Retrace's privacy commitment
Retrace never phones home with your data.
This is the load-bearing claim that distinguishes Retrace from every other "AI for your browser." It is not marketing. It is a constraint we hold ourselves to in the code:
- The Retrace extension does not send your captured pages to any server we run.
- The Retrace extension does not send your queries to any server we run.
- The Retrace extension does not send your embeddings or any derived representation of your content to any server we run.
- The Retrace extension and desktop app do not send your model invocations — your Ask questions or answers — to any server we run.
- The Retrace extension does not send the comments on the pages it captured, nor who wrote them or who they mention — names, Google user ids and email addresses read from the page — to any server we run. They are kept on your device, encrypted with the rest of your memory.
What does cross the network:
- Authentication — when you sign in, the web app talks to our auth provider (WorkOS). When you sign in from inside the extension, the extension opens a sign-in window against that same provider (
api.workos.com) and then exchanges a one-time sign-in code with our backend (api.sauvrn.ai) to activate your license. No browsing data is involved in either. If your sign-in gives your account a photo — a Google sign-in does — the extension can ask our backend for it with your license token: the backend looks the photo up at WorkOS, reads it from Google's photo host (lh3.googleusercontent.comand its siblings) or from WorkOS's (workoscdn.com), and hands it back to you alone. It stays in our server's memory for up to an hour and is never written to our database. - License verification — every six hours, the extension calls our backend to confirm your license is still active. The request contains your license token. It does not contain anything about what you've read or asked.
- Installer download (extension, one time) — during setup, the extension downloads the Retrace desktop-app installer once, over HTTPS, from the address we publish (
sauvrn.ai/download/Retrace.dmg). That address redirects to the storage bucket we keep the file in, so the host your browser actually pulls the bytes from isstorage.googleapis.com— a reviewer watching the Network tab will see that hop. This is the only file the extension itself fetches from us; it carries nothing about what you've read or asked, and the extension looks up only the installer it started, never your download history. - Model download (desktop app, one time) — when you set up the Retrace desktop app, it downloads the three AI models Retrace runs locally — the answering model, the search embedding model, and the answer-verification model — from our own CDN (
models.sauvrn.ai), over HTTPS only. Every file is verified against a SHA-256 hash compiled into the app itself; a file that doesn't match is rejected and the download fails closed. The request carries no account identifier and nothing about what you've read or asked. After this one-time download, the models run entirely on your machine. Separately, to offer you updates, the desktop app checks for a new version about every six hours while its window is open, and when it starts: its background service reads a small public manifest (version, size and SHA-256 of the published build) from our download bucket onstorage.googleapis.com— oneGETwith no body, no query string and no account identifier; an update installs only when you press the button, after its bytes match the published SHA-256. The browser extension downloads no models at all and runs none — the desktop app's local core does all the embedding and indexing of your captured pages, on your device. - Google Docs, Sheets, and Slides content capture — Google renders these documents onto a canvas, so the text is not in the page DOM where Retrace can read it. To capture it, the content script makes a single credentialed
GETto Google (docs.google.comexport endpoints), reusing your existing Google session, the same way File → Download does. The request goes to Google, not to us, and only fetches a document you are already signed in to and viewing. The returned text goes straight into your local on-device memory; it is never sent to Sauvrn servers. (A reviewer with DevTools open on one of these tabs will see this request.) - Opt-in feedback — if you click "Send feedback" inside the extension and type a message, that message is sent to us, filed in our issue tracker (Linear) and posted to our internal team channel (Slack), and we email you back an acknowledgment you can reply to. We sanitize it before it lands in our system to scrub tokens you may have pasted accidentally. The form also offers four optional diagnostics, each with its own checkbox: your extension version and build, your browser and OS, the current site's host name — the host only, never the full address — and the Retrace desktop app's own recent log lines, the last 200 of them or 32 KB, whichever comes first: timestamps, levels, module names, counts, operation kinds and error kinds — never page content, titles, queries or answers, and anything shaped like an address, a file path, an email address or a token is replaced with a withheld marker inside the app before a line can be uploaded. All four are unchecked by default, you see the exact payload before you send — the log lines included, line for line — and nothing is attached unless you tick its box. You can also attach screengrabs — up to three, PNG, JPG or WebP, dragged onto the form, pasted, or picked with Add screenshot…. Each one is shrunk to at most 400 KB before it can be sent, is never written to your device, and leaves the open form the moment the report is sent or the sheet closes. Screengrabs you intentionally share will be stored in our ticketing system. Nothing is attached unless you add it, every image appears as a thumbnail and is named in the same pre-send preview, and a screengrab carries whatever happens to be on it, so read the picture before you send it. The host name and log lines you attach stay in our own database: neither reaches Linear or Slack. We delete our copy of what you send after 90 days, or sooner if you delete your account; the copies filed in Linear and posted to Slack are not deleted with it. The in-product feedback form tells you this before you submit.
- Usage counts — on during the alpha — while Retrace is in its alpha, the extension sends
api.sauvrn.aione row per day of content-free counts: how many times you opened the Retrace window or the Space manager, how many threads you opened in Threads and how many of those from Waiting on you, how many times you viewed People, how many pages you opened from an Ask receipt or from Threads, how many times you searched (and whether you narrowed by time or by tool, as a yes or no), asked, and reopened pages, how many pages were captured and from how many different supported tools, top work apps by share of captured pages that day (supported tool catalog only, at least 3 captures, top 5, rounded to 5%; no URLs, no sites outside the catalog, no time spent), how many spaces you used or created, how long searches and Asks took as a coarse band, and four whole numbers from the browser itself — how many tabs were open when Retrace first woke that day, the fewest and the most tabs open at once, and the most windows open at once, never which tabs or what was in them — never page content, titles, URLs, queries, or answers. Beside the row: the setup steps you reached, once each, and, if a part of Retrace crashes, which part — the Mac app's engine (core-daemon) or the extension's hidden offscreen page — and what it was doing. The counts are added up on your device; sealed daily summaries and setup steps are synced periodically in the background with your license token, so they are tied to your account rather than anonymous. Older versions also sent tool clicks and a tab-switch count; the current one does not. Settings → Account lists exactly what it carries, our server refuses any row that does not match that fixed shape, and rows are kept 90 days and then deleted. Once, when that setting changes, the extension also sends a one-time note to us of that setting itself — one boolean and no events. After the alpha the switch returns and the counts go back to off by default. - Email delivery logs (on our servers, not from your device) — each time we send you one of those transactional emails, our backend writes one structured log line to Google Cloud Logging in our own Google Cloud project: a salted SHA-256 tag of your address (16 hex characters, never the address itself, which goes only to Resend), the subject, and the message id Resend returned, plus the error text if the send failed — where it sits in our retention-bound log buckets and carries nothing about what you've read, searched, or asked.
That's the entire list, and Every network call Retrace makes gives each call in one row with the code that sends it. The hosts a reviewer watching the Network tab will see are api.sauvrn.ai, api.workos.com, sauvrn.ai — which redirects the installer download to storage.googleapis.com, the bucket the file is kept in — models.sauvrn.ai and the update manifest on storage.googleapis.com from the desktop app, and docs.google.com on a Docs, Sheets or Slides tab. If you ever see network activity from Retrace that does not match the list above, that's a bug — please report it via the in-extension feedback form, or email support@sauvrn.ai.
How long it's kept. Retrace also remembers how you read a captured page — what you select or copy, how far you scroll — and keeps that as long as it keeps any version of the page, so on a page you revisited, what you did before your chosen retention window survives with the newer copy.
Third-party processors
When you take specific actions inside Sauvrn or its web app, narrowly-scoped data crosses to these processors. None of them receive your browsing data, captured pages, queries, or anything Retrace has indexed:
| Processor | Data sent | When (trigger) | How you're told |
|---|---|---|---|
| Stripe (US) | Billing email, organization name, internal sauvrn_org_id metadata — not from the extension, only from the web app at checkout |
At checkout or subscription change. Billing receipts are sent by Stripe. | Stripe's hosted checkout page links to Stripe's privacy policy. |
| Resend (US) | Recipient email address, first/last name, body of the transactional email | When we send a transactional email — a welcome email on first sign-up, workspace invitations, and license-revocation notices | Implicit in the account email setting. Resend's privacy policy. |
| Linear (US) | Your account email, the feedback body, sanitized diagnostic JSON (no tokens, no page contents) — and if you attached the app log lines, the ticket carries only their count, never the lines themselves, which stay in our own database and are read only on our internal admin feedback page. Screengrabs you intentionally share will be stored in our ticketing system. | When you submit the in-extension "Send feedback" form | The feedback form copy states the message is shared with our team via our issue tracker. Linear's privacy policy. |
| Slack (US) | Your account name and email, the feedback body, and the build metadata you attached — one message to our internal team channel. No diagnostic JSON blob, never the app log lines, and never the screengrabs. | Same trigger as the Linear row | Same in-product disclosure as Linear. Slack's privacy policy. |
The full list of processors (cloud host, auth provider, uptime monitor, DNS) is documented in the Sauvrn privacy policy.
Limited use
We use the data we collect only to provide and improve the Service and to fulfill the purposes described in this policy. We do not sell your data, do not use it for advertising, do not transfer it to data brokers, and do not use it to train AI models. Our use of data obtained through your Google account (for Google Docs, Sheets, and Slides content capture) complies with the Google API Services User Data Policy, including its Limited Use requirements; that content is fetched directly to your device and is never sent to Sauvrn servers.
Why this matters
Sending browsing data to a server "for AI" is a one-way trip. Once it lands somewhere we host, it sits in logs, backups, and shared dashboards forever. Even with the best intentions, that data can leak. Retrace is built so the leak surface does not exist.
It also means we can never read your data ourselves, even if we wanted to. We made that trade on purpose.
Open questions we're still working on
- Cross-device sync. Today, Retrace's memory is per-device. Syncing is technically hard to do without breaking the never-phone-home commitment. We're working on it.
- Workspace sharing. Sharing a specific page or answer with a colleague is not something Retrace does today. If it ships, that sharing will be opt-in, page-by-page and explicit — not bulk telemetry.