Privacy Policy

1. Who we are and what this policy covers

This policy is issued by TechPeek Magnus Solutions Private Limited, a company incorporated in India, which operates the AttoFlow brand ("AttoFlow", "we", "us", "our").

It explains how we handle personal information in connection with:

• the Trace desktop application for Windows, macOS and Linux (the "App");
• the Trace Browser Companion browser extension (the "Extension");
• Trace Cloud, the optional online service for syncing work summaries with a team; and
• our website at attoflow.ai (the "Website").

We use this policy to meet our obligations under India's Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and related rules, and other privacy laws that apply to you.

Your use of Trace is also governed by our End User License Agreement.

2. Data Trace keeps on your device

Trace works by watching which app or website you are using, so it can turn your day into a timesheet. While tracking is on, it stores the following in a local database and folder in your computer's app data directory:

This data is stored only on your device. AttoFlow does not receive, store or have access to it unless you choose to share it with us (for example, by sending us a log file for support) or you use Trace Cloud as described in section 5.

Because this data stays on your device, protecting that device is up to you. Anyone with access to your computer account may be able to see it.

3. On-device AI and model downloads

Trace sorts activity into projects using your rules and a local AI model. The model runs on your own computer through the open-source llama.cpp software. Your activity data and screenshots are processed on your computer and are not sent to us or to any AI provider.

When you pick an AI model in Trace, the App downloads it from Hugging Face, a third-party model host. Like any download, that request shares your IP address, the model you asked for and basic technical details with Hugging Face. None of your activity data is sent. Hugging Face's own privacy policy covers that request.

If we ever add an optional feature that sends your activity to a third-party AI service, it will be off by default. We will update this policy and explain in the App what would be shared before you can turn it on.

4. Trace Browser Companion

The Extension reads the address and title of your active browser tab. It sends them only to the Trace App on the same computer, over a local connection (127.0.0.1) that never leaves your device. It does not send browsing data to us or anyone else.

In private or incognito windows, the Extension tells Trace a private window is active, but does not share its address or title. The Extension doesn't read page content, form fields, passwords or cookies.

5. Trace Cloud (optional)

Trace Cloud lets you or your organisation see work time across devices and team members. It is off unless you sign in from the App's Settings. If you sign in, we process the following:

• Account details: your email address and sign-in information. The App stores the resulting sign-in token in your operating system's secure credential store.
• Device details: a device name and a random identifier created by Trace, so your organisation can tell your devices apart.
• Work blocks: for activity assigned to a project that is linked to your organisation's Trace Cloud workspace, the project, the start and end time, and a short description of the activity (usually the window or page title).
• Organisation setup: projects and rules your organisation shares with your device.

While you are signed in, the App syncs about every 30 minutes. It sends work blocks from the current and previous day. Screenshots, keyboard and mouse counts, raw activity logs, and activity that isn't assigned to a linked project are never uploaded.

People with administrative access to your organisation's Trace Cloud workspace can see the work blocks your devices sync. If your employer or client gave you Trace Cloud access, they decide how that information is used. We process it for them and follow their instructions, and their privacy practices also apply.

To stop syncing, sign out in the App's Settings. Signing out stops future uploads. It does not delete information already synced. To have it deleted, contact your organisation's administrator or us.

6. Our website and contacting us

• Hosting and downloads. The Website is hosted on Amazon Web Services in India. Trace installers are served through Cloudflare. As with any website, these providers automatically receive and briefly log technical details such as your IP address, browser type, the pages or files you request, and when you requested them. These logs are used to deliver the Website and keep it secure.
• Fonts and libraries. Pages load fonts from Google Fonts, and some pages load code libraries from unpkg. Your browser shares your IP address and browser details with those providers when it fetches these files.
• No analytics or advertising cookies. The Website does not use analytics tools, advertising trackers or marketing cookies.
• When you contact us. If you email or call us, we use your name, contact details and message to reply, provide support, or set up access to Trace for you or your team.

7. What we do not do

• We do not sell, rent or trade personal information.
• We do not use your data for advertising or build advertising profiles.
• We do not use your activity data, screenshots or Trace Cloud data to train AI models.
• The App does not include analytics, telemetry or automatic crash reporting that sends data to us.

8. Why we process data

We process the limited personal information that reaches us:

• with your consent, for example when you sign in to Trace Cloud or contact us. You can withdraw consent at any time by signing out, stopping use of the service, or contacting us. Withdrawing consent does not affect processing that happened before;
• to provide a service you asked for, including Trace Cloud and support;
• on behalf of your organisation, when it provides your Trace Cloud access; and
• for other legitimate uses permitted by law, such as keeping our services secure, preventing misuse, and meeting legal obligations.

9. How long data is kept

• Data on your device stays until you delete it or uninstall Trace and remove its data folder. You control it.
• Screenshots are deleted automatically once they have been classified, and never kept longer than 24 hours by default.
• Diagnostic captures, if turned on, are deleted automatically after 7 days by default.
• Trace Cloud data is kept while your account or your organisation's workspace is active. After that, it is deleted within a reasonable period unless the law requires us to keep it longer.
• Website logs are kept for a short period by our hosting providers for security and operations.
• Emails and support requests are kept as long as needed to help you and to keep reasonable business records.

10. Your controls and rights

In the App

• Pause tracking at any time, or schedule automatic pauses outside working hours.
• Exclude specific apps or websites from tracking.
• Delete individual activity records and screenshots, or delete all captured data at once.
• Turn off launch at login, and sign out of Trace Cloud.

Your rights

Depending on where you live, you may have the right to:

• ask what personal information we hold about you and how we use it;
• have it corrected, completed, updated or erased;
• withdraw consent you have given;
• nominate someone to exercise your rights if you die or become unable to act; and
• have your grievances addressed. In India, you may also complain to the Data Protection Board of India once you have used our grievance process.

If you are in the European Economic Area, the United Kingdom or another region with similar laws, you may also have the right to object to or restrict certain processing, to data portability, and to complain to your local data protection authority.

To use any of these rights, contact us. Because we do not hold data stored on your device, we can't access or delete it for you. You can manage it directly in the App. If your Trace Cloud access comes from an organisation, we may send your request to them.

11. Use at work

Trace is meant to help people track their own time. An organisation that installs Trace on computers used by employees, contractors or anyone else is responsible for telling those people, getting their consent where the law requires it, and following employment and privacy laws. People should only be tracked on devices, and during times, where that is lawful and they have been told about it.

12. Security

Trace keeps activity data on your device and sends Trace Cloud data over encrypted connections (HTTPS). It stores sign-in tokens in your operating system's secure credential store. The Extension talks only to the App on the same computer. We limit who can access the personal information we hold and use reasonable security practices to protect it. No system is completely secure. If a personal data breach affects you, we will notify you and the authorities as the law requires.

13. Children

Trace and Trace Cloud are made for professional use and are not meant for anyone under 18. We do not knowingly collect personal information from children. If you think a child has given us personal information, contact us and we will delete it.

14. International users

We are based in India, and the Website is hosted in India. Some of our service providers may process information in other countries. When information is transferred, we take steps required by applicable law to protect it.

15. Changes to this policy

We may update this policy as Trace changes or as laws change. We will post the new version here and update the date above. If a change significantly affects how your personal information is handled, we will give notice in the App or on the Website before it takes effect. Where the law requires it, we will ask for your consent.

16. Contact and grievances

For questions, requests or complaints about privacy, contact our Grievance Officer:

We will acknowledge your message promptly and respond within the timelines required by law, and in any case within 30 days.