TraceShot Privacy Policy

Last updated: July 22, 2026

TraceShot is a Chrome extension that captures a region of the page you are viewing, embeds an invisible traceable ID into the saved image, and later lets you decode that image to recover the URL it came from. This policy explains what data TraceShot collects, why, and how it is handled.

What we collect

• Account information. When you sign in with Google, we receive your email address and basic Google profile information. We use this solely to create and authenticate your account.
• Screenshot metadata.When you capture a traceable screenshot, we store the page’s URL, title, origin (scheme and domain), a timestamp, and the generated screenshot ID that is embedded in the watermark, linked to your account. This mapping is what lets a decoded watermark resolve back to its source URL.

What we do not collect

• We never upload or store your screenshots. The captured image is saved locally to your device (and optionally copied to your clipboard). It never leaves your device.
• Decoding happens locally. Reading a watermark out of an image is done in your browser; we only receive the decoded ID in order to look up its URL.
• We do not collect page content, HTML, cookies, passwords, form inputs, or browsing history.
• We do not sell your data or use it for advertising.

How your data is stored and shared

Account and screenshot metadata are stored in a Supabase (PostgreSQL) database and served through infrastructure hosted on Vercel. Your authentication token is stored locally on your device in the extension’s chrome.storage.local and is cleared when you sign out.

We share data only with the service providers that operate TraceShot on our behalf — Google (sign-in), Supabase (database), and Vercel (hosting) — and only as needed to run the service. We do not share your data with any other third parties.

Extension permissions

TraceShot requests only the permissions it needs to capture the current page:

• activeTab / tabs / host access — to read the current tab’s URL and title and capture its visible content when you start a screenshot.
• scripting — to draw the region-selection overlay on the current page.
• downloads — to save the screenshot to your device.
• clipboardWrite — to copy the screenshot or a resolved link when you ask.
• storage — to keep you signed in between sessions.
• identity — to sign you in with Google.

Data retention and deletion

We retain your account and screenshot metadata until you request its deletion. To delete your account or any stored screenshot records, contact us at anshs+traceshot@umich.edu and we will remove it.

Children

TraceShot is not directed to children under 13, and we do not knowingly collect their data.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

Contact

Questions about this policy or your data? Email anshs+traceshot@umich.edu.

TraceShot is open source. You can review exactly what it does at github.com/anshah1/TraceShot.