Privacy Policy

Draft — not yet reviewed by a lawyer. This page describes how Core Traces actually works today, in plain language, so the product has an honest privacy policy in place while a proper legal review is pending. Don't treat this as final legal text.

What we collect

The identifiers you give us at signup (name, email, city, phone, username, WhatsApp number) and, optionally, a photo you choose to have us track. We also store the findings our scans produce about you: data-broker listings, breach and infostealer exposure, impersonation/mention hits, and photo-reuse matches.

How we use it

Solely to run your own monitoring: searching the open web, breach databases, and infostealer-malware records for your own identifiers, and alerting you (via the dashboard and WhatsApp) when something new turns up. We never use your data to look up or monitor anyone else, and we never submit removal or opt-out requests on your behalf — findings and removal steps are for you to act on yourself.

Who we share it with (processors)

These services process your data on our behalf, each queried only with your own identifiers:

Supabase — database, authentication, and photo storage.
Twilio — sends your WhatsApp alerts.
Google Cloud Vision — reverse-image search for tracked photos.
Have I Been Pwned and Hudson Rock — breach and infostealer-exposure checks against your email.
Vercel — hosting and anonymous, aggregate site analytics.

We do not sell your data, to anyone, ever.

How long we keep it

For as long as your account is active. If you delete your account, your data is removed — see "Your rights" below.

Your rights

If you're in the EU/EEA, GDPR gives you the right to access, correct, export, and delete your data. You can export a copy of everything we hold about you, or delete your account entirely, from Account settings. Deleting your account removes your profile, findings, reports, and tracked photos permanently.

Contact

Questions about this policy: reach out via the email you signed up with.