Privacy Policy

Account information. When you create an account, we (through our authentication provider, Supabase) collect your email address and a securely hashed password — we never see or store your password in plain text. If you sign in with Google or GitHub instead, we receive the email address and basic profile information those providers share with us. You may optionally add a username and a profile picture.

Content you provide. EngTrace is built to store the engineering content you choose to put into it: projects, decision records (what was decided, why, and any calculations), and files you upload — datasheets (PDF) and source code files. This content is yours; we store it so the product can function, not to make use of it ourselves.

What we don’t collect. We do not use third-party advertising trackers, and we do not currently run any analytics tooling — the “analytics” storage option in your cookie preferences exists ahead of any such tooling being wired up, and is not doing anything yet even if enabled. If that changes, this policy will be updated first.

• To create and secure your account, and let you sign in.
• To operate the core product: storing, displaying, and letting you edit and export your projects, decisions, and uploaded files.
• To respond to you when you contact us for support.
• To detect, prevent, and investigate abuse, fraud, or violations of our terms.

EngTrace keeps you signed in using your browser’s local storage, not a traditional tracking cookie — this is “necessary” storage and can’t be turned off without also signing you out. Separately, we set one small first-party cookie to remember whether you last used light or dark mode; it stores only that preference, nothing identifying, and is “necessary” storage in the same sense. You can accept or reject an “analytics” storage category from the cookie banner or the “Cookie preferences” link in the footer at any time; as noted above, it currently gates nothing, since no analytics are wired up yet.

We don’t sell your information. We share it only with the service providers that run EngTrace itself:

• Supabase — our database, file storage, and authentication provider. All account and content data described above is stored with Supabase.
• Vercel — our hosting provider.
• Google / GitHub — only if you choose to sign in with one of those providers, in which case they act as your identity provider for that sign-in.

We may also disclose information if required by law, or to protect the rights, safety, or property of EngTrace or our users.

We retain your account and content for as long as your account is active. If you delete a project, decision, or file, it’s removed from our active database; associated storage objects are removed on the same request. If you’d like your account and all associated content permanently deleted, contact us (Section 11) and we’ll do so, other than what we’re required to retain for legal or accounting purposes.

• Access and correct your account information (profile picture, username, password) at any time from Account Settings.
• Manage cookie/storage preferences from the footer at any time.
• Request deletion or an export of your account and content by emailing privacy@engtrace.com.

Depending on where you live, you may have additional rights under laws like the GDPR or CCPA — including the right to object to or restrict certain processing. Contact us and we’ll do our best to help.

Your content is access-controlled at the database level, so it’s only readable by your own account. Passwords are hashed by Supabase Auth and never stored or logged in plain text by us. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard practices.

EngTrace is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has provided us with personal information, contact us and we’ll delete it.

Our service providers (Section 4) operate infrastructure in the United States and other countries, so your information may be processed outside the country you live in. Where required, we rely on those providers’ own safeguards for cross-border transfers.

If we make material changes to this policy, we’ll update the effective date above and, for significant changes, make a reasonable effort to notify you directly (for example, by email or an in-app notice).

Questions about this policy, or requests regarding your data? Email us at privacy@engtrace.com.