Privacy Policy

This policy explains what personal data Trace collects, why, with whom it is shared, and what rights you can exercise. It is separate from the terms of use and remains accessible without signing in.

Data controller

The controller of your data is the publisher of Trace, Louison Ribouchon (louison.rib@gmail.com). You can contact this address for any question about your personal data or to exercise your rights.

Purposes

Your data is processed for the following purposes:

• recording and displaying your sessions, sets, loads, bodyweight, RPE and notes;
• computing and presenting your progress (volumes, records, trends);
• when you explicitly enable it, the MCP feature: connecting your own artificial-intelligence client, which can then read your training data and update your personal context note.

Legal basis

Processing relies on your consent. Because some data is health data (see below), the collection and processing of that data additionally relies on your explicit consent, which you give when you sign up and can withdraw at any time, directly in the app (Settings → Legal); withdrawing it deletes your account and all your data. Providing this data is optional: without it, the app cannot perform its tracking function.

Categories of data

Trace processes your e-mail address (for your account) and your training data. Among the latter, your bodyweight, height, RPE (rate of perceived exertion) and free-text notes are health data. Only record in the notes the information you consider necessary for your tracking.

Recipients

Your data is hosted and processed by our technical providers:

• Supabase — database, hosted in the European Union (Frankfurt region);
• Vercel — application hosting.

When you enable the MCP feature, the artificial-intelligence client you connect accesses your training data and can update your personal context note. Your e-mail address is not shared with it. No data is sold or shared for advertising purposes.

Transfers outside the European Union

Your Supabase database stays in the European Union. Vercel application hosting, however, may run some functions in the United States. This transfer is framed by appropriate safeguards: Vercel is certified under the EU–U.S. Data Privacy Framework and relies on standard contractual clauses.

Retention period

Your data is kept for as long as your account is active. You can delete your account and all your data yourself at any time from the app settings (Settings → Account → Delete my account). You can also request it by writing to louison.rib@gmail.com; your request is handled within one month.

Automated decision-making

Trace makes no automated decision producing legal effects or significantly affecting you. The analytics only inform you.

Your rights

You have the right to access, rectify, erase, restrict and port your data, as well as the right to object and the right to withdraw your consent at any time (without affecting processing already carried out). To exercise these rights, contact the publisher at the address above.

Complaint

If you consider that the processing of your data does not comply with the regulations, you can lodge a complaint with the CNIL, the French supervisory authority.

Data-protection contact point

Given the size of the service, no data protection officer is appointed. For any question about your data, the contact point is the publisher, at the address above.

Cookies and local storage

Trace uses only cookies and local storage strictly necessary to operate. No advertising tracker or third-party tracking tool is used.

Internal usage measurement is tied to your session and logged server-side; it installs no additional tracker on your device.