is technically hard to do without breaking the never-phone-home commitment. We're working on it.
- Workspace sharing. Sharing a specific page or answer with a colleague is not something Retrace does today. If it ships, that sharing will be opt-in, page-by-page and explicit — not bulk telemetry.