Trace
Trace Privacy Policy
Effective: 31 August 2026
Trace keeps your recordings, text records, location tracks and transcripts on your own device and in your own private iCloud database. Trace operates no developer-run server that receives this content.
1. Who handles your data
Trace is developed and provided by qqfly. Contact: trace@qqfly.net.
Trace has no backend server. The app does not send your data to any facility controlled by the developer — because no such facility exists.
There is no account system. Trace requires no sign-up and does not automatically obtain your name, email address, phone number or Apple Account credentials. iCloud sync uses the Apple Account already signed in on your device. If you choose to send a support email, the developer receives the sender address and content you choose to send (see section 5).
2. What data Trace produces, and where it lives
| Data | How it is produced | Where it is stored |
|---|---|---|
| Recorded audio | Captured by the iPhone or Apple Watch microphone when you start a recording | Local files on the device; and, if you enable iCloud backup, your private iCloud database |
| Text records | Paragraphs you enter, together with the time and location saved for each paragraph | As above |
| Location track | Sampled during a recording, so you can review it later on the timeline and map | As above |
| Markers | Moments you deliberately mark during a recording | As above |
| Titles and place names | Titles you type; place names resolved by the system (see section 4) | As above |
| Transcripts | Produced by on-device speech recognition when you request it or enable automatic generation in settings | As above |
| Technical metadata | App-generated internal record and device identifiers, times, states, file sizes and checksums used to organise, sync and recover records | As above |
| Diagnostic log | The app's own runtime events (phase names, states, counts, byte sizes, identifiers) | On the device only, unless you export it yourself (see section 5) |
3. iCloud backup: where the data goes, and who can see it
With iCloud backup enabled, the data above syncs to a CloudKit private database. This means:
- It is stored on Apple's servers under your Apple Account, protected by Apple's privacy policy and security measures;
- The database belongs to your Apple Account; Trace has no developer-operated backend and does not copy its contents to one;
- You can turn iCloud backup off in Trace's settings at any time, or remove Trace's data under Settings → Apple Account → iCloud on your device. Turning backup off does not automatically delete copies already synced to iCloud.
4. When data leaves one device
Trace does not send your record content to a developer-operated service. The following features use Apple's system services, your paired devices, or a destination that you choose:
4.1 Place-name lookup — coordinates are sent to Apple
To turn a pair of coordinates into a readable place name, Trace calls the iOS geocoding service (CLGeocoder). This is a network service: your coordinates are sent to Apple's servers in exchange for a place name.
- The place-name request uses the coordinates — no audio, titles or transcript text;
- Apple is the processor, and Apple's privacy policy applies;
- If you decline location permission, no track is recorded and this step never happens.
4.2 Map display
Trace uses Apple MapKit to display tracks and places. When a map is displayed, the visible map region, device and network information, and location information you allow the system to use may be sent to Apple or its map-service partners. Trace does not include recordings, titles or transcript text in map requests.
4.3 iCloud sync
See section 3. This happens only if you enable iCloud backup.
4.4 Speech transcription — on-device, but the model is downloaded
Transcription uses Apple's on-device speech recognition. Your audio does not leave the device in order to be transcribed. The first time you use a given language, however, the system may download that language's recognition model from Apple — what is downloaded is the model, not your audio.
4.5 iPhone and Apple Watch coordination
When you use Watch coordination, audio chunks, location, markers, recording state and Trace Core entitlement state are transferred between your paired iPhone and Apple Watch through Apple's WatchConnectivity. This transfer does not send the data to a developer-operated server.
4.6 App Store purchase and trial status
Trace uses Apple StoreKit to load products, process purchases, and verify Trace Core access and the start of the 14-day trial. Apple handles your Apple Account, payment and transaction. Trace does not see your account credentials or payment-card details. The app receives only the product, verified transaction result, purchase date and related entitlement information, and shares the necessary access state with your paired Apple Watch.
4.7 Exports and shares that you initiate
When you export a record or diagnostic bundle and choose a destination in the system share sheet, the selected data is sent to the app, device, cloud drive or service you choose. That recipient's own privacy policy applies. Trace never sends it in the background on your behalf.
5. Feedback reports (diagnostic bundles)
If you export a diagnostic bundle from the settings screen and send it to the developer, the bundle contains:
- the app's runtime event log (phase names, state names, counts, byte sizes, internal identifiers);
- performance and crash reports generated by Apple's system (MetricKit);
- device information (app version, OS version, model, language).
The bundle contains no recorded audio, no transcript text, no location coordinates, and no recording titles or place names.
The action is entirely yours: you open the settings screen, tap a button, and press send yourself in the system's mail or share sheet. The app has no ability to send anything to the developer on its own.
If you choose email, the developer and both parties' email providers receive your sender address, message and any diagnostic bundle you attach. The developer uses this information only to reply and troubleshoot. You may ask the developer at the same address to delete the corresponding support email.
6. What we do not do
- No advertising, no marketing. The app contains no advertising, analytics or tracking SDKs.
- No tracking. No advertising identifier is collected, and no behaviour is correlated across apps or websites.
- The developer does not sell or disclose your record content to third parties. Apple system services, paired devices and destinations that you choose are described in section 4.
- The developer does not use your data to train models.
7. Your controls
| What you want to do | How |
|---|---|
| Delete one recording | Swipe left on the timeline; the recycle bin allows recovery within 7 days, or immediate permanent deletion |
| Delete everything | Removing Trace from one device clears local data on that device. If Trace remains installed on a paired Apple Watch, remove it there separately. iCloud copies are not automatically deleted when you turn sync off or remove the app from one device; remove them under Settings → Apple Account → iCloud → Manage Account Storage |
| Stop location sampling | Turn Trace off under Settings → Privacy & Security → Location Services; recording is unaffected |
| Stop microphone capture | Turn Trace off under Settings → Privacy & Security → Microphone |
| Stop iCloud backup | Turn it off in Trace's settings; copies already synced to iCloud remain until you remove them in system settings |
| Export your data | Trace can export a recording as an archive containing the original audio, the GPS track (GPX) and metadata |
The developer does not hold your day-to-day record data, so you control access, correction and deletion of that data directly in the app and system settings. For a support email that you chose to send, contact the developer at the address in section 10.
8. Children
Trace is not designed for children below the minimum age applicable in their region and does not knowingly collect personal information from them.
9. Changes
Any material change to this policy will be described in the app's release notes, and the effective date on this page will be updated.
10. Contact
Questions about this policy: trace@qqfly.net.
Website launch notification — separate from the App
This notice applies only to optional launch registration on the Trace website, updated September 22, 2026. It does not change the App’s data handling.
Only when you actively click the launch-notification button, we store a random event ID, random browser ID, server time, button placement and page language. Click counts and approximate browser-deduplicated interest counts cover 180 days. Repeated requests are not counted again. Browser IDs are stored in this site’s localStorage only after the server confirms success and expire after 180 days. Cleared storage, other browsers and shared devices affect these counts; they are not unique people or purchase intent.
Email registration is optional and only used for this app’s availability notification, not advertising. We store your email, registration time, language, button placement and the notice version. Duplicate addresses are counted once; submitting again does not extend retention. Addresses are not verified, and registration itself does not send an email.
Interest records expire after 180 days. Emails expire one year after registration or 30 days after notification, whichever is earlier. Contact trace@qqfly.net to request deletion. After verifying the request, we delete the matching registration from the active database and existing private backups. Backups rotate after 30 days; expired records may remain in an older snapshot until rotation. Restores must expire old records again.
The service uses the developer-controlled Tencent Cloud server, with separate storage for each app and no third-party analytics or form provider. No fingerprinting, cookies, cross-site identity matching or association with App content. Management data is not public. Technical access logs may include IP addresses and paths; API abuse prevention keeps network-address digests in memory for at most one hour. No interest identifier is created simply by viewing a page.