Privacy Policy — Tracepoint

1. What this covers

This policy describes how Tracepoint ("Tracepoint", "we") handles information when you use the service at app.tracepointapp.com. Tracepoint is a field-documentation tool: organizations map numbered points on building images, field workers attach photos and notes, and clients view shared links and generated reports.

2. What we collect

Account information — your name, email address, and a hash of your password (we never store the password itself). If you sign in with Google, we receive your name, email and Google account identifier.

Content you create — organizations, projects, views, marker positions, labels, captions and notes, and every image you or your field workers upload.

Photo metadata — when a photo is uploaded we read its EXIF data, including capture time, camera make and model, and GPS coordinates when the camera recorded them. This is how photos are dated and attributed. Stored image files are kept byte-for-byte as uploaded; we do not strip or alter them.

Usage and diagnostics — IP address, browser user agent, and error reports, used for security, rate limiting and debugging.

3. How we use it

To run the service: authenticate you, store and serve your content, generate PDF reports and AI report drafts, send transactional email, process payments, and keep the service secure.

To improve the service, including training machine-learning models and training our team, as described in the Terms of Service. Organizations on a paid plan can turn this off in Settings → Organization → Content and model training; the free plan does not include that option.

4. Sharing and third parties

We do not sell your personal information. We use these providers to run the service:

DigitalOcean — application hosting, managed PostgreSQL database, and Spaces object storage for your images.
Stripe — subscription billing. Card details go directly to Stripe; we never see or store them.
Resend — transactional and report email delivery.
Sentry — error monitoring and diagnostics.
Anthropic — AI report drafting. Only text is sent: labels, captions, locations, dates and counts. Your photographs are never sent to the model; they are placed into the finished PDF by our own template.

We also disclose information where required by law, and to a successor if the business is acquired.

5. Shared links

Project share links are unguessable URLs that anyone holding them can open without signing in. Treat a share link as public: whoever you send it to can forward it. Downloads can be disabled per project by an administrator.

6. Storage, retention and deletion

Data is stored on managed infrastructure in the United States and encrypted in transit. We keep your content for as long as your account exists.

Deleting a project removes its records and deletes its images from our object storage. Deleting an organization removes its records from our database; images already written to object storage are removed on request — email support@tracepointapp.com and we will delete them.

Backups and error logs may retain copies for a limited period after deletion.

7. Your choices

You can access and correct your account information in Settings, opt out of nightly report emails per user, and request deletion of your data by emailing support@tracepointapp.com. Depending on where you live you may have additional rights over your personal information; contact us and we will honor them where applicable law requires.

8. Children

Tracepoint is a business tool and is not directed to anyone under 18.

9. Changes

If we change this policy we will update the date above. Material changes will also be sent to organization administrators by email.