Your data deserves
a clear explanation.

Start on your device.

You can record and review activities without a PTrace account. Your activity history is stored locally, so recording does not depend on an account or a connection to our sync service.

Local recording does not mean the app never uses the internet. Features such as maps and terrain-based elevation correction can make network requests even when activity sync is off. These requests are separate from uploading your activity history to an account.

What changes when you sync.

When you sign in with Apple and enable sync, PTrace uploads activity records to your account. This includes your existing local history, not only the activities you record afterwards. Depending on the activity, a record can contain routes, timing, recorded signals, notes and how the activity felt.

Sync lets your devices retrieve that history and lets an AI connection request the information you have allowed it to read. Permissions limit what the connected AI receives; they do not limit the activity data held by PTrace’s server.

Encryption, and its limits.

Connections to the hosted service use HTTPS to encrypt data in transit. Activity payloads are encrypted at rest using AES-256-GCM with a key held by the server. Synced glucose values and their source-app information use the same encryption mechanism.

This is not end-to-end encryption. PTrace’s server can decrypt these records to provide sync and permitted AI access, including when your phone is offline. The encryption key is controlled by the service, not exclusively by you.

Service metadata, including account identifiers, sync timestamps, connection permissions and access records, is stored separately. It is not all covered by the activity-payload encryption described above.

You choose what each AI can read.

PTrace does not host an AI model. You connect an AI service you already use, and approve its access to your PTrace account. Each connection has its own permissions, checked by the server when it requests data.

Each read level includes the levels above it. The first two levels do not include route coordinates. Routes and full samples can reveal sensitive locations, including where an activity starts or ends. The current synced route service does not apply home or privacy zones; do not assume those locations are hidden.

Permission to create charts and workouts is separate from read access. File imports require an additional permission. An AI’s ability to read an activity does not, by itself, let it create those items or import files.

You can review your connections, change permissions and revoke access on your Connections page. The updated permission applies to the next request.

Health data has another boundary.

Heart rate recorded with an activity is part of that activity. Blood glucose is a separate series, connected from Apple Health only with your permission.

Connecting glucose on your phone, syncing it to your account and letting an AI read it are separate choices. Glucose sync is off by default. An AI also needs the separate Blood glucose permission, even if you have already given it access to full activity samples.

If you enable glucose sync, the app queues the readings already in its local glucose mirror as well as later changes. This can include readings outside the time you were exercising.

A record of access.

PTrace keeps an access history for requests handled by its permission layer. It records the connected app, the action requested, the permission required, when it happened and whether access was allowed. A record can also identify the activity, view or workout involved.

You can see recent access on your Connections page, including denied attempts. This is an account of requests to PTrace. It cannot show what another service does with information after receiving it.

The web service also produces operational request logs, including requested paths, response status and timing, to help diagnose failures. Access records and service metadata are part of running the service; activity-payload encryption is not a promise that no metadata is retained.

Disconnecting is different from deleting.

Revoking an AI connection stops future access through that connection. It does not remove your synced activities from PTrace, recall a response already sent, or erase information the AI provider has stored. Review that provider’s controls if you also want to remove its copies.

Signing out ends that device’s session. It does not delete your account’s synced history or revoke your AI connections. If you want an AI to stop reading your existing synced data, revoke its connection explicitly.

When an activity deletion reaches the sync service, its stored payload is removed and a small deletion record is kept so other devices can apply the change. An offline device must reconnect for its queued deletion to reach the server.

Turning off Sync blood glucose queues removal of that series from your account. The request must reach the server before the account copy is removed. This does not delete the original readings in Apple Health or copies already shared elsewhere.

Deleting your account (in the app under Settings, Account) erases the account, its synced activities and glucose readings, and every AI connection with its access log. It also asks Apple to remove PTrace from the Sign in with Apple list in your Apple ID settings; if that request fails, or you first signed in before September 2026, you can remove it there yourself. Deleting does not remove activities stored on your device or copies an AI provider has kept. There is no published retention schedule covering operational records, and deletion should not be read as a promise of immediate erasure from every backup.

Feedback you choose to send.

You can send a short report through your connected AI or our feedback form. We do not automatically attach conversations, activity history, routes or health readings. Please leave sensitive information out of the report itself.

Reports submitted through an AI connection include the account and connection identifiers, the server version, and any diagnostic reference you choose to include. Attribution to a user or agent is supplied by the caller; it is not independent proof of who wrote or approved the message. The website form works without sign-in and does not attach an account. A hashed network address limits repeated submissions.

Reports use the same server-held at-rest encryption as synced payloads. PTrace’s operators can read them in a private review queue to investigate problems and improve the product. They are not automatically published as issues or sent to an AI provider. Report identifiers, status, timestamps and hashes used for limits and duplicate detection are stored outside that encrypted payload.

Reports expire after 90 days and are removed during inbox maintenance. This retention rule covers the live feedback inbox, not operational logs or backups. Tool-error diagnostics record an opaque reference, tool name and server version, without arguments or response bodies. A local stdio server keeps feedback in its local inbox; a server using temporary storage says so in its receipt.

The services you choose also matter.

Apple handles Sign in with Apple and the permissions you grant through Apple Health. PTrace’s backend runs on hosted infrastructure. Uploading activity files through the web also sends those files to the PTrace server for processing and adds the resulting activities to your account.

When you connect an AI, the information returned to it is handled under that provider’s own terms and settings. PTrace’s permissions control what it can retrieve from us. They do not control that provider’s retention, use of conversations or model-training settings.

This page describes the current product and its boundaries. It does not promise that any system is risk-free. Start with the least access you need, review your connections and increase access only when it helps you do something you want to do.

Report a security problem.

If you find a vulnerability in PTrace, email studio@department.se with “Security” in the subject. Describe the problem and how to reproduce it. Do not include other people’s data, route coordinates or health readings.

We investigate every report, confirm when we have received it, and ask for reasonable time to fix a problem before it is disclosed. The same contact is published in security.txt.