Privacy Policy

This privacy policy applies to the TraceIt app (hereby referred to as "Application") for mobile devices that was created by Yassine Zeriouh (hereby referred to as "Service Provider") as a Freemium service. This service is intended for use "AS IS".

Information Collection and Use

The Application collects information when you download and use it. This information may include information such as the items below. Optional analytics and advertising-attribution collection is subject to the regional startup control described in this policy.

Your device's Internet Protocol address (e.g. IP address)
Selected app interactions and event timestamps, such as scans, paywall views, purchases, restores, and settings usage
Session and app-lifecycle information
App and device information, such as app version, device model, operating system, language, and an approximate region inferred from network information
Subscription status and a stable, pseudonymous RevenueCat app user identifier. The same identifier is used to identify the PostHog analytics person so subscription and product-interaction events can be joined.
A pseudonymous Firebase app instance ID that identifies an installation of the Application for Google Analytics measurement. The Application also provides this identifier to RevenueCat so subscription events can be associated with the same installation in Google Analytics.
A pseudonymous AppsFlyer identifier that identifies an installation of the Application for advertising-attribution measurement. The Application also provides this identifier to RevenueCat so subscription events can be associated with the same installation in AppsFlyer.
Diagnostics made available by bundled service SDKs, such as crash and performance information, when those SDKs collect it.
Generalized device properties attached to selected analytics events, such as whether a Bluetooth name was missing, whether a name looked like an Apple product, connection and iBeacon flags, a broad signal-strength bucket, and a potential tracker-brand match. These events do not include the Bluetooth device name, device identifier, raw manufacturer, or exact RSSI.
Sampled session-replay screenshots while a paywall is visible. Replay is limited to a deterministic 10% sample and masks text inputs, images, secure or sandboxed views, and device-result regions. Other non-input paywall text and interface elements may be captured; replay network telemetry is disabled.

The Application does not request or collect GPS/CoreLocation data from your mobile device. Third-party services may infer an approximate region from network information such as IP address.

Bluetooth scanning and signal-strength calculations run on your device. The Application does not need an account to scan for nearby Bluetooth devices.

A capped snapshot of up to 40 recent scan results may be stored locally on your device for up to 15 minutes to support an in-app results screen. Saved device names, Bluetooth identifiers, last-seen times, and signal readings remain in the Application's local storage until you delete them or remove the Application. If you email support, the Service Provider receives the contact information and message you choose to send.

Regional Telemetry Control

On each cold launch, the Application requests a policy decision from cc.tracker-finder.com, a Cloudflare Worker operated for TraceIt. Cloudflare derives a coarse request-country from the network IP address. The Application receives only an allowed, restricted, or unknown policy classification; it does not receive or store the country code. An unknown classification is treated as restricted. Cloudflare necessarily processes ordinary network-request data, including the IP address, to deliver this decision.

For requests classified as being in the European Economic Area, United Kingdom, or Switzerland, the Application does not initialize optional Firebase, PostHog, Meta, or AppsFlyer telemetry, forward advertising identifiers, collect an Apple AdServices attribution token, or show the App Tracking Transparency prompt unless you have given consent. Consent is requested once, on a screen inside the Application that describes this processing and offers an equally prominent decline. Until you choose, and if you decline, none of the optional services start. If you consent, they start and Google and AppsFlyer additionally receive the consent signals their European rules require. You can withdraw consent at any time under Settings › Analytics & Ads Measurement; withdrawal deletes the advertising match keys already shared for attribution and takes full effect at the next app launch.

The Application fails closed if the policy endpoint is unavailable, times out, or returns an invalid response: optional telemetry stays off and no consent screen is shown, because an unreachable endpoint is not a statement about your region. Outside the areas listed above, optional telemetry starts after an explicit allowed response and no consent screen is shown, because that regional consent requirement does not apply.

RevenueCat's core subscription, purchase, restore, and entitlement processing remains active in all regions. To provide those functions, RevenueCat receives the pseudonymous RevenueCat app user ID and ordinary service-request and device data, which can include the IP address, IDFV, current App Tracking Transparency authorization status, app version, and device or operating-system information. When optional telemetry is off, the Application does not provide values for RevenueCat's optional Firebase, Meta, AppsFlyer, or advertising-attribution match-key subscriber attributes. It may send deletion markers for those keys to remove values saved by an earlier eligible launch or app version.

Third Party Access

The Application uses third-party services to run analytics, subscriptions, and advertising attribution. The Service Provider may share information with those services in the ways that are described in this privacy statement.

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

PostHog is used for product analytics, feature flags, and session replay. For sampled sessions, replay is started only while a paywall is visible so the Service Provider can diagnose paywall and usability issues. The SDK masks text inputs, images, secure or sandboxed views, and marked device-result regions; other non-input paywall text and controls may be visible. Replay network telemetry is disabled. App Store payment details are not recorded by the Application.

The Service Provider may disclose User Provided and Automatically Collected Information:

as required by law, such as to comply with a subpoena, or similar legal process;
when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
with their trusted services providers who work on their behalf, do not have an independent use of the information we disclose to them, and have agreed to adhere to the rules set forth in this privacy statement.

Advertising and Attribution

Where the regional startup control allows optional telemetry, the Application uses Google Analytics for Firebase to understand app usage and measure the results of Google Ads campaigns. Firebase generates a pseudonymous app instance ID and may collect app, device, approximate region, first-open, session, app-lifecycle, and purchase activity. On iOS, Google Analytics may collect the Identifier for Vendors (IDFV) and may collect the Identifier for Advertisers (IDFA) only when it is available after App Tracking Transparency authorization.

When Firebase is active, the Application sends its Firebase app instance ID to RevenueCat. RevenueCat then forwards subscription lifecycle events to the same Google Analytics stream. Depending on the event, these records may include a subscription product, transaction identifier, timestamp, currency and value, and whether a trial, purchase, renewal, cancellation, expiration, product change, or billing issue occurred. Apple handles payment. This integration does not give Google your payment card or financial account details.

When Google Analytics is linked to Google Ads, Google may use observed events, event-data on-device conversion measurement, and modeled conversions to report and optimize campaign results. Where supported, event-data on-device measurement uses de-identified, temporary app-event data. It is distinct from aggregate reporting through Apple's SKAdNetwork. TraceIt does not have an account sign-in and does not provide email addresses or phone numbers to Google's first-party-data on-device measurement API. Google states that event-data on-device measurement is inactive for users in the European Economic Area, United Kingdom, and Switzerland; TraceIt's regional control also keeps Firebase and the other optional telemetry SDKs off there. Separately, Apple's SKAdNetwork may provide aggregate install or conversion postbacks, and Google's modeled results may be estimates rather than user-level matches. Google Analytics ad-personalization signals are disabled by default.

Where the regional startup control allows optional telemetry, the Application uses the Meta (Facebook) SDK to measure the performance of advertising campaigns the Service Provider runs on Meta platforms (such as Facebook and Instagram) and to understand which ads lead to app installs and subscriptions. For this purpose, the Application may collect and share the following information with Meta Platforms, Inc.:

Device and advertising identifiers, including the Identifier for Advertisers (IDFA) — only when you grant permission via the App Tracking Transparency prompt described below — the Identifier for Vendors (IDFV), and a Facebook anonymous identifier generated by the SDK.
App activity, such as app installs, app launches, and session activity.
Purchase and subscription events (for example, starting a free trial or completing a purchase), shared via RevenueCat so the effectiveness of advertising can be measured. These events do not include your payment card or financial account details.

Meta processes this information as an independent controller in accordance with its own Privacy Policy. The Service Provider does not sell your personal data.

Where the regional startup control allows optional telemetry, the Application uses AppsFlyer, a mobile measurement service, to attribute app installs to the advertising network and campaign that led to them and to measure advertising performance across networks in one place. For this purpose, the Application may collect and share the following information with AppsFlyer Ltd.:

Device and advertising identifiers, including the Identifier for Advertisers (IDFA) — only when you grant permission via the App Tracking Transparency prompt described below — the Identifier for Vendors (IDFV), and a pseudonymous AppsFlyer identifier generated by the SDK.
The IP address and an approximate region inferred from it, and app and device information such as app version, device model, operating system, and language.
App activity, such as app installs, app launches, and session activity.
Subscription lifecycle events (for example, starting a free trial, completing a purchase, a renewal, or a cancellation), shared server-to-server via RevenueCat so advertising effectiveness can be measured. Depending on the event, these records may include a subscription product, transaction identifier, timestamp, currency and value. They do not include your payment card or financial account details.

The Application also designates AppsFlyer to receive copies of Apple's SKAdNetwork postbacks and to manage SKAdNetwork conversion values. SKAdNetwork is Apple's aggregate, privacy-preserving attribution mechanism: its postbacks are campaign-level signals that do not contain user- or device-level identifiers, and Apple sends them at the operating-system level independently of the Application's optional telemetry. AppsFlyer processes information in accordance with its own Privacy Policy.

App Tracking Transparency

Where the regional startup control allows optional telemetry, the Application may ask for your permission before tracking you, using Apple's App Tracking Transparency framework. It does not show this prompt while optional telemetry is restricted or the policy decision is unavailable. "Tracking" means linking the information described above with data from other companies' apps and websites for advertising and measurement purposes.

If you select "Allow", the Application may use your device's advertising identifier (IDFA) to measure and improve advertising.
If you select "Ask App Not to Track", or take no action, the Application does not access your IDFA and does not track you across apps and websites owned by other companies. Installs and conversions may still be measured using methods that do not require IDFA. Outside regions where optional telemetry is disabled, those methods may include Google's event-data on-device measurement or modeled conversions. Separately, Apple's SKAdNetwork may provide aggregate attribution.

You can change your choice at any time on your device under Settings › Privacy & Security › Tracking.

App Tracking Transparency controls access to IDFA and cross-company tracking. It does not by itself control all app analytics, subscription processing, or privacy-preserving attribution. For example, app-instance-based Firebase Analytics may operate without IDFA.

Your Choices and Rights

This policy describes processing; it is not itself a request for consent. Merely using the Application is not treated as explicit consent where applicable law requires a separate choice. In the European Economic Area, United Kingdom, and Switzerland, optional analytics and advertising-attribution processing relies on the consent you give on the in-app consent screen described above, and you may withdraw it at any time under Settings › Analytics & Ads Measurement. Elsewhere, that processing relies on another legal basis permitted by law. Granting ATT permission does not by itself provide any separate consent required by law, and declining ATT does not automatically disable analytics that does not involve cross-company tracking.

You can deny or later change ATT permission in iOS Settings. Uninstalling the Application stops future collection from that installation, but it does not automatically erase information already held by the Service Provider or a third-party provider. To request access to or deletion of information associated with you, or to ask how to withdraw a consent that applies to you, contact the address below.

Data Retention Policy

The Service Provider retains user-provided and automatically collected data only for as long as reasonably necessary for analytics, subscription administration, advertising measurement, security, support, and applicable legal obligations. PostHog, RevenueCat, Meta, AppsFlyer, and Google may apply their own retention periods under the provider policies linked above. To request deletion of information associated with you, contact devicefinder@zeriouh.io. The Service Provider will act on the request or explain what additional identifier or legal retention requirement applies.

Website Hosting

The TraceIt website is delivered through Cloudflare. Like most hosting providers, Cloudflare may process request information such as an IP address, browser details, and requested URL to deliver and secure the site. The website does not run a separate behavioral analytics script or an app-telemetry consent banner; the regional control described above applies to the Application's optional SDKs. See Cloudflare's Privacy Policy for details about its processing.

Children

The Service Provider does not use the Application to knowingly solicit data from or market to children under the age of 13.

The Application does not address anyone under the age of 13. The Service Provider does not knowingly collect personally identifiable information from children under 13 years of age. If the Service Provider discovers that a child under 13 has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact the Service Provider (devicefinder@zeriouh.io) so that they will be able to take the necessary actions.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains.

Changes

This Privacy Policy may be updated from time to time for any reason. The Service Provider will notify you of any changes to the Privacy Policy by updating this page with the new Privacy Policy. You are advised to consult this Privacy Policy regularly for any changes. If a change requires a new consent under applicable law, that consent must be requested separately.

This privacy policy is effective as of 2026-08-05.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at devicefinder@zeriouh.io.