Legal

Privacy Policy

Traceptor is a debugging proxy. It sees an enormous amount of sensitive traffic — so the design rule is simple: that traffic never leaves your Mac, and we build so that we could not read it even if asked.

Last updated July 20, 2026

01The short version

Everything Traceptor captures — requests, responses, headers, bodies, cookies, tokens, your rules, and your generated certificates — stays on your Mac. None of it is transmitted to us, ever. There is no account to create and nothing to sign in to in order to use the app.

The longer version below exists because “offline app” is never the whole truth. Traceptor does make a small number of network calls — to check a license, to look for updates, and to send anonymous usage counters you can switch off. Section 4 lists every one of them.

02Who we are

Traceptor (“we”, “us”) is the developer of the Software described here and is responsible for the limited data covered by this policy. For anything in it, including data requests, write to support@traceptor.com.

03What stays on your Mac

These never leave your device. They are stored in your user library and, where relevant, your macOS Keychain — under your control, subject to your own backups:

Captured HTTP/HTTPS traffic — URLs, headers, bodies, cookies, credentials, and WebSocket frames.
Session files you save or export.
Your rules: Map Local, Map Remote, breakpoints, match & replace, scripts, and blocklists.
The Traceptor root certificate and every leaf certificate it generates. The private keys are generated on your Mac and we never receive them.
Application settings, window state, and the local caches behind features like the PDF editor, archive tool, and app size analyzer.

Because captured traffic is stored locally in readable form, anyone with access to your Mac user account can read it. Treat saved sessions like the credentials they often contain.

04What leaves your Mac

The complete list. Nothing else in the app initiates a connection on its own.

License activationWhen you enter a license key, the app sends the key and a device identifier to our server to activate a seat, and afterwards periodically to confirm it is still valid. This tells us which key is in use on how many devices — not what you do with the app.

Update checksThe app asks download.traceptor.com for the current version feed. Like any web request this reveals your IP address and app version to the server serving the file. We do not build profiles from update traffic.

Traceptor InsightAnonymous, opt-out usage counters. Detailed in section 5.

iCloud backupOptional. If you enable it, your rules and settings sync to your own iCloud private database via Apple CloudKit. It is your Apple account and your storage — we have no access to it and cannot read its contents.

Live SessionOptional, and only while you actively run a session. Questions and votes relay through our server to the audience joined via your session code. Treat anything you put on the shared overlay as visible to everyone holding that code.

World Tech StatusIf you open this tab, the app fetches public status feeds directly from those third-party providers. Those requests go to them, not through us, and are subject to their privacy policies.

Support emailIf you email us, we keep the correspondence so we can answer and follow up. Please redact captured traffic before attaching it to a bug report.

05Traceptor Insight — the anonymous counters

Insight answers one question for us: which features are actually used, so we know what to improve. It is built to be incapable of identifying you.

A single event is one row, and the row holds exactly four fields:

dayThe UTC date, e.g. 2026-07-20. No clock time.

uidA random UUID generated on first launch and stored on your Mac. It is not derived from your hardware, Apple ID, email, licence, or anything else about you — it is a random number, and deleting the app’s preferences produces a new, unlinkable one.

eventA fixed name from a list we ship, such as app_open or tab.repeater. Never a URL, hostname, filename, or anything drawn from your captured traffic.

countryA two-letter country code, resolved at the network edge from the connection. This is the only geographic data we hold and it is what draws the map on our public stats page.

We do not store your IP address. The country code is derived from the connection at the edge and the IP itself is discarded — it is never written to our database. Our API does keep short-lived, per-IP counters purely to rate-limit abuse; those expire automatically and are not joined to Insight data or to you.

The app also sends each event at most once per day, so the data cannot reconstruct a timeline of your session. Aggregates are published openly at traceptor.com/insights.

To switch it off: Settings → General → Traceptor Insight → turn off Share Anonymous Usage. Nothing is sent from that point on. Development builds never send anything at all.

06Payments

Purchases are handled by Lemon Squeezy, which acts as the merchant of record. They collect and process your payment details, billing address, and any tax information — we never see or store your card number. We receive the order record, your email address, and the license issued against it, which we use to deliver your key and provide support.

Lemon Squeezy’s handling of your payment data is governed by their own privacy policy.

07This website

The site is a static export served from Cloudflare’s edge. We do not run third-party advertising or cross-site tracking, and we do not set analytics cookies.

Cloudflare processes requests as our infrastructure provider and keeps standard, short-lived edge logs for security and abuse prevention.
Your theme preference is kept in your browser’s local storage. It never reaches us.
The assistant in the corner of the site answers from a knowledge base bundled into the page. It makes no network requests — your questions are not sent anywhere, including to us.

08How long we keep things

Insight events — retained in aggregate. Because rows carry no identifier tied to you, they cannot be traced back for deletion.
License and order records — kept while the license is active and afterwards for as long as tax and accounting law requires.
Support email — kept while it is useful for supporting you, then deleted.
Live Session data — held only for the life of the session and discarded when it ends.

09Your rights

The app itself collects no personal data. Nothing Traceptor captures — traffic, rules, certificates — is ever sent to us, and the counters in section 5 are not tied to your identity. The only personal data we hold comes from buying the app or writing to us.

In practice that is:

Your email address and order record, passed to us by Lemon Squeezy so we can send your license key and support you.
Your license key and the device identifier it is activated on, so we can enforce the seat count you bought.
Any support correspondence you choose to send us.
If you run a Live Session, the names and questions participants submit — held only for the length of that session, as described in section 4.

Depending on where you live — under the GDPR, the UK GDPR, or the CCPA/CPRA among others — you may have the right to access, correct, export, or delete that data, to object to processing, and to complain to your data protection authority.

Email support@traceptor.com and we will respond within 30 days. We do not sell or share personal information for advertising, and we never have.

Where we rely on a legal basis under the GDPR: performing our contract with you (license delivery and validation), your consent (Insight, which is opt-out at any time), and our legitimate interest in a secure, working service (abuse prevention).

10International transfers

Our infrastructure providers — Cloudflare, Lemon Squeezy, and Apple for iCloud — operate globally, so the limited data described above may be processed outside your country, including in the United States. Transfers rely on the safeguards those providers maintain, such as standard contractual clauses.

11Children

Traceptor is a developer tool and is not directed at children under 16. We do not knowingly collect personal data from them.

12Security

Traffic to our servers is encrypted in transit. The strongest protection here is architectural rather than procedural: the sensitive material Traceptor handles is never sent to us, so there is no store of your captured traffic for anyone to breach. If you believe you have found a vulnerability, please report it to support@traceptor.com before disclosing it publicly.

13Changes to this policy

If we change how data is handled we will update this page and move the date at the top. Material changes — particularly any new category of data leaving your Mac — will also be announced in the app’s release notes. Continuing to use Traceptor after a change means you accept the updated policy.