Privacy policy

Who we are

supertracer (“we”, “us”) is a face search service at supertracer.app and in the supertracer Android app. It is run by Sagar Tamang from India. For anything in this policy, write to [email protected]. That address also reaches our grievance officer under India’s Digital Personal Data Protection Act, 2023.

What we collect

Your account

• You sign in with Google, on the web and in the Android app; it is the same account on both. We receive your name, email address, profile picture and Google account ID. We never see your Google password.
• In the Android app we also receive a hash of your device ID, which we use only to limit free searches and invite codes per device. The app keeps a sign-in token (we store only a hash of it). If you answer the optional onboarding questions, we keep your answers.

Your searches

• A small thumbnail of the searched photo (at most 480 pixels wide) for your history.
• The results: links to the public pages found, their titles, the names those titles show, thumbnails from those pages, and how close each match is.
• When the search ran, whether it found anything, and whether you unlocked it.

Payments and credits

• Purchases go through Dodo Payments; the Android app has no purchases. We receive a customer ID, the plan or pack, the subscription status and its renewal date. Card details never reach us.
• A record of every credit added or spent, so your balance can be checked and billing disputes resolved.

Other things you give us

• Developer API keys: a name you choose and a hash of the key (the key itself is shown to you once).
• Access requests for restricted tools: your name, job title, organisation, work email, phone (optional), country and intended use.
• Anything you write to us by email.

Technical data

Your IP address is used, in memory, to rate-limit requests and stop abuse; we do not save it in our database. Our server logs record errors, and our network provider (Cloudflare) handles traffic on its way to us. We use no analytics or advertising trackers.

The photos you search

Your browser or the app shrinks the photo before sending it. On our server it is first checked for a single real face, then sent to the search engine that runs the search. We do not write the uploaded photo to disk or keep it after the search. The thumbnail in your history is made on your device and stays until you delete that search or your account.

We do not build a database of faces or face templates. Each search asks public search engines in the moment; results are stored only with the search that found them, in your account.

Only search photos of adults you have a legitimate reason to check, as the terms require. Never upload a photo of a child.

How we use it

• To run your searches, show your results and keep your history.
• To keep your credits, subscription and purchases correct.
• To limit free use, stop abuse and keep the service secure.
• To answer you when you write to us.
• To meet legal obligations, such as tax records or a valid legal request.

We do not sell or rent personal data, use it for advertising, or use your photos to train AI models. We process your data to provide the service you asked for (with your consent when you upload a photo), for our legitimate interest in preventing abuse, and where the law requires it.

Who processes it

These services handle data for us, each only for the job listed:

These providers may process data in the United States and other countries, under their own privacy terms. We may also disclose data when the law requires it, to protect people from harm, or as part of a sale or merger of the service (we would tell you first).

How long we keep it

• Uploaded photo: not kept after the search. Working data from a search is purged within about ten minutes.
• Searches and results: until you delete the search or your account.
• Your account, credits and purchase records: until you delete your account. Payment providers keep their own records as the law requires.
• Sign-in: a web session lasts 30 days; the app stays signed in until you sign out.
• Device limits (app): the hashed device ID and the time of its last free search are kept even after you delete your account, so that reinstalling cannot reset free use. They are not linked to any account and hold nothing else.

Cookies

We use only the cookies the site needs to work:

• st_session: keeps you signed in (30 days, not readable by scripts).
• Short-lived cookies during Google sign-in, which protect the sign-in from forgery and, when you sign in from the app, return you to it (10 minutes).
• st_rail: remembers whether the dashboard sidebar is open.

Your rights

You can ask to see the data we hold about you, correct it, delete it, or withdraw your consent, and you can nominate someone to act for you. If you are in the EU or UK you also have the rights to portability and to object, and you can complain to your data protection authority. In India you can raise a grievance with us and then with the Data Protection Board of India.

• Delete a search: open History in the dashboard and delete it.
• Delete your account: in the app, from Settings. On the web, email [email protected] from the address you sign in with. Deleting your account removes your searches, results, credits and purchase records with it.
• Anything else: write to [email protected]. We reply within 30 days.

Remove my face

If you appear in supertracer results and want that to stop, email [email protected] with the links of the pages that show you (and, if you like, a photo so we can find them). We will delete those results from every search stored with us and confirm when it is done.

supertracer only finds pages that are already public, so the lasting fix is at the source: ask the site to take the photo down, or use the removal tools of the search engines we rely on (Google’s “Results about you” and FaceCheck.ID’s removal request). Removed pages stop appearing in new searches once those engines drop them.

For takedowns over copyright, harassment or abuse of the service, write to [email protected].

Children

supertracer is for adults (18 and over). We do not knowingly collect data from children, and searching photos of children is forbidden. If you believe a child’s data is with us, write to [email protected] and we will delete it.

Security

All traffic is encrypted (HTTPS only). Sign-in tokens and API keys are stored only as hashes. Results stay locked on our server, links and real thumbnails included, until a search is unlocked. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

Changes

We will update this page when what we collect or how we use it changes, and change the date at the top. For significant changes we will also tell signed-in users in the product.

Contact

• Privacy, data requests and grievances: [email protected]
• Legal, takedowns and law enforcement: [email protected]
• Account, billing and bugs: [email protected]