Privacy Policy

Last updated: October 10, 2026

Minotrace is built so that we know as little about you as possible. This page explains exactly what happens to your data.

The short version

• Your boards stay in your browser. We don't have accounts, and your boards are never sent to us unless you share one.
• Shared boards are end-to-end encrypted. We store data we can't read, and we delete it 12 months after you create the link. How the encryption works.
• No cookies, no ads, no cross-site tracking. We count visits and a few anonymous usage stats with cookie-free analytics, and we never sell or share personal data.
• No AI processes your boards. We don't send your data to AI services.

Who we are

Minotrace is a personal project by Herbert Moroni, who is responsible for your data. Contact: [email protected].

What happens to your data

Boards you create

Your boards are stored only in your browser's local storage (IndexedDB) on your device. They are not sent to us, and they stay there until you delete them. If you clear your browser data, they are deleted. That's why we recommend saving a copy with Save to file.

Boards you share

When you click Share, your browser encrypts the board before upload, and the key stays in the link, so we never receive the key and can't read your board. Security explains how.

What we store per shared board: the encrypted data, its size, and the dates it was created and expires. We don't store your IP address, browser, or any account information alongside it.

Anyone who has the link can open the board. A shared board is deleted automatically 12 months after you create it, and the link stops working from then on. There's no way to delete a shared board yourself yet. If you need one removed sooner, email us the link without the part after the #. We may also remove shared data if needed, for example in case of abuse.

Preferences

We store your theme choice (light or dark) and your Share anonymous usage stats choice in your browser's local storage. They never leave your device.

Feedback

If you send feedback through the form on the feedback page, we store what you write, the items you mark and, only if you give one, your email address, together with the date. We keep them in a database at Cloudflare (D1) and get an email notice with the same content. We don't store your IP address or browser details with it. To keep robots out, the form uses Cloudflare Turnstile, which processes technical data from your browser for that purpose; it loads only when you start filling in the form. If you email us instead, we receive your address and your message. We use all of this only to reply and improve Minotrace, keep it for up to 24 months, then delete it; you can ask us to delete yours sooner. Please don't include case data in feedback.

How long we keep data

Legal basis

We process the limited technical data needed to host Minotrace, keep it secure and prevent abuse on the basis of our legitimate interest (GDPR Art. 6(1)(f); LGPD Art. 7, IX). When you send us feedback or email us, we process your message to reply to you and improve Minotrace, on the same basis.

The anonymous usage stats also rest on our legitimate interest, in knowing which features are used so we can improve them. You can turn them off at any time.

Service providers

Minotrace runs on Cloudflare (website hosting, the share service, encrypted storage and protection against abuse). Like any web host, Cloudflare processes technical data such as your IP address to deliver the site and to limit abuse (for example, rate-limiting the share service). Cloudflare acts as our processor. See Cloudflare's Privacy Policy.

International transfers. Cloudflare may process data in the United States and other countries. Those transfers are covered by Cloudflare's Data Processing Addendum, which includes the EU Standard Contractual Clauses, and by Cloudflare's certification under the EU-U.S. Data Privacy Framework.

Cloudflare Turnstile, on the feedback form, processes your IP address, your browser and a signature of your connection, only to tell people from robots. See the Turnstile Privacy Addendum.

We use Cloudflare Web Analytics to count visits. It doesn't use cookies or fingerprinting and doesn't store your IP address. It records the page address without anything after # (where share links keep their key), the referring site, and your browser, device type and country. We only see aggregated numbers. We don't use advertising or social media trackers.

Usage stats. The app sends a few anonymous events so we know which features are used, for example "a layout was applied (Force)" or "a share link was opened". Events never include what's on your boards, names, types or links, and have no user ID. We record the country, not your IP address. You can turn this off in ☰ → Share anonymous usage stats, and nothing is sent if your browser has Global Privacy Control on. Events are kept for 3 months.

Do Not Track and Global Privacy Control

We don't track you across sites, so there is nothing for Do Not Track to turn off. If your browser sends Global Privacy Control, the app sends no usage events.

No automated decisions

We don't make automated decisions about you, and we don't build profiles.

Security

We protect your data with end-to-end encrypted sharing and the other measures described on the Security page.

Your rights

Depending on where you live (for example under the GDPR in Europe, the LGPD in Brazil, or US state laws such as the CCPA and CalOPPA), you may have the right to:

• access your personal data;
• correct it;
• delete it;
• receive a copy of it (portability);
• restrict its processing;
• object to its processing;
• know who we share it with: Cloudflare, as described above, and our email provider, which receives the feedback notices.

Similar laws in other countries, such as the POPIA (South Africa) and the NDPA (Nigeria), give comparable rights. Because we hold almost no personal data, most requests are simple. Write to [email protected] and we'll answer within 15 days.

You also have the right to lodge a complaint with a data protection authority: in Brazil, the ANPD; in the European Union, the supervisory authority of your country; in South Africa, the Information Regulator; in Nigeria, the NDPC.

Children

Minotrace is a professional tool and isn't directed to children under 16.

Changes

If we change this policy, we'll update the date at the top. Significant changes will be announced on the site.