Privacy policy
For the Trace: ADHD Diary & Tracker app and trace-adhd.com. Version 5, in force from October 27, 2026.
The short version
- Your diary is kept on your phone, in an encrypted database. Trace never sends it to us or to anyone else. We never see your diary.
- There's no account. Trace doesn't ask for your email address or phone number, and the name you give it is kept on your phone.
- Our payment provider keeps a record of your purchases under an anonymous ID your phone makes.
- If you use Together, share a report as a link, or ask someone who knew you for examples, Trace makes an anonymous ID on our server and keeps what you share there end-to-end encrypted: we store it, but we can't read it.
- Voice notes are turned into text on your phone. Your calendar and steps are read on your phone, and only a few numbers a day are kept, there.
- Usage stats and error reports are off unless you turn them on. Even then, they never include anything you wrote or logged.
- We don't sell your data, we don't use it for advertising, and Trace has no advertising ID.
Who we are
Trace ADHD Ltd makes Trace. It is a company registered in England and Wales, company number 17480983, with its registered office at 124 City Road, London, EC1V 2NX, and is registered with the UK's Information Commission (the ICO) under number C2051141.
We decide how the data this policy describes is used, which makes us its controller under UK data protection law. Write to us at hello@trace-adhd.com, or by post to the address above.
Trace is sold in the United Kingdom, the United States, Canada, Australia and New Zealand. This policy covers the app on iPhone and Android, and this website.
Your diary is kept on your phone
What you enter in Trace is stored by the app on your phone: the name you give it, how you rated each day, what you log, your medicines, doses and plans, notes and voice recordings, everyday examples, questions, dates, reminders, reports, monthly reviews, sleep and steps, and how busy your calendar was. Trace never sends any of it to us or to anyone else, so we can't see, share or lose it.
- Encrypted on your phone. The diary is kept in an encrypted database. Its key is made on your phone and never leaves it.
- Your phone's own backups. iCloud or Google backups of your phone may include the encrypted database, but not its key, so the copy can't be opened anywhere else, by Apple, Google, us, or on another phone.
- Moving to a new phone. Use a Trace backup file (Settings → Backup & export). It is encrypted with a passphrase you choose. We never see the passphrase and can't recover it.
- Exports and reports. A CSV or JSON export, a PDF report for an appointment, or a note for work or study, isn't encrypted. It leaves your phone only when you share or save it, and anyone with the file can read it.
- Apple Health and Health Connect. If you allow it, Trace reads your sleep and your daily step count, to show them next to your days. It reads only those, never writes anything, and keeps what it reads on your phone.
- Your calendar. If you turn on Calendar, Trace looks at the start and end times of events in the calendars you choose, and whether each is all-day or cancelled, and keeps two numbers for each day: how many events there were and how much of 7am to 10pm they took. It never keeps titles, people, places or notes, never changes your calendar, and keeps the numbers on your phone. Turning it off deletes them.
- Voice notes. When you record a brain dump, Trace turns it into text on your phone, with your phone's own speech recognition, set to run on the phone, or with a speech model you can choose to download (below). The recording is never sent to us, to Apple, to Google or to anyone else to be turned into text. Recordings are kept encrypted on your phone with their own key, for 30 days unless you choose otherwise in Settings, and aren't included in backup files; the text is part of your diary.
- Notifications are set up on your phone, not sent from a server. They're discreet by default, so the lock screen doesn't name your medicines unless you choose to.
- The home-screen widget shows your day count, whether you've logged your meds and rated today, and the day's color. Anyone who can see your home screen can see it.
- The dose timer, if you turn it on, shows on your lock screen how long it's been since your dose, without naming the medicine. Anyone who can see your lock screen can see it.
- Siri, Shortcuts, controls and tiles. Logging a dose this way happens on your phone.
- Public lists. Trace downloads some lists that are the same for everyone, like, in the US, the FDA's list of medicine shortages. It downloads each list whole, so the request never says which medicines you take; your phone compares them itself.
- App lock. If you turn it on, Face ID, Touch ID or your phone's fingerprint or passcode is confirmed on your phone. Trace never receives your biometrics.
- Deleting. Settings → Delete everything erases the diary, recordings, any downloaded speech model and the keys from your phone, and, if you used Together, invites or share links, deletes your anonymous ID and everything stored under it on our server. Uninstalling Trace erases the diary too, unless you made a backup file or export.
Because we never receive your diary, we don't hold it, and the rights in this policy don't reach it. It is yours, on your phone.
What leaves your phone, and why
| What | Why | Our basis under UK law | Who handles it |
|---|---|---|---|
| Requests for stories, articles and their pictures, which carry your phone's IP address | To show Trace's stories and articles. They come from our content service and are the same for everyone; the request says nothing about you or your diary | Our legitimate interest in delivering the app's content | Sanity |
| An anonymous ID made on your phone, your purchases and subscription status, the store's country, your phone's type and system version, the app's version, and your IP address | To unlock Premium when you subscribe, to restore it on another phone, and to keep the financial records the law requires | Our contract with you, and our legal duty to keep records | RevenueCat, which reads purchases from the App Store or Google Play |
| Only if you turn on Share anonymous usage stats: the events listed below, a random ID made on your phone, the app's version, your phone's model and system version, its language and its time zone | To see which parts of Trace are used, so we can improve them | Your explicit consent, because one event can say something about your health (below). You give it with the switch and can withdraw it with the switch at any time | PostHog, hosted in the EU |
| Only if you turn on the same switch: error reports — where in Trace's code something went wrong, recent screen and tap events with their details removed, your phone's model and system version, and the app's version | To find and fix errors | Your explicit consent, as above | Sentry |
| Only if you use Together: an anonymous ID; what you choose to share with one person (your day's color and word, whether you rated today, your energy, a note on how to help, an appointment coming up), encrypted on your phone with a key only your two phones hold; when you shared and how big it was; and, if you allow notifications, a push token (on Android, Google's Firebase also makes an installation ID to deliver them) | To pass what you share to the person you chose, and to tell their phone something changed. The notification itself carries nothing you shared | Our contract with you, to provide the feature you asked for | Supabase (our server), and Expo, Apple and Google (Firebase Cloud Messaging, on Android) for notifications |
| Only on Android, if you scan a Together invite's QR code: diagnostics from Google's ML Kit, which reads the code on your phone — your phone's make, model and system version, the app's version, how long reading took and any error codes, with an installation ID that isn't linked to you. The camera's picture never leaves your phone | So the camera can read the invite code. Google uses the diagnostics to keep ML Kit working | Our legitimate interest in a scanner that works | |
| Only if you ask someone who knew you for examples: an anonymous ID; the invite (your first name, theirs if you add it, how you know them, your note) and the examples they write, both encrypted with a key that is only in the link you send them and on your phone | So they can write examples on a web page with no app or account, and you can read them in Trace. We can't read either | Our contract with you, to provide the feature you asked for | Supabase (our server) |
| Only if you share a report as a link: an anonymous ID; the report, encrypted on your phone with a key that is only in the link you send; when you made it, when it expires, how big it is, and how many times it has been opened and when last | So the person you send the link to can open the report in a browser, until it expires or you stop it, and so you can see whether it has been opened. We can't read the report | Our contract with you, to provide the feature you asked for | Supabase (our server), and Cloudflare for the page that opens it |
| For whoever opens a shared link: their IP address and browser details, when they open the page | To show the page and the report, and to stop the link being misused | Our legitimate interest in keeping the page safe | Cloudflare, and Supabase |
| For the person you invited: their IP address and browser details, when they open the page and send examples | To confirm a person, not a program, is sending them, and to stop the page being misused | Our legitimate interest in keeping the page safe | Cloudflare (Turnstile), and Supabase |
| Requests for the public lists above, which carry your phone's IP address | To show current shortage notices in the US | Our legitimate interest in delivering the app's content | Cloudflare |
| Only if you choose to download the speech model: the download request, which carries your phone's IP address | To fetch a speech model that turns voice notes into text on your phone. It's the same file for everyone, from a public library of models, and the request says nothing about you or your recordings | Our contract with you, to provide the feature you asked for | Hugging Face |
| What you write to us, and your email address | To answer you | Our legitimate interest in answering you, and your explicit consent for anything about your health you choose to tell us | Google (our mailbox) |
Never sent: anything you enter in your diary, your medicines, notes, voice recordings, ratings, logs, sleep, steps, calendar or reports, your contacts, your location, or an advertising ID. What you share with Together, a link or an invite is the exception you choose, and it is encrypted so that we can't read it. Trace doesn't track you across other apps or websites.
What our server can see when you use Together, a share link or an invite: that this phone uses them, when, how big each encrypted item is, and how many times a shared link has been opened. Never what's in them.
Your phone may also download its own speech recognition for your language from Apple or Google, as part of its system. Trace doesn't send anything with it.
The usage stats Trace can send
Only these, and only while the switch is on. Each is an event name with at most one detail, which is a count, the ID of a part of the app or the stage you chose, never something you wrote: the app opened; an onboarding step viewed (its ID); onboarding finished, with the stage you chose (waiting for an assessment, adjusting medication, settled on medication, or not taking medication); a day's rating saved; a log saved (how many things); one of Trace's charts opened or unlocked (its ID); a story or article viewed (its ID); a report made (its type); a monthly review viewed; a Year in Trace viewed (its type); a reminder turned on (its type); the widget added; the subscription screen viewed (where it was opened from); the dose timer turned on; something marked as having helped; a dose logged from outside the app (from where: Siri or Shortcuts, a Quick Settings tile or a watch); a medicine supply count set; a shortage notice shown; a Together invite made; a Together pairing made (which side you're on); a Together pairing ended; a hug sent; an invite for someone who knew you made; examples from them kept (how many); a report shared as a link (how many days it lasts); a shared link stopped; a voice note saved (which speech recognition made its text); a note for work or study made (which of the two); and Calendar or steps turned on (which). Your IP address is discarded when the events arrive.
Error reports
Trace removes the details of recent screen and tap events and drops anything the app wrote to its log before they can go into an error report. For errors in Trace's own code, it also replaces any long piece of text, which is where something you typed could be, with "[removed]" before the report leaves your phone. Reports carry no user ID, and your IP address is not stored.
This website
This website doesn't count visits, set cookies or load anything from other companies. Cloudflare, which hosts it, receives your IP address and browser details when you open a page, to send it to you and keep the site secure.
Who receives it
| Company | What for | Where |
|---|---|---|
| Sanity AS | Hosts and delivers Trace's stories and articles | Norway, with a worldwide delivery network |
| RevenueCat, Inc. | Handles purchases and subscription status | The US |
| PostHog, Inc. | Usage stats, only if you turn them on | Stored in the EU (Germany) |
| Functional Software, Inc. (Sentry) | Error reports, only if you turn them on | The US |
| Google LLC | Our mailbox (Google Workspace) | The US, and worldwide |
| Supabase, Inc. | Our server for Together, invites and share links: anonymous IDs and encrypted items we can't read | Stored in the EU (Germany) |
| 650 Industries, Inc. (Expo) | Sends Together notifications to Apple and Google, with nothing you shared in them | The US |
| Google LLC (Firebase Cloud Messaging) | Delivers Together notifications to Android phones, only if you turn them on | The US, and worldwide |
| Google LLC (ML Kit) | Reads a Together invite's QR code on Android phones; receives diagnostics about the scanner, never the picture | The US, and worldwide |
| Cloudflare, Inc. | Hosts this website, links.trace-adhd.com (the invite and shared-report pages) and its public lists, and Turnstile on the invite page | The US, and Cloudflare's worldwide network |
| Hugging Face, Inc. | Hosts the speech model, only if you choose to download it | The US, with a worldwide delivery network |
These companies handle your data only on our instructions, under contracts that limit what they may do with it. Apple's App Store and Google Play sell subscriptions and take payment as their own services, under their own terms and privacy policies. Apart from these, no one receives your data from us, and no advertising company ever does. We don't sell it. We give data to the police or a court only when the law requires it.
Data sent outside the UK
We are a UK company. Sanity, PostHog and Supabase keep data in the European Economic Area, which UK law recognizes as protecting it. For the US companies, we rely on the UK Extension to the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the contract terms the UK approves for sending data abroad, with an assessment of the risks that we keep on file.
How long we keep it
| What | Kept until |
|---|---|
| Your diary | Never held by us. It is kept on your phone until you delete it |
| Together: what you share | Replaced each time you share again, and deleted when either of you stops sharing |
| Invites for someone who knew you, and what they send | 30 days, or until you close the invite, then deleted |
| A report shared as a link | Deleted as soon as you stop the link, or within an hour after it expires (after 7, 14 or 30 days, as you choose) |
| Your anonymous ID, and your push token | Until you use Delete everything |
| Usage stats | Up to 12 months |
| Error reports | Up to 90 days |
| Purchase records at RevenueCat, under the anonymous ID | Up to 6 years, as the financial records the law requires |
| Emails you send us | 2 years after the last message in the conversation |
Your choices and rights
- Usage stats and error reports: Settings → Privacy → Share anonymous usage stats. Turning it off stops both at once.
- Your diary: export it, back it up or delete it in Settings, at any time.
- Subscriptions: manage or cancel them in the App Store or Google Play.
Wherever you live, you can ask us to tell you whether we hold data about you and give you a copy; correct it; delete it; give it to you in a form a computer can read; or stop or limit using it. You can withdraw any consent at any time, which doesn't affect what we did before. Because we hold almost nothing, and usage stats are linked only to a random ID rather than to you, we may not be able to find data about you; we'll tell you if so. Write to hello@trace-adhd.com. We answer within one month, don't charge, and never treat you differently for asking. If we say no, we tell you why, and you can appeal by replying with the word Appeal.
You can also complain to your privacy regulator: in the UK, the Information Commission (ico.org.uk); in Canada, the Office of the Privacy Commissioner of Canada, or in Quebec the Commission d'accès à l'information; in Australia, the Office of the Australian Information Commissioner; in New Zealand, the Office of the Privacy Commissioner; in the US, your state's attorney general. We'd like the chance to put things right first.
In the US: we don't sell personal data, share it for cross-context behavioral advertising, or use it for targeted advertising or profiling.
Children
Trace is for adults. It asks whether you're 18 or over when you first open it, and we don't knowingly collect data about anyone under 18.
Keeping it secure
We keep as little as we can. The diary is encrypted on your phone, and everything Trace sends is encrypted in transit. What you share with Together, a link or an invite is also encrypted end to end: the keys are made on your phones (and, for a link or an invite, put in the link you send, in a part that browsers never send to a server), so a copy taken from our server couldn't be read. If data we hold were ever exposed, we'd tell the regulators the law requires, within the time it sets, and tell you in the app and on this website.
Changes
The version at the top says which this is. If we change how we use your data, we say so here and in the app before the change applies. We never use data already held for a new purpose without asking you.
Contact
hello@trace-adhd.com. Trace ADHD Ltd, 124 City Road, London, EC1V 2NX, United Kingdom.