Privacy Policy — Trace
Effective date: 2026-05-04 Last updated: 2026-07-06
1. Who we are
Trace ("the app") is an iOS application that lets you take consistent face photos over time and track how your skin changes. The app is owned and operated by:
SIA Celetum Reģ.Nr. 43603084537 PVN Nr. LV43603084537 Riņķa iela 52, Ventspils, LV-3601, Latvia
For the purposes of the EU General Data Protection Regulation (GDPR) and the Latvian Personas datu apstrādes likums, SIA Celetum is the data controller for any personal data processed through the app.
The app is published on Apple's App Store under the developer account of LD TRADING (Apple Developer Team ID W5DX3JG884), which acts solely as the App Store distribution channel under a separate agreement with Celetum. LD TRADING does not control or process personal data collected by the app.
Privacy contact: in@digicomm.lv
2. The short version
- Your photos stay on your device. They are never uploaded to any server we operate or control, and we cannot see them. (Your photos may travel with Apple's iCloud Backup if you have it enabled — see §3.5.)
- We do not have user accounts. There is no sign-up, no email, no password.
- We do not use any analytics, tracking, or advertising SDKs.
- We do not sell or share your data with anyone for marketing.
- The AI chat feature sends your typed messages and selected metadata (not photos) to a Cloudflare Worker we operate, which forwards them to OpenRouter and from there to Anthropic or OpenAI. Photos are sent only when you explicitly attach one to a chat message or tap Allow in the post-capture share prompt. Every photo share is logged in Settings.
- Stated minimum age: 13. The app is not intended for users under 13. Users between 13 and 16 in the EU/EEA must obtain parental consent before using the app.
The full version is below.
3. What we collect, where it goes, and how long it stays
3.1 Stored only on your device (we cannot see this)
The following data is created and stored locally on your iPhone, inside the app's sandboxed storage area. It never leaves your device unless you explicitly attach it to an AI chat message (see §3.3) or share it via the iOS share sheet:
| Data | Where on device | How long |
|---|---|---|
| Face photos (original JPEG + aligned 1024×1280 variant) | Documents directory inside the app's sandbox | Until you delete the photo or uninstall the app |
| Photo metadata: timestamp, filename, optional note | SwiftData store | Same as above |
| Challenges you create or start (name, dates, template, status) | SwiftData store | Same as above |
| Events you log (name, date, optional note, optional links) | SwiftData store | Same as above |
| Chat messages with the AI (text + which photos you attached) | SwiftData store | Same as above |
| Photo-share audit log (every time a photo's image bytes were sent to the AI) | SwiftData store | Same as above |
| Rolling AI conversation summary (up to 200 words, generated periodically by the AI from your chat history) | iOS UserDefaults (key: chatSummary) |
Until you reset chat history in Settings, or uninstall |
| App preferences (reminder frequency, weekday, hour, onboarding completion) | iOS UserDefaults | Until you uninstall |
When you delete a photo, its files and metadata are removed from your device. When you reset all data in Settings, the local SwiftData store and chat summary are cleared. When you uninstall the app, all of the above is removed by iOS from local storage on the device.
We do not transmit this data to any server we operate or control. We do not run our own backup, sync, or cloud-storage system.
3.2 Stored in your iOS Keychain
| Data | Purpose | How long |
|---|---|---|
A randomly generated Device UUID (e.g. 4F2E…) |
Used as an anonymous identifier so our AI proxy can apply per-device daily rate limits. Not linked to your name, email, Apple ID, or any device hardware identifier. | Stored with iOS's WhenUnlockedThisDeviceOnly access class, so it is not included in iCloud Keychain and does not transfer to a new device via backup or migration. By default, iOS retains Keychain entries across app uninstall and reinstall on the same device, so reinstalling Trace may reuse the same UUID. To delete the UUID, see §9 (Your rights). |
3.3 Sent to our AI proxy when you use the AI chat
The app includes an optional AI chat feature ("Trace assistant"). When — and only when — you send a chat message, the following data is transmitted over HTTPS to a Cloudflare Worker we operate at https://trace-proxy.rg-f04.workers.dev:
HTTP request headers:
- A static application token (used only to authenticate that the request comes from our app).
- Your Device UUID (from §3.2, for rate limiting).
Request body:
- Your typed chat message.
- A "user context block" containing: today's date; your total photo count; days since your last photo; names and progress of your active challenges; names of your recent events (last 5); text of your recent photo notes (last 3, truncated to 2048 characters each); and the ID and timestamp of your latest and previous photos.
- The rolling AI conversation summary (see §3.1) so the assistant remembers prior chats.
- The last 8 messages of your current chat session.
- A list of available "tool" function definitions (so the AI can request actions like adding an event, opening a photo, etc.).
What is not automatically included:
- Your photos. Photo bytes are sent only when you explicitly attach one or more photos via the in-app chat picker, or tap Allow in the post-capture share prompt that appears after each new photo.
- Your name, email, phone, or any identifier other than the random Device UUID.
- Your device's hardware identifier, iOS advertising ID (we do not use IDFA), or any iOS-level analytics.
When you do attach a photo, the photo's image bytes (base64-encoded JPEG) are included in that message's payload, transmitted to our Cloudflare Worker, and forwarded to the third-party AI provider (see §4). Each such share is recorded in an on-device audit log (Settings → "Photos shared with AI"), with the photo ID, the timestamp, and the chat caption (if any) you sent with the photo. You can review this log at any time. There is a hard daily cap of 10 photo shares per device, enforced by the proxy.
3.4 What our Cloudflare Worker stores
Our Worker (the relay between the app and the AI provider) stores the following:
| Data | Purpose | How long |
|---|---|---|
A per-device counter (key: rl:<DeviceUUID>:<endpoint>:<date>, value: integer) |
Daily rate limiting | 24 hours (auto-expires at UTC midnight) |
The Worker does not store the contents of your messages, your photos, or the AI's responses. Message bodies are streamed through the Worker to the AI provider and the responses are streamed back; neither is logged or written to durable storage by us.
Cloudflare, as the platform operator of the Worker runtime, retains standard request-level logs (source IP address, timestamp, request size, response status) under their own privacy practices. See https://www.cloudflare.com/privacypolicy/.
3.5 Apple iCloud Backup
If you have iCloud Backup enabled on your iPhone (Settings → [your name] → iCloud → iCloud Backup), Apple includes the Trace app's local data — photos, SwiftData store, and UserDefaults — in your standard device backup. We deliberately do not exclude Trace from iCloud Backup, because:
- The app is designed for long-term tracking (months and years of face photos). Losing that history when you change to a new iPhone would be a poor user experience.
- iCloud Backup is operated by Apple, governed by your Apple ID privacy settings, and encrypted in transit and at rest under Apple's terms.
- We have no access to your iCloud Backup. Apple does not share Trace's backup contents with us.
If you do not want Trace's data to be included in iCloud Backup, you can disable backups for the app in Settings → [your name] → iCloud → Manage Account Storage → Backups → [your device] → toggle Trace off. Apple's iCloud Privacy notice describes how this data is handled on Apple's side: https://www.apple.com/legal/privacy/.
We do not operate any other backup, sync, or cloud-storage system. There is no CloudKit, no developer-controlled iCloud sync, and no third-party backup service in the app.
4. Third-party services in the AI chat path
When you use the AI chat, your message and any attached photos travel through these services in this order:
- The Trace iOS app on your device (Celetum).
- Our Cloudflare Worker (relay; see §3.4).
- OpenRouter (https://openrouter.ai/) — an AI routing service that selects an available model. OpenRouter's privacy policy applies: https://openrouter.ai/privacy.
- Anthropic (Claude models) or OpenAI (GPT models) — the AI provider that actually processes the message and generates the response. Each provider's privacy policy and data-use terms apply:
Anthropic and OpenAI may retain message content for their own purposes (e.g., abuse monitoring) per their respective policies. Neither has access to your Device UUID — only the message payload.
We have no control over the data practices of these third parties beyond our choice to use them. If you do not want any data sent to these services, do not use the AI chat feature. All other features of the app — photo capture, comparison, challenges, events, notes, timeline, settings — work entirely on-device and do not contact any server.
5. Biometric and special-category data
Face photographs are biometric data under GDPR Article 9 ("special categories of personal data"). Because such data is generated and stored on your device by default, no Article 9 processing takes place outside your device unless you explicitly share a photo with the AI chat.
When you share a photo, the legal basis for that processing is your explicit consent (GDPR Art. 9(2)(a)), given per share — either through the in-app per-message attach action, or by tapping Allow in the post-capture share prompt. You can withdraw consent for future shares at any time by not attaching photos and tapping "Not now" in the share prompt. Consent already given for past shares cannot be retroactively withdrawn from the third-party AI providers (see §4).
The app uses MediaPipe Face Landmarker (via the SwiftTasksVision Swift package) — a 3.6 MB model bundled with the app — to align your face photo to a canonical 1024×1280 frame. This model runs entirely on your device and does not transmit any data to any server.
5.1 Face data (facial landmarks)
To help you take consistent photos, Trace detects a face in the live camera preview and derives facial landmark points (facial geometry) from your photo. This face data is used only on your device, for two purposes: to detect that a face is present and steady so the app can auto-capture, and to align each photo to the same 1024×1280 frame so photos taken on different days line up for comparison.
These landmarks are processed in memory and are never saved — they are discarded immediately after the photo is aligned, and are never written to a file or database. Trace does not use face data to identify or authenticate you, does not create a facial-recognition template or profile, does not use it for advertising, and never transmits or shares it with any server or third party.
The only thing Trace stores is your photograph itself — the original and the aligned image — in the app's private, sandboxed on-device storage. Photos are retained until you delete them or uninstall the app; deleting a photo removes both the original and aligned image from your device. On-device face detection uses Apple's Vision framework; the landmark and alignment step uses the bundled MediaPipe Face Landmarker model. Both run entirely on your device.
6. Lawful bases for processing (GDPR Art. 6)
| Processing activity | Lawful basis |
|---|---|
| Storing photos and metadata on your device | Necessary to provide the service you requested (Art. 6(1)(b)) |
| Sending chat messages and context metadata to our AI proxy | Necessary to provide the AI chat service you initiated (Art. 6(1)(b)) |
| Sending photo image bytes to the AI proxy | Your explicit consent, given per share (Art. 6(1)(a) + Art. 9(2)(a)) |
| Storing a Device UUID for rate limiting | Our legitimate interest in preventing abuse and excessive cost on the AI proxy (Art. 6(1)(f)) |
| Sending notifications | Your consent at the iOS permission prompt (Art. 6(1)(a)) |
7. We do not do these things
- We do not collect your name, email address, phone number, or any account credentials. There is no sign-up.
- We do not use Apple's IDFA or any advertising identifier.
- We do not access the iOS Photos library. The in-app photo picker only shows photos you have taken with Trace's own camera (stored in the app's sandbox). We do not request or use the
NSPhotoLibraryUsageDescriptionpermission. - We do not use third-party analytics (no Firebase, Mixpanel, Amplitude, Segment, AppsFlyer, Crashlytics, Sentry, PostHog, or similar).
- We do not use third-party crash reporters.
- We do not run our own backup, sync, or cloud-storage service. (Apple's iCloud Backup, if enabled by you, is a separate Apple feature — see §3.5.)
- We do not sell, rent, license, or share your data with marketers, data brokers, or advertising networks.
- We do not use your photos or chat content to train any AI model owned by us. Whether the third-party AI providers in §4 use it for their own purposes is governed by their respective policies.
- We do not track your behavior across other apps or websites.
8. Children's privacy
The app is not intended for users under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has used the app, please contact us at the address in §10 and we will assist you in deleting any associated on-device data.
For users in the European Economic Area aged 13 to 16, applicable national law may require parental consent for the processing of personal data. Where required, you must obtain such consent before using the app. (In Latvia, the digital consent age under GDPR Article 8 is 13.)
9. Your rights
Under the GDPR and Latvian data protection law, you have the following rights with respect to personal data processed by Celetum:
- Right of access — to know what personal data we hold about you. Because the app stores almost everything on your device, the answer in nearly all cases is: whatever is currently visible in the app.
- Right to rectification — to correct inaccurate data. You can edit notes, events, and challenges directly in the app.
- Right to erasure ("right to be forgotten") — you can delete individual photos and other records in the app, or use Settings → "Delete All Data" to erase everything stored locally — photos, challenges, events, chat history, and the anonymous Device UUID. Uninstalling the app alone does not remove the Device UUID from your iOS Keychain (see §3.2), so for a complete erasure use "Delete All Data" before uninstalling. For data held by our Cloudflare Worker (the rate-limit counter, see §3.4), it auto-expires after 24 hours and we have no manual deletion mechanism beyond that. For data included in your iCloud Backup, see §3.5 — Apple controls deletion of backup data per your Apple ID settings.
- Right to restriction of processing.
- Right to data portability — your metadata can be exported on request.
- Right to object to processing based on legitimate interest.
- Right to withdraw consent for future AI photo shares — simply stop attaching photos. (Past shares cannot be retroactively unsent.)
- Right to lodge a complaint with the Latvian Datu valsts inspekcija (https://www.dvi.gov.lv/) or your local data protection authority.
For data held by Anthropic, OpenAI, OpenRouter, Cloudflare, or Apple, please consult their respective privacy policies for how to exercise rights with respect to those parties.
To exercise any of these rights, contact us at the address in §10.
10. Contact
For privacy-related questions, requests, or complaints:
Email: in@digicomm.lv
Postal address: SIA Celetum Riņķa iela 52 Ventspils, LV-3601 Latvia
We will respond to verifiable requests within 30 days.
11. Security
- All network communication between the app and our Cloudflare Worker uses HTTPS/TLS.
- Device-level data is protected by iOS's standard sandboxing. The Device UUID stored in the iOS Keychain inherits the Keychain's access-control protection class.
- Our Worker authenticates app requests via a static application token. We do not log message content.
No system is perfectly secure. If you become aware of a vulnerability or breach, please report it to in@digicomm.lv.
12. International data transfers
Cloudflare, OpenRouter, Anthropic, and OpenAI are based in the United States. By using the AI chat feature, you understand and consent that your messages (and any photos you attach) will be transferred to and processed in the United States. Where we rely on standard contractual clauses or other GDPR transfer mechanisms, this is documented in our agreements with those providers.
iCloud Backup data (if you have it enabled) is processed by Apple under Apple's own privacy policy and international transfer arrangements; we are not a party to those.
13. Changes to this policy
We may update this policy as the app evolves. Material changes will be communicated through the app and reflected in the "Last updated" date at the top of this document. Continued use of the app after a material update constitutes acceptance of the revised policy. If you do not agree, you may uninstall the app.
14. Governing law
This Privacy Policy is governed by the laws of the Republic of Latvia and, where applicable, EU data protection law. Disputes shall be resolved by the competent courts of Latvia.
End of policy.