Privacy Policy

Last updated: 2026-09-04

This is the privacy policy for Sauvrn AI Corporation, the maker of the Retrace browser extension. Sauvrn AI Corporation is federally incorporated in Canada and operates from Toronto, Ontario.

We've tried to write this in plain English. If anything is unclear, email privacy@sauvrn.ai and we'll fix it.

A note on wording: where this policy says captured, the product says remembered — the same act, named precisely here and plainly there.

TL;DR

Retrace runs entirely on your device. We do not receive your browsing data, your search queries, your captured pages, your embeddings, your model invocations, your workspace/Space data, or any derivative of those things. Network activity to us is limited to license verification (every 6 hours), sign-in, a read of your own profile photo when your sign-in has one, a one-time download of the Retrace installer by the extension and a one-time AI-model download by the desktop app (both from our own servers), one row per day of content-free usage counts during the alpha (described below) plus a one-time note to us of that setting itself, which is one boolean and no events, and — only if you send it — feedback. There is one more request, and it does not come to us: on a Google Docs, Sheets, or Slides tab, Retrace fetches that document's own export from Google, using the session your tab is already signed in with, because Google draws those documents to a canvas where the text can't otherwise be read. The text comes back to your device and is never sent to Sauvrn. The browser extension downloads no models. See Retrace's privacy commitment for the technical detail, and Every network call Retrace makes for each call in one row.
Account data (your email address, name, and license/subscription state) does live on our servers because that's how accounts work. We store it on Google Cloud in Canada and the US. We do not sell it, share it for ads, or use it for analytics profiling.
Support messages you send us (via the in-extension feedback form, or by emailing support) reach our support inbox, get filed in our issue tracker (Linear) and posted to our internal team channel (Slack) so we can reply to you — and the feedback form sends you an acknowledgment you can reply to. We scrub tokens before they land. We do not feed support content to any AI training pipeline.
You can export or delete your account data yourself. Sign in to the web app and use Settings → Account: Export my data downloads a JSON copy of the account, workspace, license, survey-answer, usage-count and feedback data we hold; Delete account permanently removes your account and every workspace you own. One case is refused rather than actioned: if you own a workspace that still has other members, deletion is blocked and nothing is deleted until you remove them or transfer the workspace — so their access is never removed without warning. You can also email privacy@sauvrn.ai if you'd rather we did it.

What information we collect

We collect the minimum information needed to run an account-based product. Specifically:

Account information you give us

Email address. Required to create an account, sign in, and recover access.
Name (if you choose to provide one).
Authentication identifiers from your sign-in provider (Google), used to verify it's actually you on subsequent sign-ins. We store an opaque identifier; we do not store your Google password.
Profile photo (if your sign-in provider supplies one — Google does). We do not store it: when the app asks, our backend looks it up at WorkOS, reads it from Google's or WorkOS's photo host, and hands it back to you alone, keeping it in our server's memory for up to an hour.
Billing information (when you subscribe after your trial): handled by Stripe. We never see or store your full card number. Stripe stores it under their PCI compliance regime.

Survey answers you typed

Alpha participant survey. If you filled in the alpha participant survey, we keep the answers you typed — how much of your day is spent in a browser, how you keep track of pages you want to come back to, how often you go looking for something you know you have seen, and how comfortable you are with a tool reading your pages. They are stored in our database attached to your account, so we can read the daily usage row against what you told us. We use your email address once, to find the account that signed in with it, and do not store it beside the answers. These come from the form you chose to fill in, never from the extension.

Information generated by your use of our service

License state — whether your license is active, which plan it records, and when it expires. Every Retrace license is the same license, so that plan value is the same for everyone.
License verification timestamps — when each connected extension last verified its license. Used to detect anomalies (e.g., a single license appearing on many devices simultaneously).
Subscription events from Stripe (subscription created, changed, cancelled). Used to keep your license state in sync with what you've actually paid for.
Operational logs — basic request logs (timestamp, route, response code, anonymized IP). Used to diagnose outages and abuse. We do not log request bodies or query parameters that could contain personal content. Retained for 30 days, then deleted.

Information your browser extension generates but never sends to us

This is the load-bearing part. Retrace is designed so the following information never leaves your device: the pages you visit, the contents of those pages, the embeddings Retrace computes from them, the questions you Ask, the answers Retrace generates, the Ask conversations you have, your reading timeline, your Find history, the URLs of tabs you have open, your Space organization, your Tool configuration, your Space tab groupings, and your display preferences. Retrace also keeps, on your device only, the comments on the pages it captured — including who wrote them and who they mention (names, Google user ids, and email addresses read from the page). They are encrypted like everything else and are never sent to Sauvrn.

There is exactly one exception, and it takes a deliberate click from you: the in-extension feedback form offers four optional diagnostics, each with its own checkbox — your extension version and build, your browser and OS, the current site's host name only, never the full address, and the Retrace desktop app's own recent log lines (the last 200 lines or 32 KB, whichever comes first — timestamps, levels, module names, counts, operation kinds and error kinds, never page content, titles, queries or answers, with anything shaped like an address, a file path, an email address or a token replaced by a withheld marker inside the app before a line can be uploaded). All four are unchecked by default, you see the exact payload before you send — the log lines included, line for line — and nothing is attached unless you tick its box. You can also attach screengrabs — up to three, PNG, JPG or WebP, dragged onto the form, pasted, or picked with Add screenshot…. Each one is shrunk to at most 400 KB before it can be sent, is never written to your device, and leaves the open form the moment the report is sent or the sheet closes. Screengrabs you intentionally share will be stored in our ticketing system. Nothing is attached unless you add it, every image appears as a thumbnail and is named in the same pre-send preview, and a screengrab carries whatever happens to be on it, so read the picture before you send it.

If you find any of the above being transmitted from the extension to a network destination, that is a bug. Please report it to security@sauvrn.ai — we will treat it as a P0 incident.

The technical guarantees behind this commitment are documented in detail at Retrace's privacy commitment.

What we do with the information we collect

Strict need-to-know basis:

Run your account. Authenticate you, enforce your subscription state, route license checks from the extensions, and send the account emails we actually send (a welcome email on first sign-up, workspace invitations, and license-revocation notices). Billing receipts are sent by Stripe.
Respond to your support requests. Read what you wrote to us, reply, follow up.
Keep the service running. Diagnose outages, investigate abuse (e.g., a leaked license being used by 50 people).
Comply with the law. If we receive a valid legal request for data, we respond — but the technical architecture means we have nothing about your browsing to hand over.

First-party usage counts (on during the alpha). While Retrace is in its alpha, the extension sends us one row per day of content-free usage counts — how many times you opened the Retrace window, Threads and People, searched, asked, and reopened pages, how many pages were captured, and how long searches and Asks took as a coarse band — never page content, titles, URLs, queries, or answers. The row is rolled up on your device; sealed daily summaries and setup steps are synced periodically in the background with your license token, so they are tied to your account; Settings → Account lists exactly what it carries, and our server refuses any row that does not match that fixed shape. Rows are kept for 90 days. It is first-party only — we still run no third-party analytics or tracking pixels. After the alpha the switch returns and the counts go back to off by default.

What the daily usage row contains

One row per account per local calendar day. These are all of its fields:

The day — a calendar date (YYYY-MM-DD), never a time of day.
Whether you used Retrace at all that day — a yes or no.
Counts, each a whole number — how many times you opened the Retrace window or the Space manager, how many threads you opened in Threads and how many of those from Waiting on you, how many times you viewed People, how many pages you opened from an Ask receipt or from Threads, searches run, searches narrowed by time, searches narrowed by tool, searches that ended in you opening a page, pages reopened, reopens that landed where they were meant to, Asks asked, Asks answered, Asks declined, pages captured, how many different supported tools those pages came from (the count — which tools stays on your device), spaces used (a count — the names and ids of your spaces stay on your device), spaces created, and those actions added into one total.
Timing as coarse bands, never milliseconds — how long searches and Asks took, as a histogram over a closed list of bands (0-100, 100-500, 500-1000, 1000-5000, 5000+ milliseconds). The real timing is turned into a band on your device; no millisecond is transmitted.
Failures by kind only — errors counted by class (network, storage, validation, runtime, permission, unknown) and failed round trips counted by which one failed (find, ask, reanchor, capture, other). Never an error message, never a stack.
Top work apps by share of captured pages that day (supported tool catalog only, at least 3 captures, top 5, rounded to 5%; no URLs, no sites outside the catalog, no time spent) — for example {"gdocs": 45, "slack": 30, "claude": 15, "github": 10}, and empty on a day no tool reaches 3 captures.
How much you have remembered, as a range — one of 0-100, 100-1k, 1k-10k, 10k+.
Your browser's own tab counts, four whole numbers — how many tabs were open when Retrace first woke that day, the fewest and the most tabs open at once, and the most windows open at once. Never which tabs, their addresses or titles, or anything in them; a count the day never measured is left out rather than sent as zero.

Older versions of the extension also sent tool clicks (in total and per tool) and a retired tab-switch count; the current one does not.

Two smaller shapes travel on the same channel. Once per install: which setup step you reached (installed, signed-in, app, paired, first-capture, first-click, first-find, first-landed), and which onboarding screen showed and which of its controls you pressed (consent-shown, consent-accept-history or consent-accept-no-history, consent-not-now, key-shown, key-pressed, key-click-here, key-skipped, pin-clicked, find-shown-chip, find-shown-typed or find-shown-none, find-open, onboarding-complete) — names only, never what you typed or opened — each with a coarse elapsed bucket (0-1m through 7d+). And if a part of Retrace crashes: which component and what it was doing (for example startup, capture, ask) — both from closed lists, never the error text. Two components report today: core-daemon, the Mac app's engine, when it stops answering a paired browser, and offscreen, the extension's hidden page that keeps your memory, when it goes silent and is replaced.

The account identifiers are stamped by our server, not sent by your browser. The request carries your license token; our backend resolves it and records your user id, license id, and extension id on the row. So the counts are content-free but the row is not anonymous — it is tied to your account. No shape has a free-text field, and our server rejects any row that does not match the fixed shape above. Rows are kept for 90 days and then deleted, or deleted with your account, whichever comes first.

We use the data we collect only to provide and improve the Service and to fulfill the purposes described in this policy. We do not sell your data, do not use it for advertising, do not transfer it to data brokers, and do not use it to train AI models. Our use of data obtained through your Google account (for Google Docs, Sheets, and Slides content capture) complies with the Google API Services User Data Policy, including its Limited Use requirements; that content is fetched directly to your device and is never sent to Sauvrn servers.

We do not:

Sell your personal information to anyone, ever.
Share your personal information with advertising networks.
Use your information to train AI models. (We don't have your browsing data in the first place, and even your support messages stay out of training.)
Build behavioral profiles of you for marketing.
Run third-party analytics or tracking pixels on our marketing site, app, or extensions.

The third parties who process your data on our behalf:

Service	What they handle	Why	Where
Google Cloud (GCP)	Hosts our backend and database	Backend infrastructure	`us-central1` (Iowa, USA)
WorkOS	Sign-in (OIDC) provider	Authentication	USA
Stripe	Subscription and payment processing; Stripe sends billing receipts	Billing	USA + Ireland
Resend	Sends our transactional emails (welcome on first sign-up, workspace invitations, license-revocation notices, and the acknowledgment for feedback you send)	Email delivery	USA
Linear	Issue tracking for feedback you send	Support inbox	USA
Slack	Internal team channel that feedback you send is posted to	Support inbox	USA
BetterStack	Status page and uptime monitoring	Operational	USA
Cloudflare	DNS for `sauvrn.ai` and subdomains	DNS	Global

Each time we send you a transactional email, our backend also writes one structured log line to Google Cloud Logging in our own Google Cloud project — a salted SHA-256 tag of your address (16 hex characters, never the address itself, which goes only to Resend), the subject, and the message id Resend returned, plus the error text if the send failed — where it sits in our retention-bound log buckets and carries nothing about what you've read, searched, or asked.

The AI models the Retrace desktop app downloads at setup are served from our own CDN (models.sauvrn.ai, hosted on the same Google Cloud infrastructure listed above) — no third party is involved in model distribution, and the download carries no account identifier. To offer you updates, the desktop app checks for a new version about every six hours while its window is open, and when it starts: its background service reads a small public manifest (the published build's version, size and SHA-256) from our download bucket on storage.googleapis.com — one GET with no body, no query string and no account identifier — and an update you choose to install is downloaded from sauvrn.ai or that bucket and checked against the published SHA-256 before anything is installed. When you capture a Google Doc, Sheet, or Slides document, the extension makes one credentialed request to Google reusing your existing Google session; that content goes to your device, never to us.

Each provider has its own privacy policy. We pick providers who themselves don't sell data and who let us delete records on request.

We do not share your information with anyone else outside this list, except: - If you explicitly tell us to (e.g., "please share my support thread with my teammate"). - If we're legally required to (e.g., a valid court order). - In the event of a business transfer (acquisition, etc.), in which case we'll notify you in advance and you'll have the option to delete your data first.

International transfers

Sauvrn operates from Canada, but our infrastructure is primarily in the United States (Google Cloud us-central1). If you sign up from outside the United States, your account information will be transferred to and processed in the US.

For users in the European Economic Area (EEA), UK, or Switzerland: this transfer occurs under Standard Contractual Clauses with our processors. If you'd like a copy of the SCC documents, email privacy@sauvrn.ai.

For users in California: the disclosures required by CCPA are throughout this policy. You also have the rights listed in Your rights and choices below.

For users in Canada: this policy is consistent with PIPEDA, Ontario's PIPA, and Quebec's Law 25. We are happy to provide additional disclosure on request.

Your rights and choices

You can, at any time:

Access the personal information we hold on you. Email privacy@sauvrn.ai and we'll provide a copy of the personal data we hold, compiled manually on request.
Correct inaccurate information by editing your account profile, or by emailing us.
Delete your account and all associated data. Self-serve deletion has shipped: sign in to the web app and use Settings → Account → Delete account. If you own a workspace that still has other members, deletion is refused and nothing is deleted until you remove them or transfer the workspace. Deletion also instructs our payment processor (Stripe) to delete your customer record; payment processors retain the transaction records the law requires them to keep. You can also email privacy@sauvrn.ai to request deletion; we action those manually and aim to complete them within 30 days, and deleted data falls out of backups within a further 30 days.
Object to specific processing if you have legal grounds (e.g., under GDPR Article 21). Email us with the specifics and we'll respond.
Port your data. Self-serve export has shipped: sign in to the web app and use Settings → Account → Export my data to download the personal data we hold about you (account email, name, workspace, license/subscription state, any alpha survey answers you typed, the usage-count rows we still hold for you, and the feedback you sent) as JSON. You can also ask us for it by email. Note: your captured Retrace memory lives only on your device; export of that is done locally, not by us.
Withdraw consent you've previously given. Note that this may make some features unusable.

You do not need to give us a reason. "I want to" is sufficient.

For users in jurisdictions with regulated data-protection authorities, you also have the right to lodge a complaint with that authority. For Canadian users: the Office of the Privacy Commissioner of Canada at priv.gc.ca. For Ontario users: the Information and Privacy Commissioner of Ontario at ipc.on.ca.

Children

Sauvrn is not directed at children under 13 (under 16 in the EEA/UK). We do not knowingly collect information from children. If you believe a child has signed up, email privacy@sauvrn.ai and we will delete the account.

Security

We follow standard industry practice for security:

Encrypted data in transit (TLS 1.2+) on all endpoints, enforced by HSTS.
Encrypted data at rest in our database and bucket storage.
Secret material (API keys, signing keys) stored in Google Cloud Secret Manager with strict IAM scoping.
Least-privilege access — the founder is the only human with production write access at this stage.
A documented audit logging trail for every administrative action.

If you discover a vulnerability, please report it via security@sauvrn.ai. We don't yet have a formal bug-bounty program but we will publicly credit researchers who report responsibly.

Data retention

Active account data: retained while your account is active.
Deleted account data: deleted from our systems when we process your deletion request, and out of backups within 30 days after that. We also instruct our payment processor (Stripe) to delete your customer record; payment processors retain the transaction records the law requires them to keep.
Support tickets: retained for 2 years after the ticket is resolved, then deleted, unless you ask us to delete sooner.
Operational logs: 30 days, then deleted.
Survey answers: kept while your account is active, and deleted with the account.
Feedback you send from Retrace: the message, the details you ticked and any screengrabs are kept in our database for 90 days, or until you delete your account if that comes first. The copies filed in Linear and posted to Slack are not deleted with them.
Billing records: retained for 7 years as required by Canadian and US tax law.
On your device: your captured memory is kept for the retention window you choose in Retrace's settings, and we never hold a copy of it. One boundary is worth stating plainly: Retrace also remembers how you read a captured page — what you select or copy, how far you scroll — and keeps that as long as it keeps any version of that page. So on a page you revisited, what you did before your chosen window survives with the newer copy. See Retrace's privacy commitment.

Changes to this policy

If we make material changes to this policy, we'll email you (using the address on your account) at least 14 days before the changes take effect. The current version is always at https://docs.sauvrn.ai/privacy; the date at the top reflects the last revision.

Contact

Privacy questions, requests, and complaints: privacy@sauvrn.ai
Security issues: security@sauvrn.ai
General support: support@sauvrn.ai
Mailing address: Available on request to privacy@sauvrn.ai.

The person responsible for privacy at Sauvrn AI Corporation is Cameron Langs, founder.