Privacy policy
What we store, why we store it, where it lives, and how to delete it. Written to be read, not skimmed past.
Last updated: September 24, 2026
Who we are
Trags is operated by Trags AS (org. nr. 937 877 978), Norway. We are the data controller for the personal data described in this policy.
What we store, and why
| Data | What it is | Why we store it | Legal basis |
|---|---|---|---|
| Account data | Your email address and, if you set one, a display name. Alongside these we keep operational records tied to your account: your plan tier and a usage counter (how many memories you have stored against your plan limit), internal account identifiers, and one-time flags that stop us from sending the same analytics event twice. | To create and operate your account, enforce plan limits, and contact you about it. | Contract (GDPR Art. 6(1)(b)) |
| Memories | The memory content you sync from Poppy or create in the dashboard, plus metadata (type, project, source, timestamps, relations) and search embeddings derived from the content. | To provide sync across devices, the dashboard, and hosted recall. | Contract |
| API keys | A SHA-256 hash and a short prefix of each key, with an optional label and usage timestamps. We never store the full key, so we cannot recover it for you. | To authenticate the Poppy CLI when it syncs. | Contract |
| Setup codes | Short-lived codes used to connect the CLI to your account. The minted key inside them is end-to-end encrypted to your device; expired codes are purged daily. | To complete CLI setup securely. | Contract |
| Analytics events | Product usage events from the web app and the Poppy CLI (page views, feature usage, latency, error classes, and memory metadata such as type and whether a project is set), and error reports from the web app (the error’s type, message, and stack trace). Events never carry a memory’s project name, from either the web app or the Poppy CLI. Events are tied to your internal account id, not your email. Never the content of your memories, and never your recall query strings. | To understand whether the product works and where it fails. | Legitimate interest (GDPR Art. 6(1)(f)) |
| Billing data | If you subscribe to Trags Pro, we store your plan tier, subscription status, billing period, and the Polar customer and subscription identifiers. Payment is processed by Polar, our merchant of record; we never receive or store your card details. | To provide and manage your paid subscription. | Contract (GDPR Art. 6(1)(b)) |
We do not sell personal data, we do not run third-party ad trackers, and we do not use your memories, the embeddings derived from them, or your usage data to train or evaluate models or benchmarks. This is true on every plan: whether you are on the free tier or Trags Pro, you are never training data, and there is no setting to switch off because there is nothing to opt out of.
Where your data lives (subprocessors)
Your account data and memories are stored and processed within the EU: memories live in Frankfurt, and both the API routes and the recall worker that touch memory content run in EU regions. Billing is the one exception: Polar, our payment processor, runs in the United States, as listed below.
| Provider | What they do | Region |
|---|---|---|
| Supabase | Database and authentication. This is where your account and memories live. | EU (Frankfurt, Germany) |
| Vercel | Hosts the web application. The API routes that handle your data run in the EU; static pages are served from a global edge network. | EU (Frankfurt) for API routes |
| Railway | Runs our recall worker. When you search, your query and a shortlist of candidate memory text are sent there for scoring. Memory content is also sent there shortly after it syncs, to compute the search embeddings described above. In both cases the worker processes the data transiently in memory and stores nothing. | EU (Amsterdam, Netherlands) |
| PostHog | Analytics, as described above. | EU (eu.posthog.com) |
| Polar | Payment processing for Trags Pro. Polar is our merchant of record: it hosts checkout, manages your subscription, and collects and remits any applicable sales tax or VAT. We receive only your subscription status, plan, and the Polar customer and subscription identifiers, never your card details. | United States (under EU Standard Contractual Clauses) |
Payments for Trags Pro are handled by Polar, our merchant of record (listed above). Card details are entered on Polar’s hosted checkout and never reach our servers; we store only your subscription status and the identifiers needed to keep your plan in sync.
Retention
- Account data and memories are kept while your account exists. What deleting a single memory removes, and what deleting your account removes, are spelled out below.
- Analytics events are stored in PostHog’s EU cloud and retained under PostHog’s platform retention. We do not yet enforce a shorter retention window of our own; when we adopt one, we will document it here. You can turn analytics off at any time from your account settings, and deleting your account removes your analytics person and its events.
- Expired setup and link codes are purged by a daily cleanup job.
- Subscription and billing records are kept while your subscription is active and afterwards for as long as Norwegian accounting law requires (five years).
- Deleting a single memory marks it as deleted and takes it out of your dashboard and out of recall results right away. We keep the record, text included, so the deletion syncs to your other devices. It is removed when you delete your account. If you ask us to erase a memory sooner, we wipe its text; only the deletion record stays, so the erasure reaches your other devices too.
- Deleting your account deletes the records themselves: your account data and every memory it owns, including the ones you had already deleted.
- Our database host keeps encrypted backups of the database for a seven day rolling window for disaster recovery. Once something is removed from the live database, any copy left in a backup goes when that backup ages out, within seven days at most.
Deleting your data
Both deletion paths are self-serve and available today:
- Individual memories. Delete any memory from the Memories page in the dashboard or via the API. This marks the memory as deleted and removes it from your dashboard and from recall results. What we keep after that, and how to have it erased sooner, is set out under Retention above.
- Your whole account. Delete your account from Settings in the dashboard. This is immediate and permanent: it removes your account, profile, all memories (including soft-deleted ones), API keys, and setup codes. If you have an active Trags Pro subscription, deleting your account also cancels it at Polar, and your analytics person and its events are deleted from PostHog.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data (memories are editable directly in the dashboard).
- Have your data erased (see the deletion paths above).
- Receive your data in a portable format. Your memories already live locally on your machine if you use Poppy, and you can request a full export from us.
- Restrict or object to processing based on legitimate interest.
- Complain to the Norwegian Data Protection Authority, Datatilsynet.
Analytics and telemetry
The web app sends product analytics to PostHog’s EU cloud. Analytics runs cookieless: we set no tracking cookies and store no analytics identifiers in your browser, so the site needs no cookie consent banner. Analytics is tied to your internal account id, not your email, and captures only explicit product events, page views, and error reports: automatic DOM capture and session recording are disabled, so what is on your screen (including memory content) is never collected. An error report is the error’s type, message, and stack trace (the code that failed, not the page around it), sent when the web app or one of its API routes fails, so we can fix failures you never got to tell us about. The Poppy CLI has its own telemetry, documented in full (every event and every property) on the Poppy telemetry page, including how to turn it off with one setting. Neither the web app nor the CLI ever sends the content of your memories to analytics. You can turn web analytics off at any time from your account settings; when you do, we stop collecting product analytics for your account, and any error report from your session is no longer tied to your account.
Changes to this policy
If we change this policy in a way that matters, we will update the date at the top and note the change here. We will not quietly weaken it.
September 24, 2026: analytics events no longer carry a memory’s project name. The analytics row now says so for both the web app and the Poppy CLI.
September 23, 2026: the analytics row now says which side sends project names: web app events do, Poppy CLI events never do. The EU storage sentence now names the one exception, billing through Polar in the United States.
September 22, 2026: the retention section now spells out what deleting a single memory keeps and what deleting your account removes. Nothing about what we store or who we share it with changed.
September 6, 2026: web analytics now includes error reports (type, message, stack trace) when the app or an API route fails. Still no page content; with analytics off, error reports are not tied to your account.
Contact
Privacy questions and requests: hello@trags.ai. Security reports: security@trags.ai.