1. Scope
This policy covers the TraceAna website and five products: the Debugger (Chrome extension and Windows app), GA4 Insights (report.traceana.com), Insight BI (bi.traceana.com), MMP (mmp.traceana.com) and VWatch (vwatch.traceana.com). TraceAna is not affiliated with Google or YouTube.
TraceAna Account (traceana.com/login) is the single sign-in for Insight BI, MMP and GA4 Insights. It stores your name, email, a hashed password if you set one, the Google or Microsoft account ID you sign in with, your two-factor secret (encrypted) and hashed backup codes, your company and role, and for security a record of sign-ins, devices (IP address and browser) and account changes. When you open a TraceAna app, the account shares only your name, email, profile picture and company with that app. Sessions and security records are kept while your account is active; sign-in and device records are pruned after about 12 months.
2. Debugger
It can display requests, headers, timing, analytics events and dataLayer activity for pages you choose. Sensitive values such as passwords or tokens may appear in what it shows. It uses browser permissions for network access and page scripting, and stores settings and rules locally. Captured data is processed locally and is not sent to analytics or advertising services by default.
3. GA4 Insights
When you sign in, we receive your email address, name, profile picture and OAuth tokens, never your Google password. It reads aggregated, report-level GA4 data, not individual visitor records or raw exports.
4. VWatch
When you sign in, we receive your email address, name, profile picture and OAuth tokens. With your permission VWatch reads your YouTube channel information, video metadata and YouTube Analytics reports so it can show them to you. It cannot upload, edit or delete content, post comments or change your channel.
5. Insight BI
You or your administrator connect databases or files. We store connection details encrypted, run the queries you or your dashboards define, and cache results briefly. Account data includes name, email and a hashed password. Access is limited by roles, sharing and row-level security rules set by your administrator. Embed links and scheduled emails are sent only where you configure them.
6. MMP
For apps you set up, MMP receives click, install and in-app event data sent through tracking links, the SDK or server-to-server calls. This can include device and advertising identifiers, IP address, user agent, campaign and partner parameters and event values. We process it on your behalf to attribute installs and report performance, and send postbacks to the partners you configure. You decide what to collect and are responsible for having a lawful basis and any required consent from your end users. Raw event data is kept for the period configured for your account and then deleted or aggregated.
7. Google permissions
We request only the access below, always read-only, and only in the product that needs it:
openid,email,profile: sign you in (TraceAna Account, GA4 Insights, VWatch).analytics.readonly: read your Google Analytics 4 reports (GA4 Insights).youtube.readonly: view your YouTube account and channel data (VWatch).yt-analytics.readonly: view YouTube Analytics reports for your channel (VWatch).
We do not request access to Gmail, Drive, Contacts or Calendar. You can remove access at any time at myaccount.google.com/permissions.
8. Limited Use
TraceAna’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google-derived data is used only to provide and improve user-facing features within the product. It is not used for advertising, not sold, not read by humans except with your consent, for security or to comply with law, and not used to train generalised AI or machine-learning models. YouTube data is also handled in line with the YouTube Terms of Service and Google Privacy Policy.
9. How we use data
To authenticate you, list the properties, channels or sources you can access, run reports and exports, answer “Ask TraceAna” questions, deliver scheduled emails and alerts, and keep the services secure. We do not use it for marketing or profiling.
10. Cookies and logs
We use essential session and security cookies only, with no advertising cookies or third-party trackers. Our hosting provider keeps standard server logs, typically for about 30 days.
11. Retention
Tokens and sessions last until you sign out, they expire, or access is revoked. GA4 and YouTube figures are cached for a short time (about 15 minutes) and not kept as a separate copy. BI account data and connections are kept while your account is active. Preferences and bookmarks may be stored in your browser. When you delete your account or ask us to, we delete your data within a reasonable period, except where the law requires us to keep it.
12. Sharing
We do not sell your data and do not share it with advertisers or data brokers. Data is disclosed only to Google (to make API requests you authorise), our hosting and email providers, ad-network partners you configure in MMP, an optional AI provider in limited cases, or where the law requires.
13. AI features
Most questions are handled by a server-side, rule-based parser. If an AI provider is configured, questions the parser cannot handle are sent to it, but only the question text and field names, not your Google data. The AI returns a query plan that is checked against an allow-list. No figures are generated by AI.
14. Security
We use HTTPS/TLS, Google OAuth 2.0 with PKCE and CSRF protection, Secure and HttpOnly cookies, hashed passwords, encrypted credentials and server-side token storage, and blocked access to credential files. No system is perfectly secure; to report a vulnerability, email [email protected].
15. Your rights
You can revoke Google access, sign out, clear browser data, or email us to access, correct or delete your data. Further rights may apply under laws such as the GDPR or India’s DPDP Act. If you are an end user of an app that uses MMP, contact that app’s publisher first.
16. What we don’t do
- Sell your data.
- Use Google or YouTube data for advertising.
- Add remote scripts or third-party trackers.
- Request permissions we don’t need.
17. Children
TraceAna is not directed at children, and we do not knowingly collect data from anyone under 16.
18. Changes
If we make material changes we will update the date above and may announce them in the product. Continued use means you accept the updated policy.
19. Contact
Privacy, security and general questions: [email protected].