Privacy

Read-only by construction. We never score credit and never move funds.

This page is the short, plain-language version. The same three things that scare us about uploading bank history — losing a balance, misusing credentials, broadcasting a credit score — are the three things TRACE never does. The technical policy lives alongside this page; if anything below is unclear, ask us.

What we don't hold

No ledger. No custody. No score.

TRACE does not store a running balance separately from the rows. Aggregators connect read-only; we never see account credentials that could move funds. We never compute, transmit, or store a credit score of any kind.

What we do hold

Your rows, on your terms.

Your authorized accounts, your saved searches, your Case Files, your export history. Each is deletable per-row, and a deletion is deletion — not a setting buried three layers deep in a trial-conversion flow. An export carries the totals, the notes, and the row count you can re-derive yourself.

Data scoping

Your data is scoped to your account.

Every saved row, Case File, attachment, saved search, and import is keyed to your user. Nothing is shared across accounts — another TRACE account cannot see your authorized institutions, your running totals, or your Case Files. The one explicit opt-in is the share link at /case-files/share/[token]: a read-only export token you mint, with a date range and an expiry, that carries no credentials and lets the recipient see exactly what you chose to publish.

Revocation paths

Pull the plug at any time.

Deletion is per-row, not buried. Three paths, each on a different axis:

  • Disconnect an institution. From Settings, remove the read-only aggregator link on any account you no longer need. The link is severed before the rows are purged; TRACE stops pulling new history the moment the disconnect completes.
  • Delete a Case File. From Case Files, wipe a Case File end-to-end — the rows, the notes, the tags, and the export history attached to it — without touching the rest of your account.
  • End the account. For a full end-to-end account deletion, send a note through the Questions form at /contact. We confirm identity, run the row-by-row purge, and email you back when the wipe is complete.