Privacy Policy
Version 2.5 — Effective July 13, 2026
1. Who is responsible
The data controller is HUGUES LLC (« we », « us »), a Wyoming limited liability company, registered office: 1309 Coffeen Ave STE 1200, Sheridan, WY 82801, USA.
For any question regarding your data: hello@trag.studio.
2. Core principle: local-first design
Trag Studio is a desktop application designed to run entirely on your machine. The following are processed exclusively on your device and are never transmitted to us through normal use of the software:
- Your prompts and text inputs
- Your input files (images, video, audio you provide)
- Your generated content (Outputs) — images, videos, music
- Your AI model usage and generation history
We have no technical access to any of this data. It stays on your drives.
We only process personal data for the connected features (account, license, billing, opt-in telemetry, support) described below.
3. Data we process
| Category | Data | When |
|---|---|---|
| Account | Email address, OAuth identifier (Google/Apple), display name, avatar | Account creation / login |
| License & activation | License key, tier, machine fingerprint (hashed hardware characteristics — CPU, GPU, motherboard), machine label, activation dates | Purchase and activation of Pro license |
| Billing | Customer and transaction identifiers (Lemon Squeezy), payment status, invoices. We never store your payment card data (handled entirely by Lemon Squeezy). | Purchase |
| Opt-in telemetry | Anonymized or pseudonymized usage events (e.g. feature opened). Disabled by default. | Only if you enable « Help improve Trag » in settings |
| Support | Content of your support requests, email address | When you contact us |
| Website | IP address, browser user-agent (standard server logs via Cloudflare) | Visiting trag.studio |
4. Purposes and legal bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Providing account, license, and billing services | Performance of contract (Art. 6.1.b) |
| Optional telemetry for product improvement | Your consent (Art. 6.1.a), withdrawable anytime in Settings |
| Marketing communications / newsletter | Your consent (Art. 6.1.a), withdrawable via unsubscribe link |
| Security, fraud prevention, license abuse detection | Legitimate interest (Art. 6.1.f) |
| Compliance with legal obligations (accounting, tax) | Legal obligation (Art. 6.1.c) |
5. Sub-processors and third parties
We use the following service providers, acting as data processors under written agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Authentication (Google/Apple OAuth, email/password), user database, license management | US (Ohio) |
| Lemon Squeezy | Payment processing, billing, invoicing. Acts as Merchant of Record — applies its own privacy policy. | US |
| Cloudflare | Website hosting (Cloudflare Pages), CDN, DDoS protection. See §11 — Cookies. | Global (edge network) |
| PostHog | Product analytics — anonymous, cookieless audience measurement (no personal data; IP discarded). Optional session replay, with all text masked, only with your consent. See Cookie Policy. | EU |
| Google / Apple | OAuth login (only if you choose this method). These providers act as independent controllers for the authentication step. | US / Global |
AI models are downloaded by your machine directly from their public sources (Hugging Face, GitHub, etc.). These downloads are governed by those third parties' policies and do not transit through our servers.
We do not sell your personal data. Not now, not ever.
6. International transfers
Our servers (Supabase) are located in the United States. For users in the EEA, UK, or Switzerland, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) where applicable. Details available on request at hello@trag.studio.
7. Retention periods
| Data | Retention |
|---|---|
| Account | As long as the account is active, then 90 days after deletion request |
| License & billing | Duration of the relationship, then according to legal accounting obligations (up to 10 years) |
| Opt-in telemetry | 24 months, then irreversible anonymization |
| Support tickets | 3 years from last activity |
| Server logs (Cloudflare) | 30 days (per Cloudflare defaults) |
8. Your rights
Under applicable data protection laws (including GDPR for EEA/UK users), you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate or incomplete data
- Erasure (« right to be forgotten ») — request deletion of your data
- Restriction — limit how we process your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — at any time, without affecting prior lawful processing
You can exercise many of these rights directly from your account panel (export, deletion). For anything else, email hello@trag.studio. We respond within 30 days.
You may also lodge a complaint with your local supervisory authority (e.g., CNIL in France, ICO in the UK).
9. Security
We implement reasonable technical and organizational measures:
- Encryption in transit: TLS 1.3 for all communications (website, API, auth)
- Per-user data isolation: Row-Level Security (RLS) policies in Supabase
- Secrets management: Signing keys and secrets stored server-side, never in the client app
- Access control: Least-privilege access to production systems
- No local data access: Your generated content is never accessible to us by design
No system is infallible. We cannot guarantee absolute security, but we design with security as a first principle — not an afterthought.
10. Children
Trag Studio is not intended for persons under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent and believe your child has provided us with personal data, contact us at hello@trag.studio.
11. Cookies & similar technologies
Strictly-necessary cookies:
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
__cf_bm | Cloudflare bot management — distinguishes humans from bots | 30 min | Strictly necessary |
cf_clearance | Cloudflare challenge clearance — stores proof of passing a security challenge | 30 min | Strictly necessary |
trag_session | Authentication session — keeps you logged in | Session | Strictly necessary |
trag_consent | Stores your cookie consent preferences | 12 months | Strictly necessary |
| PostHog (audience) | Anonymous, cookieless audience measurement — active by default, no personal data, IP discarded. Session replay (text masked) only after consent. | Session / consent | Anonymous measurement · replay opt-in |
The Trag Studio desktop application does not use cookies or any browser-based tracking. It stores your license and preferences locally.
You can manage or withdraw cookie consent at any time via the Cookie Settings link in the website footer.
12. Changes to this policy
We may update this Privacy Policy from time to time. The latest version is always published at https://trag.studio/privacy with its effective date. Material changes will be notified to you by email and/or a prominent notice on the website.
13. Contact
HUGUES LLC
1309 Coffeen Ave STE 1200
Sheridan, WY 82801
United States
Email: hello@trag.studio
Website: trag.studio