Skip to content
trace·warrior
legal

Privacy Policy

This policy explains what personal data Trace Warrior collects, why we use it, who receives it, how long we keep it, and what rights you have. We don't sell your data, ever.

Who we are

Trace Warrior, operated from the United Kingdom, decides how and why personal data is used for the service described here, which makes us the data controller. For anything in this policy, email support@tracewarrior.com.

What we collect

  • Account info. Email address, display name, profile picture URL, and your account ID at the sign-in provider, which we receive when you sign up with Google or GitHub (GitHub also sends your username). We also record when the account was created and when you last signed in. We hold no password for you, because sign-in goes through the provider. If you sign in with Google, see the dedicated Google user data section below for exactly what we receive and how it is handled.
  • Sign-in records. Our authentication provider, Supabase, records the IP address and browser (user agent) of each sign-in session, and keeps a security log of sign-in events that can include your email address. These protect your account and help us investigate misuse.
  • Profile image. If you upload an avatar, we store the image in file storage at Supabase. The file is public: anyone with its link can view it. If you don't upload one, the site shows the picture from your Google or GitHub profile, which your browser loads directly from that provider.
  • Tool usage. When you're signed in, we log each run of a network tool (which tool, and when) for the usage history shown in your dashboard. That log does not include the inputs you submit or the results returned. Tools that work entirely in your browser, such as the JWT decoder and the email header analyzer, never send what you enter to us.
  • Tool and monitor targets. To run a check, we send the hostname, URL, or IP address you enter to the system that performs it. For most tools, and for ping and WHOIS monitors, that is our network probe, a server we run on DigitalOcean in London. HTTP, SSL, and port monitors run from our server functions at Vercel, and DNS monitors query public resolvers (Cloudflare, Google, or Quad9). Checks that connect to a host contact the target you name, and some lookups also reach the public lookup services listed further down.
  • Rate limiting. To stop abuse, we keep a short-lived count of tool requests per IP address for visitors who aren't signed in, and per account for those who are. It is held in server memory only, never written to our database, and resets every minute.
  • Monitor configuration. When you create a monitor, we store its name, the target hostname / port / URL you specified, the check schedule, and the alert channels you configured (your email address, already on the account, plus any webhook URL you provided and a per-monitor HMAC secret we generate to sign payloads).
  • Monitor check history. Each scheduled check writes one row: timestamp, observed state, the raw result (DNS records, cert metadata, port status, HTTP status code) and the duration. This data is what powers your sparkline and the public status page when you enable it. History is retained per plan (3 days on Free, 14 on Starter, 30 on Professional, 90 on Enterprise) and pruned daily by an automated job.
  • Alert delivery audit. When an alert fires we record which channel was attempted (email address or webhook URL), whether it delivered successfully, and the error message if it didn't. Same retention window as check history.
  • API keys. If your plan includes API access, we store each key's name, its first 12 characters, a SHA-256 hash of it, and when it was created, last used, and revoked. We never store the full key.
  • Billing. If you start a checkout or subscribe, Stripe handles your card and we never see the card number. We store your Stripe customer and subscription IDs, your plan, subscription status, billing period dates, trial end date, whether it is set to cancel, the amount, billing interval, and Stripe price ID.
  • Analytics. We count page views and tool runs with Vercel Web Analytics, which sets no cookies. Vercel derives a hash from each incoming request to estimate unique visitors and discards it after 24 hours. It stores the page URL without its query string (we keep only utm_ campaign tags), the referrer, coarse location, operating system, browser, and device type. When a network tool runs, our server also sends Vercel an event naming the tool. That event passes on your IP address, your browser's user agent, and the cookies your browser sent with the request, which include the sign-in cookie if you are signed in. Vercel already handles all of these as our host. The event's URL can include the query string of the page you ran the tool from, which can contain the host or IP address you looked up. Vercel's documentation describes query parameters as filtered, but we can't change that URL or confirm the filtering ourselves.
  • Contact form. If you message us through the contact page, we receive your name, email address, subject, and message. They are delivered to our mailbox by email through Resend, with a confirmation copy to you. The form does not save them in our database.
  • Spam protection. Contact form messages pass through automated filtering. Google reCAPTCHA v3 loads once you start using the form on /contact, sends information about your browser, your device, and how you interact with the page to Google, and returns a score for how likely the message is to be automated. Google acts as our processor for this. We also run our own checks: a hidden field, the time taken to fill the form, and whether the text looks random. If the score is low, the message isn't sent, and the form tells you so and gives you our email address. Some of the other checks stop a message while the form still shows it as sent, so if your confirmation copy never arrives, please email us. When we block a message we log the reason and the email domain, not the full address.
  • Hosting and server logs. Vercel, which hosts the site, keeps request logs, which can include IP address, page address with any query string, time, and browser. A link to a tool can hold a lookup target in its address, so that target can appear in these logs. Our own server logs can also hold an account ID when something fails, and the top-level domain (such as .dev) of a WHOIS lookup that used our RDAP fallback.
  • Emails with us. We keep what you email us and what we send back. When an account is created or deleted, we also get a notification email with the name, email address, and account ID, plus the sign-in provider or the plan.
  • Older records. Our database still holds some records from an earlier version of the site: email sign-ups from November 2025 (email address, name, IP address, browser, the page and campaign they came from), contact form messages from March to November 2025 (name, email address, subject, message), and a few old order rows tied to an account ID. We don't use them for anything, and nothing on the site reads them or adds to them now.

Why we use it, and our lawful basis

Data protection law requires a lawful basis for each use of personal data. We rely on these, depending on the purpose:

  • Contract. To create and run your account, sign you in, run the tools and monitors you ask for, send alerts and service email, publish the status pages you turn on, and manage your plan, trial, and billing, as set out in our Terms of Service.
  • Legitimate interests: security and abuse prevention. Rate limiting, sign-in records, and request logs. Our interest, and yours, is keeping accounts safe and the service available.
  • Legitimate interests: spam filtering. reCAPTCHA and our own checks on the contact form. Our interest is keeping the form usable for people rather than bots.
  • Legitimate interests: aggregate analytics. Counting page views and tool runs. Our interest is understanding what gets used so we can improve the site.
  • Legitimate interests: answering people and running the service. Replying to messages you send us, and the notification emails we receive when an account is created or deleted. Our interest is being able to respond to people and keep track of our accounts.
  • Legal obligation. Keeping tax and accounting records, and answering lawful requests from authorities.

We don't rely on consent for any of this. You can use the free tools without an account, giving only what you type into them. Data for an account or a paid plan is needed for the contract: an account needs the email address and sign-in details from your provider, and a paid plan needs your payment details at Stripe. Without them we can't provide the account or plan. The contact form needs your name, email address, subject, and message so we can reply, and you can email us instead. No law requires you to give us any of this.

We don't make decisions by solely automated means that have legal or similarly significant effects on you. The spam filtering above is automated, but it only affects whether a contact form message is delivered, and you can always email us directly.

Who processes your data

We use these providers to run the service. They act on our instructions under their data processing terms, except where this list says otherwise:

  • Supabase. Authentication, our database (accounts, monitors, check history), and avatar file storage. The database is hosted in London.
  • Cloudflare. The network gateway Supabase uses in front of its service, on api.tracewarrior.com. It carries sign-in and account traffic.
  • Vercel. Hosts the website and its server functions, keeps request logs, and provides our cookieless page analytics.
  • Stripe. Payments and subscriptions. It receives your email address and account ID when you start a checkout, and your card details directly from you. Stripe is also an independent controller of some payment data, under its own privacy policy.
  • Resend. Delivers service email (alerts, account messages) and contact-form messages.
  • Microsoft 365. Hosts our mailbox, which receives contact-form messages, replies to our emails, and new-account and deleted-account notifications.
  • DigitalOcean. Hosts our network probe, which receives the hostnames and IP addresses you test with the tools and monitors.
  • Google. reCAPTCHA v3 on the contact form, as our processor under Google Cloud's data processing terms: Google commits to using this data only to provide, maintain, and secure the service. Separately, if you choose Google sign-in, Google acts for itself in signing you in with your own Google account, as described below.
  • GitHub. If you choose GitHub sign-in, GitHub acts for itself in signing you in with your own GitHub account, and tells us your name, username, email address, avatar URL, and GitHub account ID.

Public lookup services. Running a lookup sends what you typed to the public services that hold the answer. They see a request from our servers, not from you, but if you enter your own IP address or a personal domain, that is what they receive. They are independent of us and handle queries under their own terms:

  • DNS resolvers (Cloudflare, Google, Quad9, OpenDNS, or the default resolver of our probe's server, whichever you choose) and the name servers for the domain you look up.
  • WHOIS and RDAP servers run by IANA, domain registries, domain registrars, and regional internet registries.
  • DNS blocklist operators, such as Spamhaus and SpamCop, for the blacklist check.
  • Team Cymru, for IP-to-network lookups.
  • ipinfo.io, only from the DNS monitor, only for the IP addresses a monitored hostname resolves to, and only when Team Cymru gives no answer.
  • macvendors.com, only from the MAC address lookup, only for the manufacturer prefix, and only when our own data has no match.

IP location comes from a database stored with the site, so that part of a lookup sends nothing to the database's supplier. We may also disclose personal data where the law requires it.

International transfers

Our database and our network probe are in London. Several of the providers above are based in the United States or elsewhere outside the UK, or use staff or subprocessors there, so personal data can be handled outside the UK. Where that happens, the transfer relies on UK adequacy regulations, the UK-US data bridge for US organisations certified to it, or the ICO's International Data Transfer Agreement or Addendum, depending on the provider and country and under that provider's data processing terms. Email support@tracewarrior.com for more detail or a copy of the safeguards.

Google user data

If you choose to sign in with Google, we use Google OAuth to authenticate you. This section explains exactly what we receive from Google and what happens to it.

  • What we access. Only your basic profile through the non-sensitive OAuth scopes (openid, email, profile): your name, email address, profile picture URL, and Google account identifier. We never request access to Gmail, Drive, Calendar, Contacts, or any other Google service or content.
  • How we use it. Solely to create and sign you into your Trace Warrior account, to show your name and picture on the site, to send service email (alert notifications, trial reminders, account messages) to your address, to notify us when an account is created or deleted, and to pass your email address to Stripe if you start a checkout. We do not use Google user data for advertising, and we do not use it to train artificial intelligence or machine learning models.
  • How we store it. Your profile data is stored in our authentication database, hosted on Supabase (PostgreSQL), encrypted in transit (TLS) and at rest. A copy of your name and email address also sits in the sign-in cookie in your own browser, which is not encrypted: see the Cookie Policy.
  • How we share it. We never sell Google user data and never share it for advertising. It is handled only by the providers that operate the service: Supabase and Cloudflare (authentication and database), Vercel (our server functions handle it when you use the service), Resend (delivers service email to your address, and notification emails to us), Microsoft 365 (our mailbox, which receives those notifications), and Stripe (receives your email address if you start a checkout or subscribe, for billing). No advertisers, no data brokers.
  • Retention and deletion. We keep this data while your account exists. Deleting your account removes it from our authentication and application databases, and the section on deleting your account below lists the records that stay outside them. You can also revoke Trace Warrior's access at any time in your Google Account security settings (myaccount.google.com/permissions), or email support@tracewarrior.com and we will delete it for you.

Trace Warrior's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Public status pages

When you toggle a monitor to public, anyone with the URL can see the monitor's name, target, current state, 24-hour uptime percentage, and the last 24 hours of check history. Nothing about your account, billing, or other monitors is exposed. Toggle the monitor back to private to remove it from the public URL.

Webhook deliveries

When you provide a webhook URL we POST to it on alert events. Slack and Discord URLs receive their native message format; any other endpoint receives a JSON payload signed with HMAC. The payload contains the monitor name, target, current and previous state, and the check result. We retry once on 5xx or timeout. We don't store the response body from your webhook endpoint, only whether the request succeeded and any error message.

What we don't

  • Sell or rent your data.
  • Store your on-demand tool inputs or outputs in our database.
  • Track you across third-party sites.
  • Send you marketing email.
  • Share your monitor configuration or check history, except with the providers above and where you publish a status page or set up a webhook.

How long we keep it

  • Account data. Your email address, name, sign-in provider details, profile, and plan record stay until you delete your account.
  • Sign-in records. Session records (IP address and browser) last as long as the session and go when you delete your account. The security log is covered in the next section.
  • Monitors. Configuration stays until you delete the monitor or your account. Check history and alert records follow your plan: 3 days on Free, 14 on Starter, 30 on Professional, 90 on Enterprise.
  • Tool usage and API keys. Kept for the life of your account. Revoking an API key marks it as revoked rather than removing its record.
  • Stripe records. Customer, subscription, and invoice records are kept at Stripe for as long as tax and accounting law requires.
  • Contact messages and other email. Kept in our mailbox for as long as we need them to deal with your request and any follow-up. Resend keeps its delivery records under its own retention settings.
  • Logs. Kept for the period set by our hosting provider, Vercel.
  • Analytics. The request hash is discarded after 24 hours. The totals stay in our Vercel dashboard for as long as Vercel's service keeps them.
  • Older records. Kept only until we finish reviewing them, and then deleted. There is no fixed date yet. You can ask us to delete yours at any time.

Deleting your account

You can delete your account from your dashboard profile page. Any live subscription is cancelled first, so you are not billed again. This is what goes:

  • Your sign-in account, its linked provider details, and its session records.
  • Your profile and uploaded profile images. If removing a file fails, the failure is logged so we can clear it by hand.
  • Your plan and subscription record in our database.
  • Your monitors, their check history, alert records, and status pages.
  • Your API keys and tool usage history.

This is what stays:

  • Your Stripe customer record and billing records, if you ever started a checkout. We do not delete these from Stripe.
  • Entries in Supabase's sign-in security log, which can include your email address, until they are purged. No automatic purge runs today.
  • Emails between us, the new-account and deleted-account notifications in our mailbox, and Resend's delivery records.
  • Request logs at Vercel, until they expire, and any database backups at Supabase, until they age out.
  • Any of the older records described above that are yours. Deleting your account doesn't reach them, so ask us and we will delete them.

Your rights

You have these rights under the UK GDPR. Using them is free. Where this list doesn't give a dashboard route, email support@tracewarrior.com. We reply within one month and may ask you to confirm it's you.

  • Access. Download a JSON export of your account data from your dashboard profile page. It holds your most recent 5,000 monitor checks, 1,000 alerts, and 5,000 tool runs, and lists what is kept elsewhere. You can ask us for anything older and for a copy of any of that.
  • Correction. Change your display name and profile image in your dashboard profile page. To change your email address, email us: it comes from your sign-in provider, so we change it on request.
  • Erasure. Delete your account from your dashboard profile page, or ask us to. You can also ask us to erase the records that stay after deletion, and we will unless we need to keep them, for example for tax.
  • Restriction. Ask us to pause our use of your data while a concern is looked into.
  • Portability. The same JSON export gives you the data you provided under our contract in a reusable format.

If you are in the EU, the EU GDPR gives you similar rights, and you can also complain to your local data protection authority.

Your right to object

You can object at any time to any use of your data that we base on legitimate interests: security and abuse prevention, spam filtering, aggregate analytics, and the notification emails we receive. Email support@tracewarrior.com and tell us what you object to. We will stop unless we have compelling grounds that override your interests, or we need the data for a legal claim. Analytics can't single out one visitor, so the way to object to it is to block the script in your browser, as the Cookie Policy explains.

Complaints

If you are unhappy with how we have handled your data, please complain to us first at support@tracewarrior.com. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay.

You can also complain to the UK regulator, the Information Commission's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.

Last updated: 7 November 2026