C-Trace Android App — Privacy Policy
Version: CTRACE-APP-PRIVACY-v1.2 · Effective Date: 1 October 2026
How the Service Works
The authorised user selects and submits the query. C-Trace routes the query to the relevant contracted third-party provider and delivers the provider response. C-Trace does not independently own or maintain the underlying third-party databases. This does not mean that C-Trace performs no processing: routing, security, delivery, account administration and audit functions may involve processing for which C-Trace has its own legal responsibilities.
1. Introduction
This Privacy Policy explains how C-Trace Soft Solutions Pvt. Ltd. (“C-Trace”, “we”, “us”) handles personal data and device/technical information in connection with the C-Trace Android application. The App is intended primarily for authorised Police / Law-Enforcement users and is not intended for general-public use.
2. Different Processing Roles
C-Trace’s legal role may differ depending on the processing activity. For officer account administration, authentication, subscription, security, support, billing and service operations, C-Trace may determine relevant purposes and means. For an authorised investigative lookup, the requesting officer/agency determines the official purpose and selects the input/identifier, while C-Trace primarily provides technical routing and delivery functionality through contracted third-party providers. The statutory role of each party depends on applicable law, governing agreements and the actual processing arrangement.
3. Officer Account Information
We may process the mobile number used to sign in; the user’s name and designation returned through an authorised verification API based on that mobile number; subscription/account status; Terms/Privacy acceptance records; and support or incident information voluntarily provided by the user.
4. Device and Technical Information
The App may process an app-generated random installation UUID, device manufacturer and model, operating-system version, App version, locale, timezone, Firebase Cloud Messaging registration token, Firebase Installation ID and Google Play Integrity/security signals. The App is not designed to collect IMEI, Android ID, hardware serial number, MAC address, IMSI/SIM serial number or Android Advertising ID.
5. App Permissions
The current App uses INTERNET, ACCESS_NETWORK_STATE and POST_NOTIFICATIONS permissions. The App does not currently request contacts, SMS, call-log, precise location, microphone, camera or storage/media permissions as part of its ordinary operation. If this changes, the Policy and relevant in-App/store disclosures will be updated before or with the relevant release.
6. Investigative Query Information
When an authorised user performs a supported lookup, the user selects the target/identifier and submits the query. The submitted identifier — such as a mobile number, vehicle identifier, UPI identifier, PAN or another supported identifier — may be transmitted through C-Trace systems to the contracted provider required to fulfil the request. C-Trace does not independently select the target of the search.
7. Provider Response Information
The relevant provider may return information associated with the submitted query from systems or data sources under that provider’s control. Provider responses may pass through C-Trace systems for transient security, encryption/decryption as technically necessary, validation, formatting and delivery. C-Trace does not independently own or maintain the provider’s underlying database and does not use investigative response content for advertising, unrelated commercial profiling or resale.
8. Local Storage on the Device
Delivered responses may be stored locally in the App using encrypted local storage, including Room/SQLCipher. Local response history remains on the authorised user’s device until the user deletes it, uses Reset Chat History, clears App data or uninstalls the App, subject to Android/device behaviour and copies previously exported or shared.
9. Server-Side Retention
Under the ordinary service design, C-Trace servers do not retain report-response payloads after delivery for independent secondary use. For audit, billing, abuse prevention, account administration and service security, limited lookup/transaction metadata may be retained for up to 90 days. Separate cybersecurity, ICT-system, incident, preservation or legally required records may be retained for longer where required by applicable law, contract or competent-authority direction.
10. Purposes of Processing
We process information to authenticate authorised users; verify service eligibility; operate and secure the App; manage subscriptions; route authorised user-initiated requests to contracted providers; deliver responses; provide notifications; prevent abuse; maintain billing/audit records; provide support; investigate security incidents; enforce Terms; comply with contracts; and comply with applicable law.
11. Third-Party Providers
C-Trace may disclose or transmit information only as reasonably necessary to contracted API/service providers used to fulfil an authorised user’s request and to supporting technology providers necessary to operate or secure the App. C-Trace’s primary application/API infrastructure is hosted in India. Current supporting Google services include Firebase Cloud Messaging, Firebase Installations and Google Play Integrity, which may process limited technical identifiers or security information under Google’s applicable terms and privacy practices.
12. Payments
The App does not currently contain an embedded payment SDK. Renewal/payment may be initiated through an external payment flow and processed by Razorpay or another approved provider, subject to the applicable distribution/payment rules. Payment credentials such as card PINs, banking passwords or UPI PINs are not collected or stored by the C-Trace App.
13. Push Notifications
The App uses Firebase Cloud Messaging for service notifications. C-Trace designs notifications to minimise disclosure of investigative response content or sensitive subject information on lock screens. Users may control notification settings through Android settings.
14. Screenshots, Exports and Sharing
The App may allow screenshots and may support exporting or sharing information as images, PDFs or Excel files. Once information is captured, downloaded, exported or shared outside the App’s encrypted local storage, the copy may be stored or processed by the user’s device, selected application or receiving system. The authorised user and agency are responsible for lawful and secure handling of such copies. Reset Chat History does not delete copies previously exported, captured, downloaded or shared outside the App.
15. Support Submissions
If a user voluntarily sends C-Trace Support a screenshot, report extract, device information or other content for troubleshooting, security or incident resolution, C-Trace may process that information only for the relevant support/incident purpose and retain it only as reasonably necessary for that purpose or where law requires longer preservation. Users should redact information that is not necessary for the support issue.
16. Security Measures
C-Trace uses reasonable technical and organisational safeguards appropriate to the service, including encrypted network transport, payload protection where implemented, SQLCipher-protected local storage, access controls, app-generated installation identifiers, Google Play Integrity checks, transaction/audit monitoring and restricted administrative access. No electronic system can be guaranteed to be completely secure.
17. Logging and Data Minimisation
C-Trace seeks to limit processing to information reasonably necessary for the relevant service, security, audit or legal requirement. Ordinary application/debug/security logs should not intentionally contain full investigative response payloads. Where a query identifier must be retained for audit or billing, C-Trace may apply access restrictions, encryption, masking, tokenisation or similar controls appropriate to the operational requirement.
18. Retention and Deletion
Retention periods depend on the category and purpose of information. Local report history remains on the device until deleted/reset by the user, cleared with App data or removed with uninstallation, subject to exported copies. Ordinary server-side lookup/audit metadata is retained for up to 90 days. Account, subscription, acceptance, support, accounting, cybersecurity, ICT-system and incident records may be retained for the period reasonably necessary for their purpose or any longer period required by applicable law, contract, dispute, investigation or competent-authority direction.
19. Reset Chat History
The Reset Chat History function is intended to delete locally stored response history within the App. It does not delete records independently maintained by C-Trace for audit/security/billing, records held by third-party providers or agencies, or copies previously exported, captured, downloaded or shared outside the App.
20. Account Access and Deactivation
C-Trace does not currently provide general-public self-registration. Authorised access is verified/provisioned through the user’s mobile number and service eligibility. An authorised user may contact C-Trace regarding C-Trace-controlled account/profile information, correction, access deactivation or privacy questions. Requests may be subject to records that C-Trace must retain for legal, security, accounting, dispute-resolution, contractual or incident-response purposes.
21. Requests Concerning Third-Party Records
C-Trace does not independently control the underlying databases maintained or accessed by third-party API providers. A request to correct, erase or challenge an underlying source record may therefore need to be addressed to the relevant provider, requesting agency or original data source, depending on the facts and applicable law.
22. Rights Under Applicable Data-Protection Law
Where applicable and subject to lawful exemptions, restrictions and role-specific limitations, individuals may have rights under Indian data-protection law concerning personal data. Such rights and C-Trace’s corresponding obligations will be handled according to the law in force at the relevant time. Processing connected with prevention, detection, investigation or prosecution of offences may be subject to specific statutory provisions, exemptions or continuing safeguards where applicable.
23. No General-Public / Child Use
The App is not intended for children or general-public use. Access is intended for verified authorised Police / LEA personnel or other specifically approved official users.
24. Security Incidents
C-Trace will investigate suspected security or personal-data incidents involving systems under its control and will take appropriate containment, remediation, preservation and notification measures where required by applicable law or competent-authority directions. Users must promptly report suspected credential compromise, unauthorised access or improper disclosure through the designated support/security channel.
25. Google Play / Distribution Transparency
Where distributed through an app store, C-Trace will maintain the disclosures required by that distribution channel and will seek to keep them consistent with actual App and SDK behaviour. Material changes to SDKs, data collection, sharing, retention or permissions require corresponding policy/disclosure review before release.
26. Changes to this Policy
C-Trace may update this Policy to reflect changes in law, App functionality, retention, security practices or providers. The current version will be made available through the App and/or official C-Trace website. Material changes may be presented for renewed acknowledgement where appropriate.
27. Privacy / Grievance Contact
- C-Trace Soft Solutions Pvt. Ltd.
- Registered Address: Mallik Chambers, Himayath nagara, Hyderabad-500029
- Privacy / Grievance Officer: Sd. Jilani
- Privacy Email: [email protected]
- Support: [email protected]