The Retrace privacy commitment

Last updated 2026-09-06

Captured page content, your searches and your answers never leave your Mac. Everything Retrace does send is on one short, fixed list, and that list is below in full.

This is the load-bearing claim that separates Retrace from every other "AI for your browser." It is not marketing copy — it is a constraint we hold ourselves to in the code.

Retrace is made by Sauvrn AI Corporation, federally incorporated in Canada and operating from Toronto, Ontario. Sauvrn AI Corporation is the data controller for the personal information described here. This page is the commitment; the full privacy policy carries the complete detail on what we collect, who processes it, how long we keep it, and how to have it deleted.

What stays on your device

Your captured pages
How you read your captured pages — text you select or copy there (a short excerpt), how far you scrolled, and which page led to which (details below)
Your queries against that memory
The embeddings Retrace uses to search them — computed on your device by the search embedding model that runs in the Retrace desktop app. Item 4 below covers the one-time download of that model; once it is on your machine, nothing about a page leaves it to be embedded. No neural runtime ships in the browser extension at all.
Every Ask session, including the conversation history and every answer — generated by AI models running locally in the Retrace desktop app on your machine
Your reading timeline, Spaces, and settings

What crosses the network

The pages you read, the queries you type and the answers you receive never leave your Mac and are never received by Sauvrn. What does leave: sign-in through WorkOS (a browser window that carries the email you typed, then a token exchange), an account-bound licence check, the installer you download from sauvrn.ai, the desktop app's one-time download of its model files, three same-origin export fetches to your own Google session so canvas-rendered Docs, Sheets and Slides are capturable at all, a feedback post you initiate, and, during the alpha, one content-free usage row per day, tied to your account, always on, with the row's fields listed at docs.sauvrn.ai/privacy, plus a one-time note to us of that setting itself, which is one boolean and no events. Everything else fails the build.

A short, fixed list:

Authentication. When you sign in, the Sauvrn web app talks to our auth provider (WorkOS). When you sign in from inside the extension, the extension opens a sign-in window against that same provider (api.workos.com) and then exchanges a one-time sign-in code with our backend (api.sauvrn.ai) to activate your license. No browsing data is involved in either. Retrace is in a closed alpha, so sign-in is checked against a list of invited addresses: if yours is not on it, no account is created for you — and we record that refused attempt, including the address it used, in our own audit log.
License verification. Every six hours, the extension calls our backend (api.sauvrn.ai) to confirm your license is still active. The request contains your license token. It does not contain anything about what you've read or asked.
Installer download (extension, one time). The extension does nothing without the desktop app, so during setup it downloads that app's macOS installer once, over HTTPS, from the address we publish (sauvrn.ai/download/Retrace.dmg). That address redirects to the storage bucket we keep the file in, so the host your browser actually pulls the bytes from is storage.googleapis.com — a reviewer watching the Network tab will see that hop. The request carries no account identifier and nothing about what you've read or asked. The extension reads back the progress of that one transfer and nothing else: it never reads your download history.
Model download (desktop app, one time). When you set up the Retrace desktop app, it downloads the three AI models Retrace runs locally — the answering model, the search embedding model, and the answer-verification model — from our own CDN (models.sauvrn.ai), over HTTPS only. Every file is verified against a SHA-256 hash compiled into the app itself; a file that doesn't match is rejected and the download fails closed. The request carries no account identifier and nothing about what you've read or asked. After this one-time download, the models run entirely on your machine. The browser extension downloads no models at all.
Google Docs, Sheets, and Slides content capture. Google renders these documents onto a canvas, so the text isn't in the page DOM where Retrace can read it. To capture it anyway, the Retrace content script fetches the document's own export from Google — the same file File → Download fetches:
- on a Google Doc, docs.google.com/document/d/<doc id>/export?format=html — the doc body, as HTML;
- on a Google Sheet, docs.google.com/spreadsheets/d/<sheet id>/export?format=csv — the cell values of the sheet tab you're viewing, as CSV;
- on a Google Slides deck, docs.google.com/presentation/d/<deck id>/export?format=txt — the on-slide text, as plain text.
Each is a single GET to Google, sent with the Google session cookie your open tab is already sending; no new credential is created, and when Google redirects the download to its file host, the cookie is withheld on that leg. The only data Retrace puts in the request is the document's id (for a Sheet, also the numeric id of the sheet tab you're on) — taken from the page you are already viewing; nothing you authored leaves the tab's origin. This goes to Google, not to us, and only ever for a document you're signed in to and viewing. The returned text goes straight into your local on-device memory — it is never sent to Sauvrn servers. A reviewer watching the Network tab on one of these tabs will see this request.
Opt-in feedback. If you click "Send feedback" inside the extension and type a message, that message is sent to us and forwarded to our issue tracker (Linear), where it is filed as a ticket, and to our internal team channel (Slack), where it is posted as a notification so we can act on it and get back to you. We sanitize it before it lands in our system to scrub any tokens you may have pasted accidentally. The form also offers three optional diagnostics, each with its own checkbox: your extension version and build, your browser and OS, and the current site's host name — the host only, never the full address. All three are unchecked by default, you see the exact payload before you send, and nothing is attached unless you tick its box. The Linear ticket carries your account email, your message, and whichever of those diagnostics you attached; the Slack notification carries your account name and email, your message, and the extension version and build, browser and OS you attached — not the diagnostic blob. The in-product feedback form tells you this before you submit.
Usage counts — on during the alpha. While Retrace is in its alpha, the extension sends api.sauvrn.ai one row per day of counts, so we can see which features are working. Settings → Account shows the same list you are reading now; there is no switch during the alpha, and the alpha agreement says so. The daily row carries: which of the supported tools you clicked in the rail and how many times (tool names from our own fixed list — anything else is counted as "other", never named), how many times you switched between tabs, how many searches you ran and whether you narrowed them by time or by tool (a yes or no, never the range or the tool), how many searches ended with you opening a page, how many remembered pages you reopened and how many landed where they were meant to, how many Asks you asked and how many were answered or declined, how many pages were captured, how many spaces you used or created, whether you did anything in Retrace at all that day, those actions added into one total, how many errors happened by kind (network, storage, permission, other) and how many Find or Ask round trips failed, how long searches and Asks took as a coarse band (such as "100-500" milliseconds — the real timing is turned into a band on your device and never sent), and roughly how many pages you have remembered in total, as a range (such as "1k-10k"). Separately, once per install, which setup steps you reached and the first time you clicked a tool, switched, searched, or landed on a reopened page (each with a coarse elapsed bucket such as "1-5m"); and if Retrace crashes, which part of it and what it was doing — never the error text. Never page content, titles, URLs, queries, answers, the names you give spaces, or your theme and your other rail settings. Every field is a whole-number count, a yes or no, a calendar day, or a word from a fixed list; none has a free-text field, and our server refuses any row that does not match that shape. Every string value is scrubbed for URLs, email addresses, and secret-shaped strings on our server before anything is stored. These counts are not anonymous: the row is sent with your license token, so it is tied to your account — what it does not contain is anything about what you read, searched, or asked. Rows are kept for 90 days and then deleted; if you delete your account, the rows lose their link to you and are kept only as counts. The counts are rolled up on your device and sent once a day, so nothing about the time of day you did something leaves it. We also hold a per-user gate on our own servers that can stop a person's counts at the source. After the alpha, the switch returns and the counts go back to off by default. Once, when that setting changes, the extension also sends a one-time note to us of the setting itself — one boolean and no events.
Email delivery logs (on our servers, not from your device). Each time we send you one of the transactional emails in the Resend row below — the welcome email on first sign-up, a workspace invitation, a license-revocation notice — our backend writes one structured log line to Google Cloud Logging in our own Google Cloud project: a salted SHA-256 tag of your address (16 hex characters, never the address itself, which goes only to Resend), the subject, and the message id Resend returned, plus the error text if the send failed. It sits in our retention-bound log buckets and carries nothing about what you've read, searched, or asked.

That's the entire list. If you ever see network activity from Retrace that doesn't match the list above, that's a bug — please report it via the in-extension feedback form, or email support@sauvrn.ai.

What Retrace remembers about how you read

Retrace's memory is not just the pages — it also remembers how you moved through them. Concretely:

Text you select or copy on a captured page. Retrace stores the actual text as a short excerpt (up to about 1 KB per event). Excerpts go through the same scrubbing as captured page text: strings shaped like passwords, keys, or access tokens are replaced with a redaction marker, and an excerpt that still looks like it contains a secret is not stored at all. That scrubbing targets secrets, not ordinary personal text — the excerpt is your data, and it stays on your device like everything else. Text inside form fields, password boxes, and other editable areas is excluded at the point of capture: selecting or copying there records nothing. (ships with this release)
Reading signals. That you interacted with the page at all — a key press or a click marks the page as one you acted on, and Retrace keeps only that fact and the time it last happened, never which key you pressed or where you clicked. How far down a page you got and how long the page was actually in front of you; zoom changes; that you printed a page; where you paused or stopped a video or audio player; sections you expanded or collapsed. (attention time and the fact of interaction are recorded today; the rest ships with this release)
How pages connect. Which page opened which (recorded today), how you got there (typed, link, reload — ships with this release), and — when you copy on one captured page and later paste on another — a link between those two pages, computed on your machine by matching a one-way fingerprint of the copied text. The pasted text itself is not stored; only its fingerprint is compared. (ships with this release)
When a page changed while you had it open. On a page Retrace is remembering, it checks at most once every 30 seconds whether the page's content has changed — a live feed, a document someone else is editing, an inbox — and keeps a numbered entry of the time it changed alongside a one-way fingerprint of the content, never the text: what Retrace keeps is that the page changed and when, never what it said. Those entries stay on your device and nowhere else — in the extension's own storage and in the desktop app's database — and "Clear memory" removes them with everything else. Today they are the one part of this list that does not yet follow the retention rule below: in the desktop app they age out with the page, but in the browser they are bounded only by a fixed cap on how many are kept, and the oldest are dropped first. (recorded today)

All of it lands in the same local, on-device memory as your captured pages, and the page contents and event contents are encrypted at rest there. None of it crosses the network: the same build-time checks that block any code path from transmitting page content cover these events too.

The same controls govern all of it. Nothing enters your memory before you finish the consent step in setup. Pausing capture stops this too. Sites you've excluded and incognito windows are never captured, so there is nothing to record interactions against. Retention is keyed to the page, not the visit — all of this is kept as long as any version of that page is kept, so on a page you revisited, what you did before your retention window survives with the newer copy. And none of this reading capture asks for a new browser permission — but this version does ask for one more than earlier ones did: permission to save the backup file you export, encrypted with a passphrase you choose, into your Downloads folder. Chrome shows that as "Manage your downloads" when you install or update.

One honest caveat. Before your memory reaches the encrypted store in the desktop app, events wait in a small buffer inside your browser profile. The contents of each event are encrypted there, but its filing labels — which page it belongs to, and when — are readable by design; that is what lets the buffer be read efficiently. In practice: someone with your unlocked Mac and your browser profile could see which pages you interacted with and when from that buffer. The content of the events, and of the pages, stays encrypted. The page memory's own local index has always worked the same way — and for a page from a supported tool (a Google Doc, Sheet, Slides deck, or Gmail thread), its readable filing labels include the document's own id alongside the page's address: which document it is, never what it says. It is what our at-rest encryption is for: it protects your content from casual inspection of the files on disk — it is not a defense against someone who can run code on your machine.

Third-party processors

A handful of third-party services receive narrowly-scoped data when you do specific things in Sauvrn. None of them receive your browsing data, your captured pages, your queries, or anything Retrace has indexed.

Processor	Data sent	When (trigger)	How you're told
Stripe (US; GDPR DPA on file)	Billing email, organization name, and our internal `sauvrn_org_id` as checkout metadata	At checkout, subscription change, or invoice event. Billing receipts are sent by Stripe. Retrace is a paid product, but the free trial does not run through Stripe: until you go to checkout, no customer record is created with them at all.	You land on Stripe's hosted checkout page, which links to Stripe's privacy policy. We never see your full card number.
Resend (US)	Recipient email address, first/last name (if provided), and the body of the transactional email itself. If you type your address into the waitlist form on sauvrn.ai, that address is also stored with Resend as a mailing-list contact.	When we send a transactional email — a welcome email on first sign-up, workspace invitations, and license-revocation notices — and when you submit the waitlist form on this website	Implicit in the account email setting; you can request the list of transactional templates from privacy@sauvrn.ai. Resend's privacy policy.
Linear (US)	Your account email, the feedback message body you typed (verbatim, with emails + bearer tokens + high-entropy secret-shaped strings redacted before send), and a schema-bounded diagnostic JSON blob (allowlisted keys only — extension version and build, browser and OS, and the current site's host name, each attached only if you ticked its box — no free-text fields, same redaction pass on every string value)	When you submit the in-extension "Send feedback" form	The feedback form copy states that feedback is shared with our team via our issue tracker. Linear's privacy policy.
Slack (US)	Your account name and email, the same redacted feedback message body, and the build metadata you attached (extension version and build, browser, OS) — posted as one message to our internal team channel. The diagnostic JSON blob is not included.	Same trigger as the Linear row: when you submit the in-extension "Send feedback" form	Same in-product disclosure on the feedback form. Slack's privacy policy.

For the complete list of processors (including our cloud host, auth provider, and uptime monitor), see the full Sauvrn privacy policy.

Limited use

We use the data we collect only to provide and improve the Service and to fulfill the purposes described in this policy. We do not sell your data, do not use it for advertising, do not transfer it to data brokers, and do not use it to train AI models. Our use of data obtained through your Google account (for Google Docs, Sheets, and Slides content capture) complies with the Google API Services User Data Policy, including its Limited Use requirements; that content is fetched directly to your device and is never sent to Sauvrn servers.

Why we made this constraint

Sending browsing data to a server "for AI" is a one-way trip. Once your reading lands somewhere we host, it sits in logs, backups, and shared dashboards forever. Even with the best intentions, that data can leak. Retrace is built so the leak surface does not exist.

It also means we can never read your data ourselves, even if we wanted to. We made that trade on purpose.

Open questions we're still working on

Cross-device sync. Today, Retrace's memory is per-device. Syncing without breaking the privacy commitment is technically hard. We're working on it.
Workspace sharing. Sharing a specific page or answer with a colleague is not something Retrace does today. If it ships, that sharing will be opt-in, page-by-page and explicit — not bulk telemetry.

Audit it yourself

Retrace's source is closed, but the network behavior is auditable from any browser's developer tools. Watch the Network tab while you use Retrace. From the extension you'll see calls to api.sauvrn.ai (license verification every six hours, sign-in, the once-a-day usage-counts row described above, and — only if you send it — feedback); a sign-in window opened against our auth provider at api.workos.com when you sign in from the extension; a one-time fetch of the desktop-app installer during setup, which starts at sauvrn.ai and redirects to storage.googleapis.com; and, on a Google Docs, Sheets, or Slides tab, a credentialed export request back to docs.google.com (the content capture described above; the text it returns stays on your device). The desktop app fetches models.sauvrn.ai once, at setup, for the model download. Those are the hosts. If you see one that is not on that list, that is a bug and we want to hear about it — you'll see it before we do.