The Retrace privacy commitment

Last updated 2026-07-29

Retrace never phones home with your data.

This is the load-bearing claim that separates Retrace from every other "AI for your browser." It is not marketing copy — it is a constraint we hold ourselves to in the code.

What stays on your device

Your captured pages
Your queries against that memory
The embeddings Retrace uses to search them — computed on your device by an embedding model that runs in the Retrace desktop app. No neural runtime ships in the browser extension at all.
Every Ask session, including the conversation history and every answer — generated by AI models running locally in the Retrace desktop app on your machine
Your reading timeline, Spaces, and settings

What crosses the network

A short, fixed list:

Authentication. When you sign in, the Sauvrn web app talks to our auth provider (WorkOS). When you sign in from inside the extension, the extension exchanges a one-time sign-in code with our backend (api.sauvrn.ai) to activate your license. No browsing data is involved in either.
License verification. Every six hours, the extension calls our backend (api.sauvrn.ai) to confirm your license is still active. The request contains your license token. It does not contain anything about what you've read or asked.
Model download (desktop app, one time). When you set up the Retrace desktop app, it downloads the three AI models Retrace runs locally — the answering model, the search embedding model, and the answer-verification model — from our own CDN (models.sauvrn.ai), over HTTPS only. Every file is verified against a SHA-256 hash compiled into the app itself; a file that doesn't match is rejected and the download fails closed. The request carries no account identifier and nothing about what you've read or asked. After this one-time download, the models run entirely on your machine. The browser extension downloads no models at all.
Google Docs, Sheets, and Slides content capture. Google renders these documents onto a canvas, so the text isn't in the page DOM where Retrace can read it. To capture it anyway, the Retrace content script makes a single credentialed GET to Google (docs.google.com export endpoints) that reuses your existing Google session, exactly the way File → Download works. This goes to Google, not to us, and only fetches a document you're already signed in to and viewing. The returned text goes straight into your local on-device memory — it is never sent to Sauvrn servers. A reviewer watching the Network tab on one of these tabs will see this request.
Opt-in feedback. If you click "Send feedback" inside the extension and type a message, that message is sent to us and forwarded to our help-desk provider (HubSpot, or Linear as a fallback) so we can reply. We sanitize it before it lands in our system to scrub any tokens you may have pasted accidentally. The in-product feedback form tells you this before you submit.
Opt-in telemetry — off by default. If (and only if) you explicitly opt in, the extension sends content-free usage events (feature counters and timings — never page content, titles, URLs, queries, or answers) to api.sauvrn.ai so we can see which features are working. Consent is checked on your device before any request is constructed, and re-checked on our server. If you never opt in, nothing is ever sent.

That's the entire list. If you ever see network activity from Retrace that doesn't match the list above, that's a bug — please report it via the in-extension feedback form, or email support@sauvrn.ai.

Third-party processors

A handful of third-party services receive narrowly-scoped data when you do specific things in Sauvrn. None of them receive your browsing data, your captured pages, your queries, or anything Retrace has indexed.

Processor	Data sent	When (trigger)	How you're told
Stripe (US; GDPR DPA on file)	Billing email, organization name, and our internal `sauvrn_org_id` as checkout metadata	At checkout, subscription change, or invoice event (only if you're on a paid plan). Billing receipts are sent by Stripe.	You land on Stripe's hosted checkout page, which links to Stripe's privacy policy. We never see your full card number.
Resend (US)	Recipient email address, first/last name (if provided), and the body of the transactional email itself	When we send a transactional email — a welcome email on first sign-up, workspace invitations, and license-revocation notices	Implicit in the account email setting; you can request the list of transactional templates from privacy@sauvrn.ai. Resend's privacy policy.
HubSpot (US)	Your account email, the feedback message body you typed (verbatim, with emails + bearer tokens + high-entropy secret-shaped strings redacted before send), and a schema-bounded diagnostic JSON blob (allowlisted keys only, no free-text fields, same redaction pass on every string value)	When you submit the in-extension "Send feedback" form	The feedback form copy states that feedback is shared with our customer-success team via our help-desk provider. HubSpot's privacy policy.
Linear (US)	Same payload as the HubSpot row above — used only as a fallback if HubSpot is unreachable	Same trigger as HubSpot, only when HubSpot is unavailable	Same in-product disclosure on the feedback form. Linear's privacy policy.

For the complete list of processors (including our cloud host, auth provider, and uptime monitor), see the full Sauvrn privacy policy.

Limited use

We use the data we collect only to provide and improve the Service and to fulfill the purposes described in this policy. We do not sell your data, do not use it for advertising, do not transfer it to data brokers, and do not use it to train AI models. Our use of data obtained through your Google account (for Google Docs, Sheets, and Slides content capture) complies with the Google API Services User Data Policy, including its Limited Use requirements; that content is fetched directly to your device and is never sent to Sauvrn servers.

Why we made this constraint

Sending browsing data to a server "for AI" is a one-way trip. Once your reading lands somewhere we host, it sits in logs, backups, and shared dashboards forever. Even with the best intentions, that data can leak. Retrace is built so the leak surface does not exist.

It also means we can never read your data ourselves, even if we wanted to. We made that trade on purpose.

Open questions we're still working on

Cross-device sync. Today, Retrace's memory is per-device. Syncing without breaking the privacy commitment is technically hard. We're working on it.
Workspace sharing. Team plans will eventually let you opt in to sharing specific pages or answers with your team. That sharing will be page-by-page and explicit — not bulk telemetry.

Audit it yourself

Retrace's source is closed, but the network behavior is auditable from any browser's developer tools. Watch the Network tab while you use Retrace. From the extension you'll see calls to api.sauvrn.ai (license verification every six hours, sign-in, and — only if you triggered them — feedback and opt-in telemetry), and on a Google Docs, Sheets, or Slides tab, a credentialed export request back to docs.google.com (the content capture described above; the text it returns stays on your device). The desktop app fetches models.sauvrn.ai once, at setup, for the model download. That's it. If we ever break that, you'll see it before we do.