Privacy Policy

This Privacy Policy explains how Ulookup Technologies LLP (“we”, “us”, “our”) collects, uses, stores, shares, and deletes information when you use the Trace app for iPhone and Android (the “App”), the Trace dashboard on the web, and the connector that lets AI tools read your Trace data. By using Trace, you agree to the practices described here. Your use of Trace is also governed by our Terms of Service.

If anything here is unclear or you’d like to exercise your rights, contact us at support@heytrace.app.

1. Who we are

Ulookup Technologies LLP, based in Gurugram, Haryana, India, is the controller of personal data processed in connection with Trace. Our company website is ulookup.ai. The App is published under the package identifier com.ulookup.trace on both Android and iOS.

2. What Trace does

Trace records the conversations and voice notes you choose to record. It transcribes each recording, tells the speakers apart, and uses large language models to write it up as a meeting (with a summary, decisions, topics, and action items) or as a note. From what was said, it suggests reminders and the people you talked to. A suggestion becomes a reminder, or a person in your people list, only when you accept it.

Recall lets you ask questions about what you recorded and get answers that cite your meetings and notes. It can also create a reminder when you ask it to. You can also connect an AI tool you use, such as Claude, ChatGPT, or Cursor, so it can read your Trace data (see section 7).

Earlier versions of Trace had a chat assistant, knowledge pages, and insights. Those features were retired on 17 October 2026 and their data was deleted from every account.

3. Information we collect

3.1 Information you provide

• Account information: your email address and display name. You can sign in with an email and password, with Google, or with Apple. If you use a password, it is hashed by our authentication library, Better Auth, and never stored in plain text. If you use Google or Apple, we receive your name, email address, and profile picture, if you have one, from them.
• Audio recordings that you start within the App.
• Profile details you choose to add: your name, role, and company.
• A personal dictionary of names, companies, and terms you add to improve transcription.
• Who’s who: which speaker in a recording is you, and the names you give the others. Each name you confirm is kept in your people list.
• Questions you ask Recall.
• Anything else you choose to enter in Trace, such as edits to meetings, notes, reminders, or people.

3.2 Information generated from your use of Trace

• Transcripts of your recordings, produced by our speech-to-text sub-processor ElevenLabs, marking which parts each speaker said.
• A record of each speaker in a recording, with a line they said and, where a recording has more than one speaker, a short audio clip of their voice (see section 5).
• Content written by language models: meetings, notes, suggested reminders, suggested names for speakers, and Recall answers.
• Your timezone, used to date your recordings and schedule reminders correctly.
• Usage counts, such as how many recordings you have made, used to apply limits.

3.3 Information collected automatically

• Device details: an identifier for your installation of the App, your platform, device model, operating system version, and app version.
• A push notification token, issued through Expo’s push service, so we can deliver notifications.
• Standard server logs, including IP address, request timestamps, and user agent strings. We use these for security, debugging, and abuse prevention.
• Usage information, such as which features you use, along with basic device and app details.

We use PostHog for product analytics and Meta to measure whether our ads lead to installs and sign-ups. PostHog receives an account id, your email address, when you signed up, and the names of events, such as which features you use and the names of AI tools you connect. Meta receives that the App was installed or opened and that an account was created. Neither receives your recordings, transcripts, or anything else you create in Trace, and we do not ask to track you across other apps. If we add another analytics or advertising provider, we will update this policy first.

4. How we use your information

We use the information described above to:

• Provide the features of Trace: recording, transcription, telling speakers apart, writing meetings and notes, suggesting reminders and people, Recall, the connector for AI tools, and push notifications.
• Authenticate you and keep your account secure.
• Send transactional emails, such as the email that verifies your address. We do not send marketing emails.
• Operate, maintain, and improve our infrastructure (debugging errors, capacity planning, security monitoring).
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not use your recordings, transcripts, or anything else you create in Trace for advertising, and we do not use them to train AI models. We only measure whether our own ads lead to installs and sign-ups.

5. Speakers and other people’s voices

Recordings made through Trace capture the voices of the people you talk to. You are responsible for understanding and complying with the laws that apply to you about recording other people. In many places and situations, everyone in a conversation must agree to be recorded. Our Terms of Service say more about this.

Within a single recording, Trace tells the different speakers apart (for example “speaker 1” and “speaker 2”) so the transcript shows who said what. To help you say which speaker is you and who the others are, Trace keeps a line each speaker said and, where a recording has more than one speaker, a short audio clip, up to 8 seconds, of each speaker who spoke long enough to cut one.

Trace may suggest which speaker is you, or a name for a speaker, from what was said in the recording, for example when someone is addressed by name. Until you confirm who’s who, such a suggested name may appear in the meeting and in who’s who. Only you set a speaker’s name, and a person is added to your people list only when you confirm it.

Trace does not recognise a person’s voice across recordings and does not build a voiceprint of anyone. Speaker clips are never compared with other recordings. They are deleted with the recording’s audio or shortly after (see section 11).

6. Using Trace before you sign in

You can try Trace before you create an account, as a guest. A guest can make up to three recordings, five minutes in all. They are processed in the same way as an account’s: the audio is stored, transcribed, and written up, using the sub-processors in section 9. Recall, the connector, and profile details are not available to a guest.

If you sign in, everything you made as a guest moves to your account. If you never sign in, the guest account and all its recordings and data are deleted seven days after it was created.

7. Connected AI tools

You can connect an AI tool, such as Claude, ChatGPT, or Cursor, to your Trace account through the Model Context Protocol (MCP). The tool asks for your approval when you connect it. Once you approve, it can read your meetings, notes, transcripts, list of recordings, people, reminders, profile, and dictionary, and it can create and complete reminders for you.

What the tool reads is sent to the tool and handled by its maker under their own terms and privacy policy. You can remove a connection at any time in the App, under Settings, Connected agents. After that the tool can no longer read your data, but it keeps whatever it has already read. We keep the tool’s name and when it last read your data.

8. How and where we store your information

• Account information, transcripts, meetings, notes, reminders, your profile, dictionary and people list, Recall conversations, and metadata are stored in our managed backend and database (Convex), scoped per user.
• While you record, and until the upload finishes, audio is stored on your phone. It is removed from the phone once the upload is confirmed, and when you sign out.
• Audio files, including speaker clips, are stored in Convex’s managed file storage and are referenced only from your account.
• Session tokens on your device are kept in the iOS Keychain or the equivalent secure storage on Android.
• All communication between Trace and our backend is encrypted in transit using TLS / HTTPS.

9. Sub-processors and third parties

Trace relies on third-party AI providers to work. Your recordings, transcripts, and questions, together with your profile details, dictionary, and the names in your people list, are sent to the AI sub-processors below so Trace can transcribe your audio and write things up. By using Trace, you consent to this processing. We do not share your data with any third-party AI for advertising, profiling, or any purpose other than delivering the features you use.

We use the following sub-processors to operate Trace. Each is bound to handle data only as instructed by us:

• Convex — backend hosting, database, managed file storage (including audio), and background jobs such as processing recordings.
• Vercel — hosting for the Trace dashboard and this website.
• ElevenLabs — speech to text, using its Scribe v2 model. We send the audio you record so it can be turned into text and the parts said by different speakers can be told apart. To improve accuracy we also send key terms: your name and company, the names in your people list, and the terms in your dictionary. ElevenLabs acts as our data processor. Its terms let customers turn off the use of their content to train its models, and we have turned this off. From the public release of this version of Trace, we delete each transcription from ElevenLabs as soon as it completes, so their copy does not outlive ours. Until then, ElevenLabs keeps the audio and text of each request in our account history under its own retention.
• OpenAI — large language models, used to decide what kind of recording you made, write meetings and notes, suggest reminders and names, and answer Recall questions. We send the relevant text: your transcripts, your profile details and dictionary, the names in your people list, your questions, and, for Recall, the meetings, notes, transcripts, people, and reminders needed to answer. Under OpenAI’s API terms, this data is not used to train its models. OpenAI keeps logs of requests for up to 30 days to check for abuse, and keeps the responses to our requests for 30 days under the settings we use today.
• Resend — transactional email delivery (verification emails only).
• PostHog — product analytics.
• Meta Platforms — measuring installs and sign-ups from our ads.
• Google and Apple — signing in, if you choose Sign in with Google or Sign in with Apple.
• Expo Push Service, Apple Push Notification service (APNs), and Google Firebase Cloud Messaging (FCM) — delivering push notifications.
• Google Play and Apple App Store — distribution of the App. These platforms apply their own privacy policies and may collect standard platform telemetry independently of us.

We aim to keep this list current. If we add or replace a sub-processor in a way that materially affects how your data is handled, we will update this policy.

10. International data transfers

Trace is offered globally, and our sub-processors may operate in countries different from your own — most commonly, the United States. By using Trace, you understand that your information may be transferred to, processed in, and stored in countries whose data-protection laws may differ from those in your country. Where required by law (for example for transfers from the European Economic Area or the United Kingdom), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

11. How long we keep your information

• We keep your account data and the content you create in Trace for as long as your account is active, unless you delete it sooner (see section 12). This includes your transcripts, meetings, notes, reminders, people list, profile, dictionary, and Recall conversations.
• Audio recordings are deleted 14 days after they are uploaded, once they have been transcribed. If a recording has not been transcribed, its audio is kept for up to 30 days after upload so transcription can be retried, and is then deleted. The transcript, meeting, and note stay after the audio is gone.
• Speaker clips are deleted with the recording’s audio, or shortly after. The line each speaker said stays with the transcript.
• If an upload from your phone never finishes, the parts that arrived are kept for up to 14 days so the upload can be retried (up to 30 days if the recording failed while being assembled), and are then deleted.
• A guest account that never signs in is deleted, with all its data, seven days after it was created.
• If you delete your account in the App, deletion starts at once. If you ask us by email, we delete your account within 30 days of verifying the request. In both cases it cannot be undone, except where we are legally required to keep something for longer (for example, to comply with tax or fraud-prevention obligations).
• Backups are purged on a rolling cycle of up to 90 days; deleted data may persist in encrypted backups during that window before being overwritten.
• Server logs are retained for a limited operational period, typically not longer than 90 days.

12. Deleting your data

• Deleting a recording deletes, for good, its audio, speaker clips, transcript, speakers, meeting or note, and the suggested reminders you had not accepted. A person in your people list who appears in no other recording is deleted too. Reminders you had accepted from it stay, no longer linked to it. We keep only a short marker of the deleted recording for 90 days, so a late upload from your phone cannot bring it back.
• Recall conversations that already quoted a deleted recording keep those answers. Recall conversations are deleted when you delete your account.
• An AI tool you connected keeps whatever it already read from a deleted recording.
• Deleting a meeting or a note deletes it for good, along with the suggested reminders from it you had not accepted. Reminders you had accepted stay, no longer linked to it. The recording and its transcript stay, so you can write it up again. When you write a recording up again, the earlier meeting or note is hidden and kept until you delete the recording or your account.
• Deleting a reminder hides it. Hidden reminders are kept until you delete your account.
• Removing a person from your people list deletes them for good.
• Deleting your account deletes everything: your account, recordings, speaker clips, transcripts, meetings, notes, suggested and accepted reminders, people, profile and dictionary, Recall conversations, connected AI tools, devices and push tokens, and usage counts. You can delete your account in the App, under Settings, Delete account, or by asking us by email. Copies our sub-processors hold expire under their own retention, described in section 9.

13. Your rights

Depending on where you live, you may have the following rights with respect to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Deletion (the “right to be forgotten”) — ask us to delete your data.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Object to or restrict processing (under the GDPR / UK GDPR).
• Opt out of the “sale” or “sharing” of your data (under the CCPA / CPRA). For clarity, we do not sell your data, but California residents may still submit a formal request to confirm this.
• Nominate a representative to exercise rights on your behalf in the event of death or incapacity (under India’s Digital Personal Data Protection Act, 2023).
• Lodge a complaint with your local data-protection authority if you believe we have not handled your data properly.

To exercise any of these rights, email support@heytrace.app. We will respond within the timeframes required by applicable law (typically within 30 days).

14. Children

Trace is for people 18 years of age and older. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@heytrace.app and we will delete that information promptly.

15. Security

We use a combination of technical and organizational measures to protect your data, including encrypted transport (TLS / HTTPS), per-user isolation of your data, hashed password storage, secure on-device session storage (iOS Keychain / Android equivalent), and access controls on our infrastructure. No system is perfectly secure; if we ever discover a breach affecting your data, we will notify you and the relevant authorities as required by law.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you in advance by email or through the App, ask you to accept the new policy in the App, and update the effective date at the top of this page. Your continued use of Trace after the new policy takes effect constitutes acceptance of the updated terms.

17. Contact

Privacy questions, requests to exercise your rights, or any other concerns about your data should be sent to support@heytrace.app.