Privacy Policy

This privacy policy applies to the TraceIt app (hereby referred to as "Application") for mobile devices that was created by Yassine Zeriouh (hereby referred to as "Service Provider") as a Freemium service. This service is intended for use "AS IS".

Information Collection and Use

The Application collects information when you download and use it. This information may include information such as the items below. Optional analytics and advertising-attribution collection is subject to the regional startup control described in this policy.

Your device's Internet Protocol address (e.g. IP address)
Selected app interactions and event timestamps, such as scans, paywall views, purchases, restores, and settings usage
Session and app-lifecycle information
App and device information, such as app version, device model, operating system, language, and an approximate region inferred from network information
Subscription status and a stable, pseudonymous RevenueCat app user identifier. The same identifier is used to identify the PostHog analytics person so subscription and product-interaction events can be joined.
A pseudonymous Firebase app instance ID that identifies an installation of the Application for Google Analytics measurement. The Application also provides this identifier to RevenueCat so subscription events can be associated with the same installation in Google Analytics.
A pseudonymous Tenjin analytics installation ID that identifies an installation of the Application for advertising-attribution measurement. It is generated on your device by the Tenjin SDK rather than assigned by a server, and is stored in the Application's local storage. The Application also provides this identifier to RevenueCat so subscription events can be associated with the same installation in Tenjin.
Diagnostics made available by bundled service SDKs, such as crash and performance information, when those SDKs collect it.
Generalized device properties attached to selected analytics events, such as whether a Bluetooth name was missing, whether a name looked like an Apple product, connection and iBeacon flags, a broad signal-strength bucket, and a potential tracker-brand match. These events do not include the Bluetooth device name, device identifier, raw manufacturer, or exact RSSI.
Sampled session-replay screenshots while a paywall is visible. Replay is limited to a deterministic 10% sample and masks text inputs, images, secure or sandboxed views, and device-result regions. Other non-input paywall text and interface elements may be captured; replay network telemetry is disabled.

The Application does not request or collect GPS/CoreLocation data from your mobile device. Third-party services may infer an approximate region from network information such as IP address.

Bluetooth scanning and signal-strength calculations run on your device. The Application does not need an account to scan for nearby Bluetooth devices.

A capped snapshot of up to 40 recent scan results may be stored locally on your device for up to 15 minutes to support an in-app results screen. Saved device names, Bluetooth identifiers, last-seen times, and signal readings remain in the Application's local storage until you delete them or remove the Application. If you email support, the Service Provider receives the contact information and message you choose to send.

Regional Telemetry Control

From version 1.6.0, the Application decides on your device, on each cold launch, whether the consent described below is needed. It reads the region set on your device (in iOS, Settings › General › Language & Region); it makes no network request for this and does not send or store the region. A region in the European Economic Area, United Kingdom, or Switzerland, or a region that cannot be determined, is treated as restricted. Because this is a setting rather than your location, travelling or using a VPN does not change it.

Earlier versions instead request a policy decision on each cold launch from cc.tracker-finder.com, a Cloudflare Worker operated for TraceIt. Cloudflare derives a coarse request-country from the network IP address. Those versions receive only an allowed, restricted, or unknown policy classification; they do not receive or store the country code. An unknown classification is treated as restricted. Cloudflare necessarily processes ordinary network-request data, including the IP address, to deliver this decision.

Where the region is restricted, the Application does not initialize optional Firebase, PostHog, Meta, or Tenjin telemetry, forward advertising identifiers, or collect an Apple AdServices attribution token unless you have given consent. Consent is requested once, inside the Application: a screen describes this processing and then opens Apple's App Tracking Transparency prompt, and your answer there is your decision. "Allow" gives consent; "Ask App Not to Track" declines. If you have already answered that prompt, or tracking requests are switched off on your device, that existing answer is used and no screen is shown. Earlier versions of the Application asked on a screen of their own, with an equally prominent decline, before showing the App Tracking Transparency prompt. Until you choose, and if you decline, none of the optional services start, apart from the feature-switch download described below. If you consent, they start and Google and Tenjin additionally receive the consent signals their European rules require. You can withdraw consent at any time under Settings › Analytics & Ads Measurement; withdrawal deletes the advertising match keys already shared for attribution and takes full effect at the next app launch.

Versions before 1.6.0 fail closed if the policy endpoint is unavailable, times out, or returns an invalid response: optional telemetry stays off and no consent screen is shown, because an unreachable endpoint is not a statement about your region. Outside the areas listed above, optional telemetry starts without a consent screen (in versions before 1.6.0, after an explicit allowed response), because that regional consent requirement does not apply.

Feature switches: from version 1.6.0, when PostHog analytics is not running (before you choose, or after you decline), the Application still downloads its feature switches, such as whether a feature is shown, directly from PostHog on each cold launch. That request carries no identifier, no events, and no usage or device information: every such device asks as the same fixed placeholder, the request asks PostHog not to look up a location, and PostHog receives your IP address only as part of delivering the response. The switches are stored on your device until the next download. This is part of operating the Application, not analytics, and relies on the Service Provider's legitimate interest in configuring the Application's features remotely.

RevenueCat's core subscription, purchase, restore, and entitlement processing remains active in all regions. To provide those functions, RevenueCat receives the pseudonymous RevenueCat app user ID and ordinary service-request and device data, which can include the IP address, IDFV, current App Tracking Transparency authorization status, app version, and device or operating-system information. When optional telemetry is off, the Application does not provide values for RevenueCat's optional Firebase, Meta, Tenjin, or advertising-attribution match-key subscriber attributes. It may send deletion markers for those keys to remove values saved by an earlier eligible launch or app version.

Third Party Access

The Application uses third-party services to run analytics, subscriptions, and advertising attribution. The Service Provider may share information with those services in the ways that are described in this privacy statement.

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

PostHog is used for product analytics, feature flags, and session replay. Without analytics consent, only the anonymous feature-switch download described under Regional Telemetry Control reaches PostHog. For sampled sessions, replay is started only while a paywall is visible so the Service Provider can diagnose paywall and usability issues. The SDK masks text inputs, images, secure or sandboxed views, and marked device-result regions; other non-input paywall text and controls may be visible. Replay network telemetry is disabled. App Store payment details are not recorded by the Application.

The Service Provider may disclose User Provided and Automatically Collected Information:

as required by law, such as to comply with a subpoena, or similar legal process;
when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
with their trusted services providers who work on their behalf, do not have an independent use of the information we disclose to them, and have agreed to adhere to the rules set forth in this privacy statement.

Advertising and Attribution

Where the regional startup control allows optional telemetry, the Application uses Google Analytics for Firebase to understand app usage and measure the results of Google Ads campaigns. Firebase generates a pseudonymous app instance ID and may collect app, device, approximate region, first-open, session, app-lifecycle, and purchase activity. On iOS, Google Analytics may collect the Identifier for Vendors (IDFV) and may collect the Identifier for Advertisers (IDFA) only when it is available after App Tracking Transparency authorization.

When Firebase is active, the Application sends its Firebase app instance ID to RevenueCat. RevenueCat then forwards subscription lifecycle events to the same Google Analytics stream. Depending on the event, these records may include a subscription product, transaction identifier, timestamp, currency and value, and whether a trial, purchase, renewal, cancellation, expiration, product change, or billing issue occurred. Apple handles payment. This integration does not give Google your payment card or financial account details.

When Google Analytics is linked to Google Ads, Google may use observed events, event-data on-device conversion measurement, and modeled conversions to report and optimize campaign results. Where supported, event-data on-device measurement uses de-identified, temporary app-event data. It is distinct from aggregate reporting through Apple's SKAdNetwork. TraceIt does not have an account sign-in and does not provide email addresses or phone numbers to Google's first-party-data on-device measurement API. Google states that event-data on-device measurement is inactive for users in the European Economic Area, United Kingdom, and Switzerland; TraceIt's regional control also keeps Firebase and the other optional telemetry SDKs off there unless you consent in the Application. Separately, Apple's SKAdNetwork may provide aggregate install or conversion postbacks, and Google's modeled results may be estimates rather than user-level matches. Google Analytics ad-personalization signals are disabled by default.

Where the regional startup control allows optional telemetry, the Application uses the Meta (Facebook) SDK to measure the performance of advertising campaigns the Service Provider runs on Meta platforms (such as Facebook and Instagram) and to understand which ads lead to app installs and subscriptions. For this purpose, the Application may collect and share the following information with Meta Platforms, Inc.:

Device and advertising identifiers, including the Identifier for Vendors (IDFV), a Facebook anonymous identifier generated by the SDK, and the Identifier for Advertisers (IDFA), which is shared only when you grant permission via the App Tracking Transparency prompt described below.
App activity, such as app installs, app launches, and session activity.
Purchase and subscription events (for example, starting a free trial or completing a purchase), shared via RevenueCat so the effectiveness of advertising can be measured. These events do not include your payment card or financial account details.

Meta processes this information as an independent controller in accordance with its own Privacy Policy. The Service Provider does not sell your personal data.

Where the regional startup control allows optional telemetry, the Application uses Tenjin, a mobile measurement service, to attribute app installs to the advertising network and campaign that led to them and to measure advertising performance across networks in one place. For this purpose, the Application may collect and share the following information with Tenjin, Inc.:

Device and advertising identifiers, including the Identifier for Vendors (IDFV), a pseudonymous Tenjin analytics installation ID generated on your device by the SDK, and the Identifier for Advertisers (IDFA), which is shared only when you grant permission via the App Tracking Transparency prompt described below.
The IP address and an approximate region inferred from it, and app and device information such as app version, device model, operating system, and language.
App activity, such as app installs, app launches, and session activity.
Subscription lifecycle events (for example, starting a free trial, completing a purchase, a renewal, or a cancellation), shared server-to-server via RevenueCat so advertising effectiveness can be measured. Depending on the event, these records may include a subscription product, transaction identifier, timestamp, currency and value. They do not include your payment card or financial account details.

The Application also designates Tenjin to receive copies of Apple's SKAdNetwork postbacks. SKAdNetwork is Apple's aggregate, privacy-preserving attribution mechanism: its postbacks are campaign-level signals that do not contain user- or device-level identifiers, and Apple sends them at the operating-system level independently of the Application's optional telemetry. Where the regional startup control allows optional telemetry, the Application registers each install for SKAdNetwork attribution and may set the install's SKAdNetwork conversion value, a coarse numeric code rather than a record of individual events. Depending on the version of the Application, this value is either set to zero once, only to register the install, or set by Google Analytics for Firebase according to a schema the Service Provider configures in Google Analytics. In the latter case it can reflect early in-app activity, such as whether a free trial or purchase started within Apple's measurement windows, and Google Ads uses it to measure and optimize campaigns. Apple includes the value in the postbacks it sends to the advertising network whose ad led to the install and in the copies it sends to Tenjin. Tenjin processes information in accordance with its own Privacy Policy.

App Tracking Transparency

The Application may ask for your permission before tracking you, using Apple's App Tracking Transparency framework. Where the regional startup control requires consent, this prompt is how you give or decline it, as described above. Earlier versions did not show the prompt there until you had consented on their own screen, and versions before 1.6.0 do not show it while the policy decision is unavailable. "Tracking" means linking the information described above with data from other companies' apps and websites for advertising and measurement purposes.

If you select "Allow", the Application may use your device's advertising identifier (IDFA) to measure and improve advertising.
If you select "Ask App Not to Track", or take no action, the Application does not access your IDFA and does not track you across apps and websites owned by other companies. Installs and conversions may still be measured using methods that do not require IDFA. Outside regions where optional telemetry is disabled, those methods may include Google's event-data on-device measurement or modeled conversions. Separately, Apple's SKAdNetwork may provide aggregate attribution. Where the regional startup control requires consent, this answer also declines it, so none of the optional services described above start.

You can change your choice at any time on your device under Settings › Privacy & Security › Tracking.

App Tracking Transparency controls access to IDFA and cross-company tracking. It does not by itself control all app analytics, subscription processing, or privacy-preserving attribution. For example, app-instance-based Firebase Analytics may operate without IDFA.

Your Choices and Rights

This policy describes processing; it is not itself a request for consent. Merely using the Application is not treated as explicit consent where applicable law requires a separate choice. In the European Economic Area, United Kingdom, and Switzerland, optional analytics and advertising-attribution processing relies on the consent you give in the Application as described above (your answer to the App Tracking Transparency prompt, or the Settings switch), and you may withdraw it at any time under Settings › Analytics & Ads Measurement. Elsewhere, that processing relies on another legal basis permitted by law, granting ATT permission does not by itself provide any separate consent required by law, and declining ATT does not automatically disable analytics that does not involve cross-company tracking.

You can deny or later change ATT permission in iOS Settings. Uninstalling the Application stops future collection from that installation, but it does not automatically erase information already held by the Service Provider or a third-party provider. To request access to or deletion of information associated with you, or to ask how to withdraw a consent that applies to you, contact the address below.

Data Retention Policy

The Service Provider retains user-provided and automatically collected data only for as long as reasonably necessary for analytics, subscription administration, advertising measurement, security, support, and applicable legal obligations. PostHog, RevenueCat, Meta, Tenjin, and Google may apply their own retention periods under the provider policies linked above. To request deletion of information associated with you, contact devicefinder@zeriouh.io. The Service Provider will act on the request or explain what additional identifier or legal retention requirement applies.

Website Hosting

The TraceIt website is delivered through Cloudflare. Like most hosting providers, Cloudflare may process request information such as an IP address, browser details, and requested URL to deliver and secure the site. The website does not run a separate behavioral analytics script or an app-telemetry consent banner; the regional control described above applies to the Application's optional SDKs. See Cloudflare's Privacy Policy for details about its processing.

Children

The Service Provider does not use the Application to knowingly solicit data from or market to children under the age of 13.

The Application does not address anyone under the age of 13. The Service Provider does not knowingly collect personally identifiable information from children under 13 years of age. If the Service Provider discovers that a child under 13 has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact the Service Provider (devicefinder@zeriouh.io) so that they will be able to take the necessary actions.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains.

Changes

This Privacy Policy may be updated from time to time for any reason. The Service Provider will notify you of any changes to the Privacy Policy by updating this page with the new Privacy Policy. You are advised to consult this Privacy Policy regularly for any changes. If a change requires a new consent under applicable law, that consent must be requested separately.

This privacy policy is effective as of 2026-10-07.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at devicefinder@zeriouh.io.