Skip to content

Privacy Policy

Last updated: 2026-08-07

This is the privacy policy for Sauvrn AI Corporation, the maker of the Retrace browser extension. Sauvrn AI Corporation is federally incorporated in Canada and operates from Toronto, Ontario.

We've tried to write this in plain English. If anything is unclear, email privacy@sauvrn.ai and we'll fix it.

A note on wording: where this policy says captured, the product says remembered — the same act, named precisely here and plainly there.

TL;DR

  • Retrace runs entirely on your device. We do not receive your browsing data, your search queries, your captured pages, your embeddings, your model invocations, your workspace/Space data, or any derivative of those things. Network activity to us is limited to license verification (every 6 hours), sign-in, a one-time download of the Retrace installer by the extension and a one-time AI-model download by the desktop app (both from our own servers), and — only if you explicitly trigger them — feedback and opt-in telemetry. There is one more request, and it does not come to us: on a Google Docs, Sheets, or Slides tab, Retrace fetches that document's own export from Google, using the session your tab is already signed in with, because Google draws those documents to a canvas where the text can't otherwise be read. The text comes back to your device and is never sent to Sauvrn. The browser extension downloads no models. See Retrace's privacy commitment for the technical detail.
  • Account data (your email address, name, and license/subscription state) does live on our servers because that's how accounts work. We store it on Google Cloud in Canada and the US. We do not sell it, share it for ads, or use it for analytics profiling.
  • Support messages you send us (via the in-extension feedback form, or by emailing support) reach our support inbox, get filed in our issue tracker (Linear) and posted to our internal team channel (Slack) so we can reply to you — and the feedback form sends you an acknowledgment you can reply to. We scrub tokens before they land. We do not feed support content to any AI training pipeline.
  • You can export or delete your account data yourself. Sign in to the web app and use Settings → Account: Export my data downloads a JSON copy of the account, workspace, and license data we hold; Delete account permanently removes your account and every workspace you own. One case is refused rather than actioned: if you own a workspace that still has other members, deletion is blocked and nothing is deleted until you remove them or transfer the workspace — so their access is never removed without warning. You can also email privacy@sauvrn.ai if you'd rather we did it.

What information we collect

We collect the minimum information needed to run an account-based product. Specifically:

Account information you give us

  • Email address. Required to create an account, sign in, and recover access.
  • Name (if you choose to provide one).
  • Authentication identifiers from your sign-in provider (Google), used to verify it's actually you on subsequent sign-ins. We store an opaque identifier; we do not store your Google password.
  • Billing information (when you subscribe after your trial): handled by Stripe. We never see or store your full card number. Stripe stores it under their PCI compliance regime.

Information generated by your use of our service

  • License state — whether your license is active, which plan it records, and when it expires. Every Retrace license is the same license, so that plan value is the same for everyone.
  • License verification timestamps — when each connected extension last verified its license. Used to detect anomalies (e.g., a single license appearing on many devices simultaneously).
  • Subscription events from Stripe (subscription created, changed, cancelled). Used to keep your license state in sync with what you've actually paid for.
  • Operational logs — basic request logs (timestamp, route, response code, anonymized IP). Used to diagnose outages and abuse. We do not log request bodies or query parameters that could contain personal content. Retained for 30 days, then deleted.

Information your browser extension generates but never sends to us

This is the load-bearing part. Retrace is designed so the following information never leaves your device: the pages you visit, the contents of those pages, the embeddings Retrace computes from them, the questions you Ask, the answers Retrace generates, the Ask conversations you have, your reading timeline, your Find history, the URLs of tabs you have open, your Space organization, your Tool configuration, your Space tab groupings, and your rail state preferences. Retrace also keeps, on your device only, the comments on the pages it captured — including who wrote them and who they mention (names, Google user ids, and email addresses read from the page). They are encrypted like everything else and are never sent to Sauvrn.

There is exactly one exception, and it takes a deliberate click from you: the in-extension feedback form offers three optional diagnostics, each with its own checkbox — your extension version and build, your browser and OS, and the current site's host name only, never the full address. All three are unchecked by default, you see the exact payload before you send, and nothing is attached unless you tick its box.

If you find any of the above being transmitted from the extension to a network destination, that is a bug. Please report it to security@sauvrn.ai — we will treat it as a P0 incident.

The technical guarantees behind this commitment are documented in detail at Retrace's privacy commitment.

What we do with the information we collect

Strict need-to-know basis:

  • Run your account. Authenticate you, enforce your subscription state, route license checks from the extensions, and send the account emails we actually send (a welcome email on first sign-up, workspace invitations, and license-revocation notices). Billing receipts are sent by Stripe.
  • Respond to your support requests. Read what you wrote to us, reply, follow up.
  • Keep the service running. Diagnose outages, investigate abuse (e.g., a leaked license being used by 50 people).
  • Comply with the law. If we receive a valid legal request for data, we respond — but the technical architecture means we have nothing about your browsing to hand over.

First-party product telemetry (opt-in, off by default). The extension includes an optional telemetry feature so you can choose to share content-free usage events (feature counters and timings — never page content, titles, URLs, queries, or answers) that help us improve Retrace. It is OFF by default and sends nothing unless you explicitly turn it on; consent is checked on your device before any request is constructed and re-checked on our server. It is first-party only — we still run no third-party analytics or tracking pixels.

We use the data we collect only to provide and improve the Service and to fulfill the purposes described in this policy. We do not sell your data, do not use it for advertising, do not transfer it to data brokers, and do not use it to train AI models. Our use of data obtained through your Google account (for Google Docs, Sheets, and Slides content capture) complies with the Google API Services User Data Policy, including its Limited Use requirements; that content is fetched directly to your device and is never sent to Sauvrn servers.

We do not:

  • Sell your personal information to anyone, ever.
  • Share your personal information with advertising networks.
  • Use your information to train AI models. (We don't have your browsing data in the first place, and even your support messages stay out of training.)
  • Build behavioral profiles of you for marketing.
  • Run third-party analytics or tracking pixels on our marketing site, app, or extensions.

Who we share information with

The third parties who process your data on our behalf:

Service What they handle Why Where
Google Cloud (GCP) Hosts our backend and database Backend infrastructure us-central1 (Iowa, USA)
WorkOS Sign-in (OIDC) provider Authentication USA
Stripe Subscription and payment processing; Stripe sends billing receipts Billing USA + Ireland
Resend Sends our transactional emails (welcome on first sign-up, workspace invitations, license-revocation notices, and the acknowledgment for feedback you send) Email delivery USA
Linear Issue tracking for feedback you send Support inbox USA
Slack Internal team channel that feedback you send is posted to Support inbox USA
BetterStack Status page and uptime monitoring Operational USA
Cloudflare DNS for sauvrn.ai and subdomains DNS Global

The AI models the Retrace desktop app downloads at setup are served from our own CDN (models.sauvrn.ai, hosted on the same Google Cloud infrastructure listed above) — no third party is involved in model distribution, and the download carries no account identifier. When you capture a Google Doc, Sheet, or Slides document, the extension makes one credentialed request to Google reusing your existing Google session; that content goes to your device, never to us.

Each provider has its own privacy policy. We pick providers who themselves don't sell data and who let us delete records on request.

We do not share your information with anyone else outside this list, except: - If you explicitly tell us to (e.g., "please share my support thread with my teammate"). - If we're legally required to (e.g., a valid court order). - In the event of a business transfer (acquisition, etc.), in which case we'll notify you in advance and you'll have the option to delete your data first.

International transfers

Sauvrn operates from Canada, but our infrastructure is primarily in the United States (Google Cloud us-central1). If you sign up from outside the United States, your account information will be transferred to and processed in the US.

For users in the European Economic Area (EEA), UK, or Switzerland: this transfer occurs under Standard Contractual Clauses with our processors. If you'd like a copy of the SCC documents, email privacy@sauvrn.ai.

For users in California: the disclosures required by CCPA are throughout this policy. You also have the rights listed in Your rights and choices below.

For users in Canada: this policy is consistent with PIPEDA, Ontario's PIPA, and Quebec's Law 25. We are happy to provide additional disclosure on request.

Your rights and choices

You can, at any time:

  • Access the personal information we hold on you. Email privacy@sauvrn.ai and we'll provide a copy of the personal data we hold, compiled manually on request.
  • Correct inaccurate information by editing your account profile, or by emailing us.
  • Delete your account and all associated data. Self-serve deletion has shipped: sign in to the web app and use Settings → Account → Delete account. If you own a workspace that still has other members, deletion is refused and nothing is deleted until you remove them or transfer the workspace. Deletion also instructs our payment processor (Stripe) to delete your customer record; payment processors retain the transaction records the law requires them to keep. You can also email privacy@sauvrn.ai to request deletion; we action those manually and aim to complete them within 30 days, and deleted data falls out of backups within a further 30 days.
  • Object to specific processing if you have legal grounds (e.g., under GDPR Article 21). Email us with the specifics and we'll respond.
  • Port your data. Self-serve export has shipped: sign in to the web app and use Settings → Account → Export my data to download the personal data we hold about you (account email, name, workspace, and license/subscription state) as JSON. You can also ask us for it by email. Note: your captured Retrace memory lives only on your device; export of that is done locally, not by us.
  • Withdraw consent you've previously given. Note that this may make some features unusable.

You do not need to give us a reason. "I want to" is sufficient.

For users in jurisdictions with regulated data-protection authorities, you also have the right to lodge a complaint with that authority. For Canadian users: the Office of the Privacy Commissioner of Canada at priv.gc.ca. For Ontario users: the Information and Privacy Commissioner of Ontario at ipc.on.ca.

Children

Sauvrn is not directed at children under 13 (under 16 in the EEA/UK). We do not knowingly collect information from children. If you believe a child has signed up, email privacy@sauvrn.ai and we will delete the account.

Security

We follow standard industry practice for security:

  • Encrypted data in transit (TLS 1.2+) on all endpoints, enforced by HSTS.
  • Encrypted data at rest in our database and bucket storage.
  • Secret material (API keys, signing keys) stored in Google Cloud Secret Manager with strict IAM scoping.
  • Least-privilege access — the founder is the only human with production write access at this stage.
  • A documented audit logging trail for every administrative action.

If you discover a vulnerability, please report it via security@sauvrn.ai. We don't yet have a formal bug-bounty program but we will publicly credit researchers who report responsibly.

Data retention

  • Active account data: retained while your account is active.
  • Deleted account data: deleted from our systems when we process your deletion request, and out of backups within 30 days after that. We also instruct our payment processor (Stripe) to delete your customer record; payment processors retain the transaction records the law requires them to keep.
  • Support tickets: retained for 2 years after the ticket is resolved, then deleted, unless you ask us to delete sooner.
  • Operational logs: 30 days, then deleted.
  • Billing records: retained for 7 years as required by Canadian and US tax law.
  • On your device: your captured memory is kept for the retention window you choose in Retrace's settings, and we never hold a copy of it. One boundary is worth stating plainly: Retrace also remembers how you read a captured page — what you select or copy, how far you scroll — and keeps that as long as it keeps any version of that page. So on a page you revisited, what you did before your chosen window survives with the newer copy. See Retrace's privacy commitment.

Changes to this policy

If we make material changes to this policy, we'll email you (using the address on your account) at least 14 days before the changes take effect. The current version is always at https://docs.sauvrn.ai/privacy; the date at the top reflects the last revision.

Contact

The person responsible for privacy at Sauvrn AI Corporation is Cameron Langs, founder.