PRIVACY

Privacy policy

This policy covers both TraceAna products: the browser extension and desktop debugger, and the TraceAna GA4 Insights web application at report.traceana.com.

Last updated: September 4, 2026

Local-first debuggingThe TraceAna extension and desktop app process captured debugging information locally by default.
Read-only analytics accessTraceAna GA4 Insights reads your Google Analytics data with read-only permission and stores no analytics data in a database.
Never sold, never advertisingNo data from either product is sold, used for advertising, or used to train machine-learning models.

1. Which product this covers

TraceAna publishes two related products. They handle data differently, so each is described separately below.

  • TraceAna Debugger — the Chrome extension and Windows desktop application used to inspect network requests, APIs, performance and analytics events while developing a website.
  • TraceAna GA4 Insights — the web application at report.traceana.com that connects to a Google Analytics 4 property and produces funnel, anomaly and performance reports.

TraceAna is an independent product. It is not affiliated with, endorsed by or sponsored by Google LLC. Google, Google Analytics and Chrome are trademarks of Google LLC.

2. TraceAna Debugger (extension & desktop)

What can be visible

Depending on the feature you use, TraceAna may display network requests, URLs, methods, status codes, headers, response information, timing, analytics events, dataLayer activity, rules and other debugging information for pages you explicitly choose to debug.

Network debugging can expose sensitive values. Avoid sharing sessions containing passwords, authentication tokens, personal information or confidential data.

Why access is needed

Network access — some features need access to traffic on pages you choose to debug. Browser permissions enable those capabilities.

Page scripting — features such as Tag Watch inspect page-level objects such as a dataLayer, limited to the feature and page where it is needed.

Local storage — settings, saved requests and rules are stored locally so your workflow persists between sessions.

Where captured data goes

TraceAna Debugger is designed around local processing. Captured debugging information is not sent to an external analytics or advertising service by default.

3. TraceAna GA4 Insights (report.traceana.com)

Information received when you sign in

When you sign in with Google, we receive your email address (to identify your session), your name and profile picture (displayed in the interface), and OAuth tokens used to query the Google Analytics API on your behalf. We never receive your Google password.

Google Analytics data accessed

With your permission, TraceAna reads aggregated, report-level data from GA4 properties your Google account can already access — session, user and event counts, key-event and revenue totals where recorded, and dimension breakdowns such as campaign, source/medium, channel, landing page, device, browser, operating system and region.

TraceAna does not request or receive individual user-level records, personal identifiers of your website visitors, or raw event exports.

Technical information

Our hosting provider records standard web server logs (IP address, timestamp, requested URL, user agent) for security and troubleshooting. A single essential session cookie keeps you signed in and is removed when you sign out. No advertising cookies or third-party tracking scripts are used.

4. Google permissions requested

TraceAna GA4 Insights requests exactly these OAuth scopes and no others:

  • openid — confirms your identity so a secure session can be created.
  • email — identifies your session and shows which account is signed in.
  • profile — displays your name and profile picture in the interface.
  • .../auth/analytics.readonly — lists the GA4 properties you can access and reads report data from the property you select. This scope is read-only; it does not permit creating, modifying or deleting anything in Google Analytics.

No access is requested to Gmail, Google Drive, Contacts, Calendar or any other Google service. TraceAna can only see properties your own Google account is already permitted to see.

5. Limited Use disclosure

Google API Services User Data Policy

TraceAna's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained through Google APIs is:

  • Used only to provide and improve the user-facing features described in this policy and on this website.
  • Never transferred to third parties except as necessary to provide the service, to comply with applicable law, or as part of a merger or acquisition in which the receiving party is bound by this policy.
  • Never used for serving advertising, including retargeting, personalised or interest-based advertising.
  • Never sold to anyone, under any circumstances.
  • Never read by humans, except with your explicit consent for a specific support issue, where necessary for security or to comply with applicable law, or where the data has been aggregated and anonymised.
  • Never used to develop, improve or train generalised artificial intelligence or machine-learning models.

6. How information is used

  • Authenticate you and maintain your session
  • Show the GA4 properties you have access to
  • Query the Google Analytics Data API and render the report you requested
  • Generate PDF, Excel or CSV exports you explicitly request
  • Answer questions you type into the "Ask TraceAna" feature by querying Google Analytics
  • Maintain the security and reliability of the service

We do not use your information for marketing, profiling or advertising of any kind.

7. Storage and retention

  • OAuth tokens — server-side session storage; kept until you sign out, the session expires, or you revoke access.
  • Your email, name and picture — server-side session storage; duration of the session only.
  • GA4 report figures — short-lived server cache of approximately 15 minutes, then discarded automatically. This exists only so refreshing a report does not exhaust your Google API quota. Analytics data is never written to a permanent database.
  • Interface preferences (pinned properties, visible filters) — stored in your own browser and never transmitted to us.
  • Server logs — retained by the hosting provider, typically 30 days.

8. Sharing and third parties

We do not sell your data and do not share it with advertisers or data brokers. Information is disclosed only:

  • to Google LLC, when making Analytics API requests on your behalf — the service functioning as intended;
  • to our hosting provider, which operates the servers TraceAna runs on;
  • to an AI provider, only in the limited circumstances described in section 9;
  • where required by law, regulation or valid legal process.

9. AI features

The "Ask TraceAna" feature turns a natural-language question into a structured Google Analytics query. Most questions are handled entirely by TraceAna's own rule-based parser on the server, with nothing sent externally.

Where an operator has configured an optional AI provider, questions the parser cannot interpret are sent to that provider. In that case:

  • Only the text of your question and a list of available Google Analytics field names are sent. No analytics data, figures, personal information or Google account details are transmitted.
  • The provider returns only a query plan — which metrics, dimensions and dates to request — which is validated against an allow-list before use.
  • No figure shown to you is generated by an AI model. Every number comes from the Google Analytics Data API.

Consistent with section 5, data obtained from Google APIs is never used to train or improve any AI model.

10. Security

  • All traffic to traceana.com and report.traceana.com is encrypted with HTTPS/TLS.
  • Authentication uses Google OAuth 2.0 with PKCE and CSRF state validation. TraceAna never sees or stores your Google password.
  • Session cookies are set Secure and HttpOnly and are not readable by client-side scripts.
  • Access tokens are held server-side and never exposed to the browser.
  • Configuration files containing credentials are blocked from public web access at the server level.

No system can be guaranteed perfectly secure. Report suspected vulnerabilities to [email protected].

11. Your rights and choices

  • Revoke access at any time at myaccount.google.com/permissions. Revocation takes effect immediately.
  • Sign out inside the application to clear your session and its stored tokens.
  • Clear local preferences by clearing your browser data for report.traceana.com.
  • Request deletion of any residual information by emailing us. Because no permanent database of your analytics data exists, signing out and revoking access removes everything associated with you in most cases.

Depending on where you live you may have further rights under laws such as the GDPR or the DPDP Act, including access, correction, erasure, restriction and portability. Contact us and we will respond within the period required by applicable law.

12. What we do not do

  • We do not sell captured debugging traffic or analytics data.
  • We do not use captured data as advertising data.
  • We do not introduce remote JavaScript or third-party tracking scripts into the TraceAna product.
  • We do not request browser or Google permissions that a shipped feature does not need.

13. Children

TraceAna is a developer and business analytics tool, not directed at children. We do not knowingly collect information from anyone under 16.

14. Changes to this policy

If this policy changes materially we will update the date above and, where significant, give notice in the product. Continued use after a change constitutes acceptance.

15. Contact

Privacy, security and general questions: [email protected]