Privacy Policy

Pre-launch edition · August 2026 · The effective date will be set at Traccia's public launch (December 2026).

The short version

Traccia is a private life journal that quietly records the places you go, so you can look back on your life without handing it to anyone. Here's the honest summary:

Your journal is yours. Your location history, photos, notes, and the people and places in your timeline are encrypted on your iPhone before anything leaves it. We use AES-256-GCM encryption and a key that only you hold. We cannot read your journal content, and neither can anyone who breaks into our servers.
What we can see is small but real. To run your account we can see your email address, sign-in details, when your device syncs, and the size of the encrypted bundles we store. If you leave crash reports and analytics on, we see limited technical usage data. We list all of this below — no hiding it.
Where it lives. Your encrypted mirror lives on servers in the European Union (Frankfurt, Germany). Your primary copy lives on your device.
What we never do. We never sell your data. No ads. No brand deals. No sponsored content. Ever.
You're in control. You can export everything and permanently delete your account from inside the app.
Who we are. Traccia is built by A Good Husband, a one-person studio in Abu Dhabi, UAE. You can reach us any time at privacy@traccia.life.

The full policy below explains all of this in detail, including your legal rights under EU, UK, UAE, and California law.

1. Who we are (the data controller)

Traccia ("Traccia," "we," "us," "our") is operated by A Good Husband, a sole-proprietor software studio based in Abu Dhabi, United Arab Emirates, founded and run by David. We are the "data controller" responsible for your personal data.

Websites: traccia.life and agoodhusband.co
Privacy contact: privacy@traccia.life
Postal contact: published at launch
EU representative (GDPR Article 27): appointed and published at launch
UK representative (UK GDPR Article 27): appointed and published at launch
Data Protection Officer: reachable via privacy@traccia.life; a dedicated DPO contact will be published at launch

This policy applies to the Traccia iOS app (listed on the App Store as "Traccia – Journal"), the traccia.life website, and related services. An Android version is planned after launch; this policy will be updated to cover it.

2. Our privacy promise, stated honestly

Traccia is built on a zero-knowledge design. Your content is encrypted on your device using AES-256-GCM before it is synced. Your encryption keys are derived from a User Master Key (UMK), which is itself wrapped by keys derived from your password and your recovery key. Because those keys never reach us in usable form, we cannot decrypt your journal, and a breach of our servers would expose only unreadable ciphertext.

We think it's important to be equally clear about the limits of that promise. Encryption protects your content, not the fact that you have an account. So here is the honest split.

What we CANNOT see:

Your location history and timeline of places
Your journal notes and entries
Your photos and scanned documents
The contacts you attach to the People feature
Any content protected by your keys

What we CAN see (and why):

Your account email address — to create your account, sign you in, and send essential service emails
Authentication metadata — sign-in method (email OTP + password, Sign in with Apple, or Google Sign-In), timestamps of logins, and security tokens
Encrypted blob metadata — the size of the encrypted bundles you sync and the time they were synced. While this data is technically personal data, it is processed strictly to verify successful synchronization and manage storage quotas. It does not reveal the content of your journal.
Crash diagnostics (only if you enable them) — technical error data via Sentry
Subscription status — if and when we introduce paid plans in the future (Traccia is free at launch)

We will never inflate our privacy claims. If our architecture changes, this section changes with it.

3. What we collect, why, and our legal basis

Under GDPR we must tell you the purpose and the "legal basis" for each type of processing (GDPR Articles 6 and 13). Here it is.

Data	Purpose	GDPR legal basis
Email address, password/auth credentials	Create and secure your account; sign you in; send essential service messages	Contract (Art. 6(1)(b))
Encrypted location history, journal entries, photos, documents (content we can't read)	Provide the core journaling service; sync and back up your encrypted data	Contract (Art. 6(1)(b))
Encrypted blob size + sync timestamps	Operate sync, verify data integrity, and manage storage quotas	Contract (Art. 6(1)(b)) — necessary to perform the core service. (A Legitimate Interests Assessment is documented as fallback, but Contract is the primary basis.)
Contacts (People feature)	Let you associate people with places/memories — optional, on-device	Consent (Art. 6(1)(a)), via iOS permission
Camera (document scanning)	Optional flight-document scanning	Consent (Art. 6(1)(a)), via iOS permission
Photos	Optional attachment of images to entries; with your permission, Traccia reads when and where your photos were taken (on-device) to place them in your timeline and story	Consent (Art. 6(1)(a)), via iOS permission
Crash diagnostics (Sentry)	Detect and fix crashes	Consent (Art. 6(1)(a)) — opt-in
Notification preferences	Deliver local notifications you turn on	Consent (Art. 6(1)(a))

A note on location. Location is the heart of Traccia. With your permission, the app records your location in the background — including when the app is closed — to build your timeline. iOS asks you for "When In Use" access first and later asks whether to allow "Always"; Traccia needs "Always" access to keep your timeline complete. iOS will periodically remind you that Traccia is using your location in the background and let you change your mind at any time. You choose Precise or Approximate location, and we honestly reflect your choice. You can revoke location access at any time in iOS Settings; the app will keep working with whatever you've already recorded. Location data is collected on-device and synced only in encrypted form.

A note on crash reporting. Crash reporting (Sentry) is off by default and only runs if you opt in, because diagnostics generally require your consent. You can turn it off again at any time in the app. Our Sentry sample rate is set low (0.05) to minimize collection, Sentry is configured to store data in the EU (Frankfurt), and we never attach your identity to crash reports. Traccia does not use product-analytics tracking; if we ever add it, it will be opt-in and this policy will be updated first.

4. Where your data lives

On your device: your primary journal lives locally in an encrypted database (SQLite/SQLCipher). Traccia is offline-first — the app works without a connection.
On our servers: an encrypted mirror is stored with Supabase (PostgreSQL) in the EU, Frankfurt region. We chose the EU region deliberately for strong data-protection standards and data residency.

5. Who processes data for us (subprocessors)

We keep our vendor list short and privacy-conscious. Each is bound by a data processing agreement. None of them can read your encrypted content.

Subprocessor	Role	Data location
Supabase	Database, authentication, encrypted storage mirror	EU (Frankfurt)
Resend	Transactional email (via custom SMTP send.traccia.life)	EU region
Sentry	Crash reporting (opt-in; sample rate 0.05)	EU (Frankfurt)
Cloudflare	Website hosting (Cloudflare Pages, traccia.life)	Global CDN
Apple	App distribution; Sign in with Apple; local notifications	Per Apple's terms
Google	Google Sign-In (OAuth/PKCE) if you choose it	Per Google's terms

We use local notifications only at launch — there are no push tokens and no remote push service, so we do not transmit notification data to a push server.

We do not sell your personal data, and we do not share it with advertisers, data brokers, or brand partners.

6. How long we keep data (retention)

Your account and encrypted content: kept for as long as your account is active.
When you delete your account: your deletion enters a 30-day grace period — a safety net in case you change your mind. You can cancel any time during those 30 days by signing back in and choosing to keep your account. After the grace period ends, we permanently and automatically delete your server-side data: your encrypted content, your photos, and your account itself. On-device data is removed when you delete the app or your account.
What survives deletion, honestly: we keep one minimal, content-free record that a deletion happened (an internal account identifier, the event, and its date — nothing about you or your journal), so we can prove the deletion was carried out. Deleted data may also persist briefly in encrypted database backups until those backups age out — currently up to 7 days. Backups are never used to restore deleted accounts.
Operational logs: internal sync and security audit logs are automatically purged after 90 days.
Crash data (if enabled): retained at Sentry for 90 days and never linked to your identity.
Email logs (Resend): retained only as needed to deliver and troubleshoot essential emails.

You can export all your data and delete your account at any time from within the app.

7. Your rights

Depending on where you live, you have some or all of the following rights. We will not discriminate against you for exercising them, and we will respond within the timeframes the law requires. To exercise any right, email privacy@traccia.life (or use the in-app export/delete tools).

If you are in the EU or UK (GDPR / UK GDPR, Articles 15–22):

Right to be informed (this policy)
Right of access — get a copy of your data
Right to rectification — correct inaccurate data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing based on legitimate interests
Rights regarding automated decision-making — note: Traccia does not make automated decisions with legal or similarly significant effects about you
Right to withdraw consent at any time (e.g., turn off analytics)
Right to lodge a complaint with your supervisory authority

We aim to respond to GDPR requests within one calendar month.

If you are in the UAE (PDPL, Federal Decree-Law No. 45 of 2021):

Right to be informed and to access your data
Right to rectification and to erasure
Right to restrict/stop processing
Right to data portability
Right to object to processing
Right to withdraw consent
Right to file a complaint with the UAE Data Office

If you are in California (CCPA/CPRA):

Right to know what personal information we collect and how it's used
Right to access/obtain a copy
Right to delete
Right to correct inaccurate information
Right to opt out of the "sale" or "sharing" of personal information — we do not sell or share your personal information, so there is nothing to opt out of
Right to limit the use of sensitive personal information (location is sensitive) — we already limit our use to providing the service
Right to non-discrimination

We do not knowingly sell or share personal information, and we have not done so in the preceding 12 months. Because we hold everyone to the same strong privacy posture, most Californians will find their data already handled at the level CCPA reserves for its strongest protections.

8. International data transfers

Traccia's controller is in the UAE, and your data is stored in the EU (Frankfurt). That means data may move between the UAE, the EU, and (depending on where you are) your own country.

For EU/UK users: your data is stored inside the EU. Where any data is accessed from the UAE by us as controller, we rely on appropriate safeguards for that transfer, consistent with GDPR Chapter V.
For UAE users: storing data on EU servers is a cross-border transfer out of the UAE under PDPL Articles 22–23. Because the UAE Data Office has not yet published an adequacy list, we rely on PDPL Article 23 safeguards — a data processing contract that binds our EU host to PDPL-level protections, together with your explicit consent for the transfer.
For all users: our subprocessors that operate outside your region rely on standard contractual clauses or equivalent safeguards where required.

9. Children

Traccia is not directed to children. The app is rated 17+ on the App Store and is intended for adults. We do not knowingly collect personal data from children under 16 (or the applicable age of digital consent in your country; under 13 for purposes of the U.S. COPPA). If you believe a child has provided us data, contact privacy@traccia.life and we will delete it.

10. Security

Beyond zero-knowledge encryption, we use TLS in transit, encryption at rest, a low-privilege server design, and reputable EU-based infrastructure. No system is perfectly secure, but our architecture is designed so that the most sensitive thing — your journal — never exists in readable form on our servers.

11. Changes to this policy

If we make material changes, we'll update the "Last updated" date and notify you in-app or by email before the changes take effect. If the UAE Data Office publishes Executive Regulations that mandate specific registration or additional procedures for high-risk processing, we will update this policy and our internal procedures accordingly. This policy supersedes the earlier short privacy page at traccia.life/privacy (which covered on-device encryption, the iOS privacy manifest, and account deletion).

12. Contact us

Questions, requests, or concerns: privacy@traccia.life. Details of our EU/UK Article 27 representative will be published here at launch. You always have the right to complain to your local data-protection authority (EU), the UK ICO, or the UAE Data Office.