Privacy Policy

Effective date: May 25, 2026  ·  Last updated: May 25, 2026

Traced ("we," "us," or "our") is a personal finance and expense tracking application. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using Traced, you agree to the practices described here.

1. Information We Collect

We collect the following categories of information:

• Email metadata — sender address, subject line, email snippet, and attachment filenames from connected inboxes. We read email content only to extract receipt and transaction data. Full email bodies are processed in memory and are not permanently stored on our servers.
• Bank and card transaction data — merchant name, transaction amount, date, account type, and category, retrieved via your bank's authorized connection through Plaid. We do not collect your bank login credentials.
• Phone number — collected when you choose to enable SMS transaction alerts. Used solely to send you categorization prompts and receive your replies.
• Account preferences — which accounts are labeled Work vs. Personal, category assignments, and connection timestamps.

2. How We Use Your Information

• To identify, display, and categorize receipts and transactions in your Traced dashboard.
• To send SMS text messages to your phone number alerting you to new charges and requesting categorization replies. Message frequency varies based on your account activity. Standard carrier message and data rates may apply.
• To match email receipts with PDF attachments and proxy them securely to your browser.
• To maintain your account preferences (Work/Personal labels, categories) between sessions.

We do not use your data for advertising, profiling, or sale to third parties.

3. SMS Messaging Program

By providing your phone number and linking a bank account, you consent to receive automated SMS text messages from Traced regarding your financial transactions. These messages are sent to help you categorize transactions in real time.

• To opt out: Reply STOP to any message. You will receive a one-time confirmation and no further messages will be sent.
• To get help: Reply HELP to any message or contact us at the address below.
• Message frequency: One message per new bank transaction. This varies based on your spending activity.
• Cost: Message and data rates may apply depending on your mobile carrier plan.
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subprocessors (Twilio, Plaid) is limited to what is required to operate the service.

4. Third-Party Services

Traced uses the following third-party providers to deliver its service:

• Nylas — used to connect and read your email accounts via OAuth 2.0. Subject to Nylas's privacy policy at nylas.com.
• Plaid — used to connect your bank accounts and retrieve transaction data. Plaid's privacy policy is available at plaid.com/legal/privacy-statement. Traced never receives or stores your bank username or password.
• Twilio — used to send and receive SMS messages. Your phone number is shared with Twilio solely to deliver messages. Twilio's privacy policy is available at twilio.com/legal/privacy.

We do not sell, rent, or otherwise share your personal information with any other third party.

5. Data Storage and Security

Account connections and preferences are stored locally in encrypted configuration files on the device running Traced. Email and transaction data is fetched on demand and not retained beyond the active session, except for categorization preferences you explicitly save. We use HTTPS for all communications with third-party APIs.

No security system is impenetrable. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

6. Data Retention and Deletion

You can disconnect any email account or bank account at any time from the Accounts screen. Disconnecting removes the stored credentials and stops all data collection for that source. To request full deletion of any stored information, contact us at the address below and we will respond within 30 days.

7. Children's Privacy

Traced is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it promptly.

8. Your Rights

Depending on your location, you may have the right to access, correct, or delete personal information we hold about you, or to restrict or object to certain processing. To exercise any of these rights, contact us below.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Material changes will be communicated through the app. Continued use of Traced after changes constitutes acceptance of the updated policy.