Privacy Policy
Last updated October 20, 2026
1. Who we are
Trails (“Trails”, “we”, “us”) runs the website and app at usetrails.app. Trails helps marketing teams see how their brand appears in AI assistants and Google Search, and decide what to do next.
This policy covers the website, the app, and the emails we send. It explains what data we collect, how we use it, who we share it with, and the choices you have. Questions go to support@usetrails.app.
2. Data we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | Email address. With Google sign-in, also your name and profile picture. | You, or Google when you sign in with it |
| Brand settings | Brand names, website domains, competitors, tracked prompts, keyword themes, brand descriptions, brand facts, guidelines, automation and email settings | You |
| Work you create in Trails | Action items, content briefs and drafts, topic plans, tracked plays, step checklists | You, and AI drafts you ask for |
| Public brand data | Pages on the public websites you add; AI assistants’ answers to your tracked prompts; public posts on Reddit, Hacker News and YouTube; keyword volumes and search results | We gather it for you |
| Google user data | Search Console and Google Analytics data, only if you connect them (section 3) | Google, with your permission |
| Technical | IP address, browser type and request times in server logs; a sign-in cookie | Your browser and our hosting providers |
| Product usage | Which sections of Trails you open and which actions you take (for example “copied a page for publishing”), with your account and brand ID and the time. Never the content of your drafts, prompts or Google data. | Your use of the app |
| Feedback | Ratings, reasons and notes you send us, the section you sent them from, and your email address | You |
We do not ask for payment details, government IDs or any special-category data. If you type personal data about other people into a prompt or brand description, it is processed like any other brand setting.
3. Google user data
Connecting Google is optional, read-only, and limited to the products you connect. We cannot change anything in your Google accounts, and we never access Gmail, Drive or any other Google product.
| Product | Scope | What we read |
|---|---|---|
| Google Search Console | webmasters.readonly | The properties your account can access and your permission level. For the property you choose: queries, page URLs, clicks, impressions, click-through rate and average position, by day, for up to the last 16 months. |
| Google Analytics 4 | analytics.readonly | Account and property names and each property’s website address, so we can match one to your brand. For the property you choose: sessions, engaged sessions, key events, purchases and purchase revenue, by landing page, channel, device and day, plus visits referred by AI assistants. Aggregate figures only, never data about individual visitors. |
| OAuth tokens | — | The access and refresh tokens Google issues, encrypted with AES-256-GCM before we store them. |
Trails’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We use Google user data only to provide and improve the Trails features you can see and use.
- We transfer it to third parties only to provide those features (section 5), to comply with the law, or in a merger, acquisition or asset sale, with notice to you.
- We never use or transfer it for advertising, sell it, or use it to profile people or decide creditworthiness.
- We do not use it to develop, improve or train generalized AI or machine-learning models. Trails analyzes it with its own code, not AI models. When you ask Trails to write something based on it (a brief, title options, a draft), we send what that piece needs only to AI providers whose terms prohibit training on it, never to services that may use it to improve their models.
- Nobody at Trails reads it unless you allow it for a specific request, it is needed for security, the law requires it, or it is aggregated and anonymized for internal operations.
Disconnecting. Disconnect Search Console or Google Analytics from your brand’s Settings page at any time. We revoke access with Google and delete the stored tokens immediately. You can also remove access at Google Account permissions.
4. How we use data
We use your data only to run Trails and the features you choose:
- show your brand dashboards, growth plan and AI visibility, and refresh them on a schedule while a connection is active;
- ask AI assistants your tracked prompts and analyze how they describe your brand and competitors;
- find search opportunities and turn them into plays, briefs and content drafts grounded in your brand;
- run the automations you switch on, and send in-app alerts and, if you turn it on, a weekly results email;
- keep the service secure, fix problems and answer support requests;
- learn which features help and what is missing, from product usage and the feedback you send. Google user data is never used for this.
Our legal bases, where the GDPR or UK GDPR applies: performing our contract with you (running the service), our legitimate interest in keeping it secure and working, and your consent for optional connections and emails, which you can withdraw at any time.
5. Service providers
These providers process data only to run Trails for us, under their own terms and data-protection commitments.
| Provider | What they do | What they receive |
|---|---|---|
| Vercel | Hosts the app | All app traffic |
| Supabase | Sign-in and database | Account data and everything stored in Trails, including Google data and encrypted tokens |
| Google (Gemini API), Groq, OpenRouter and the model providers it routes to | Answer your tracked prompts, analyze the answers, summarize insights and classify public posts | Brand name, competitors, tracked prompts, AI answers and public posts. Never Google user data. |
| Groq, and OpenRouter limited to providers that don’t collect data; Anthropic or OpenAI when enabled | Write briefs, title and description options, and drafts you ask for | Brand settings, and the Search Console searches and page figures the piece is about. Never Google’s free Gemini tier. |
| DataForSEO | Keyword volumes, search results, backlinks and local listings | The keywords and domains you research, which can include queries from Search Console |
| Firecrawl | Reads the public pages of websites you add | Website URLs |
| Reddit, YouTube and Hacker News (Algolia) APIs | Find public conversations about your brand | Brand and competitor names as search terms |
| Resend | Sends the weekly results email, if you turn it on | Your email address and the email’s contents |
Only the providers in the writing row above receive Google user data, and only under terms that prohibit training on it.
6. When we share data
We do not sell or rent personal data, and we do not share it for cross-context behavioral advertising. Beyond the providers in section 5, we disclose data only:
- when you ask us to;
- when the law requires it, or to protect the rights, safety or security of Trails, our users or others;
- as part of a merger, acquisition or asset sale, with notice to you first.
7. How long we keep data
| Data | How long |
|---|---|
| Account and brand data | While your account is open |
| Imported Google data | While your account is open, so trends stay available. Ask us and we delete it, and anything derived from it, within 30 days. |
| Google OAuth tokens | Until you disconnect, then deleted immediately |
| Server logs | As long as our hosting providers keep them, typically under 30 days |
| Product usage | 13 months, then deleted automatically |
| Feedback | While your account is open, so we can follow up; deleted with your account |
| Backups | Overwritten in the normal backup cycle after deletion |
To close your account, email support@usetrails.app. We delete the account and all its data, including Google user data, within 30 days.
8. Security
All traffic is encrypted with TLS. Google OAuth tokens are also encrypted at rest with AES-256-GCM. Each brand’s data is visible only to the account that owns it, and every request checks that ownership. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
9. Your rights
You can access, correct, export or delete your personal data, and object to or restrict how we use it. Email support@usetrails.app and we will reply within 30 days. We will not treat you differently for using these rights.
- EU and UK (GDPR / UK GDPR): you can also withdraw consent at any time and complain to your local data protection authority.
- California (CCPA/CPRA): you have the right to know, delete and correct, and to opt out of sale or sharing. We do not sell or share personal data as those laws define it.
- India (DPDP Act 2023): you can ask for a summary of the data we process, correct or erase it, and nominate someone to act for you. Our grievance contact is support@usetrails.app.
10. Cookies and browser storage
We use one essential cookie to keep you signed in. We use no advertising cookies, analytics trackers or third-party ad pixels, so there is no cookie banner.
The app also saves a few preferences in your browser’s local storage: when you last visited a brand, which plan steps you ticked, and similar view settings. They never leave your device, and clearing your browser data removes them.
11. Other things you should know
International transfers. Our providers process data in the United States and other countries. Where the GDPR or UK GDPR applies, transfers rely on the providers’ Standard Contractual Clauses or an adequacy decision.
Children. Trails is a business tool, not meant for anyone under 16 (under 18 in India). We do not knowingly collect children’s data.
Changes. For material changes we update the date at the top and tell account holders by email or in the app before they take effect. We ask for consent again before using Google user data in a new way.
Contact. Trails · support@usetrails.app