Privacy Policy

Who we are & what this covers

Trace is a creative portfolio, publishing, and professional network product operated by Null Origin (Pty) Ltd. This policy covers the Trace website, accounts, Studio, published portfolios, projects, and social features.

Legal operator: Null Origin (Pty) Ltd. Service address: [CONFIRM SERVICE ADDRESS]. Information Officer: [CONFIRM INFORMATION OFFICER CONTACT].

Contact support.trace@nullorigin.tech for privacy questions. Complete any marked operator fields before release.

Registration & your account

Email registration sends your email address and password to Supabase Authentication. Trace uses your authentication identifier and verification status to provision an account and manage access. Passwords are handled by the authentication provider and are not included in public profiles.

Your account contains a unique username, display name, introduction, optional avatar and contact links, social links, and chosen interests. Trace also stores onboarding state, theme and destination preferences, visibility choices, discovery preferences, tour progress, and service entitlements. Required information supports account creation and access; optional profile fields can be left empty.

Signing in with Google

When Google sign-in is enabled and you choose it, Supabase receives identity information from Google and provides Trace with your account identifier, email address, and available basic profile details such as name and profile image. Supabase manages the authentication exchange and session.

The current Trace integration does not request additional Google permissions beyond basic sign-in. It does not request access to Gmail, Google Drive, contacts, calendars, or files. Google’s own privacy terms apply to its processing. Google sign-in may be unavailable until the operator configures the provider.

Your work, drafts & uploads

Trace stores portfolio layouts, projects, development timeline entries, collections, and portfolio revisions. Content can include text, dates, categories, technologies, contributors, URLs, and images. Uploaded image records include an owner identifier, file path, size, and media metadata.

Draft records and private previews require an authenticated owner. Publishing creates a separate public snapshot. Images in the private media bucket become available to visitors when referenced by an active publication belonging to their owner. External images, video embeds, repository links, and other third-party content can send technical information to those services when accessed.

What becomes public

Publishing makes the selected content and its profile snapshot available to visitors, the Network, search engines, and people using a shared link. Published profile fields can include your name, username, introduction, avatar, interests, contact URL, and social links. Only publish information you intend to share.

Changing a draft does not automatically replace its published snapshot. Republish to update public content. Unpublishing removes the active public snapshot; making a project private removes its related active publications. Making your profile private deactivates all your publications; making only the portfolio publishing preference private removes your portfolio while separately published projects may remain public. Review each item before sharing. Copies, screenshots, search caches, and previously issued image links can remain outside Trace’s control.

Network & social interactions

Trace stores follows, saved projects, comments, reports, recommendation signals, and notifications. Comments on active publications are public. Saves, follows, reports, preferences, and notifications are available through owner-restricted account access.

Interests, saved work, followed creators or projects, publication recency, and “see less” preferences can influence discovery. Reports contain the content reference and information you submit; avoid including unnecessary sensitive information.

Cookies & local preferences

Trace uses authentication cookies to maintain and refresh sessions. Your browser also stores a theme preference locally. Studio autosave recovery may store draft content locally to help recover unsaved work; this is relevant on shared devices.

These functions support login, appearance, and editing. Blocking cookies or local storage can affect them. Trace’s inspected implementation does not include an advertising tracker or a third-party analytics SDK. Infrastructure providers may maintain technical usage and security logs.

Technical information & logs

Hosting, authentication, database, storage, and email services may process IP addresses, request timestamps, browser or device information, authentication events, errors, and delivery status. Trace’s welcome-email system stores delivery attempts, provider identifiers, and a delivery snapshot to coordinate sending and avoid duplicates.

Technical information supports service delivery, diagnosis, security, abuse prevention, and email operations. Trace does not promise a specific infrastructure log retention period where one has not been confirmed.

Why we process information

We process information to create and secure accounts, save and publish work, serve media and previews, operate discovery and social features, apply your preferences, send account and welcome emails, respond to requests, and investigate abuse or service failures.

Where applicable, processing may be necessary to provide the service you request, meet legal obligations, or pursue legitimate operational and security interests subject to your rights. Consent is used where required, including choices involving optional publication or third-party sign-in. The operator must confirm the applicable legal basis for each processing activity before release.

Service providers & international processing

The production website is hosted on Vercel. Supabase provides authentication, database, and image storage. The configured Trace database region is eu-west-1 (Ireland). The welcome-email integration uses Resend when configured. Google processes sign-in information when enabled, and linked or embedded services apply their own policies.

The operator must confirm hosting account arrangements, provider locations, subprocessors, and contractual safeguards for international transfers. Information may be processed outside South Africa or your country. Applicable transfer requirements, including POPIA where it applies, must be assessed; this policy does not assert a verified transfer agreement or certification.

Retention & account deletion

Information is retained to operate accounts, saved drafts, revision history, publications, social features, and email delivery, and where needed for legal or security purposes. No fixed retention schedule or automatic inactivity deletion has been verified.

You can edit your profile, delete supported content, and unpublish work using the product controls. Request account deletion or an information export at support.trace@nullorigin.tech. There is currently no self-service account deletion or automated export workflow. We may need to verify ownership before acting. Provider backups, logs, legal obligations, and third-party copies may limit immediate removal; the operator must confirm the deletion procedure and retention schedule.

Protecting your information

Trace uses authenticated sessions, database row-level security, owner checks, separate publication snapshots, and a private image bucket. Content schemas restrict supported components and unsafe URLs. Server-only credentials are kept separate from public clients.

No online service can guarantee absolute security. This policy does not claim a security certification, a specific encryption method, or an independently audited compliance status. Keep your account credentials private and report suspected unauthorized access to support.

Your privacy rights

Depending on the law applicable to you, you may request access, correction, deletion, information about processing, or object to or restrict certain processing. You may withdraw consent where processing relies on it, without affecting earlier lawful processing. Contact support.trace@nullorigin.tech with your request; identity verification may be required.

Where South Africa’s Protection of Personal Information Act applies, it provides rights and protections for personal information. You can raise a complaint with South Africa’s Information Regulator through inforegulator.org.za. Additional rights under other applicable laws must be assessed for Trace’s users. Nothing here limits statutory rights.

Children’s privacy

Trace’s terms require users to be at least 18. The current registration form does not verify age. Trace is not intended for children; do not submit a child’s personal information without appropriate authority and a lawful basis.

If you believe a child has supplied personal information, contact support so the operator can assess and address it. The operator must confirm this eligibility policy and any future arrangements for minors before introducing them.

Changes & contacting us

The effective date appears at the top of this page. Updated policies will be published here. Material changes should be communicated through an appropriate service or account channel; there is currently no dedicated policy-notification workflow.

For privacy, deletion, correction, or security requests, email support.trace@nullorigin.tech. The operator must complete the legal identity, address, Information Officer, provider, retention, and transfer details identified above before treating this policy as final release documentation.