A narrow intake needs a clear data boundary.

01Scope

This notice covers the public website and the design-partner intake.

This notice applies to traceaxiom.com and the form used to join the waitlist. TraceAxiom is currently an independent product project operated by Arhan Canli. A later design-partner or customer engagement will require a separate agreement describing its own data boundary.

The public form is not a channel for customer source code, credentials, security secrets, regulated records, or other sensitive material. Submit a high-level description first; a private channel and handling terms must be established before any confidential project material moves.

02Collection

The intake stores submitted fields and a narrow abuse-prevention record.

When you join the waitlist, the site collects the name, work email, company or project, description of your pull requests, and optional repository or stack description you provide. The intake function also derives a salted hash from the request IP address and stores a bounded user-agent string. It does not store the raw IP address in the access-request record.

The site does not currently run advertising pixels, cross-site trackers, behavioral analytics, or marketing cookies. Standard hosting infrastructure may process request metadata needed to deliver and protect the service.

• Submitted contact and project fields
• Salted IP hash rather than raw IP in the request record
• Bounded user-agent string
• No advertising or behavior-tracking scripts

03Purpose

Access-request data is used to evaluate and answer the request.

TraceAxiom uses the information to assess design-partner fit, understand the requested work at a high level, respond to the sender, deliver a confirmation, prevent abuse, and preserve a record of the conversation. It is not sold, rented, or used to build third-party advertising profiles.

Submitting the form does not opt you into a newsletter. If product updates or marketing communication are introduced later, they will require a distinct choice and an unsubscribe mechanism.

04Processors

Three infrastructure providers support the public intake.

Vercel hosts the website and runs the access-request function. Supabase stores validated access-request records under an insert-only public policy. Resend delivers the founder notification and requester confirmation email. These providers process information for their infrastructure roles and under their own applicable terms and privacy commitments.

TraceAxiom does not authorize those services to use access-request content for advertising. Provider locations and subprocessors can change over time; this notice will be updated when the public data path materially changes.

• Vercel: hosting and serverless intake
• Supabase: access-request storage
• Resend: transactional email
• No public read access through the form credential

05Retention

Records are kept only while they serve the access conversation or a legitimate safeguard.

Access requests are retained while they are evaluated and while related correspondence remains relevant. Records may also be kept when reasonably needed for abuse prevention, security, dispute handling, or legal obligations. TraceAxiom periodically reviews records that no longer serve those purposes.

Automated retention enforcement is not yet implemented for the design-partner intake. That is a disclosed operational limitation. You may request access, correction, or deletion using the Contact page; identity may need to be verified before a request is completed.

06Control

You can ask what is held and request correction or deletion.

Use the public contact route and select a privacy request in the message. Describe the email address used for the original request, but do not send identity documents or credentials in the first message. TraceAxiom will reply through a private channel if more information is necessary.

Privacy rights vary by location. TraceAxiom will honor applicable rights and explain any request it cannot complete. Because the project is in an early operational stage, questions about jurisdiction-specific processing should be raised before submitting confidential or regulated data.

07Changes

Material changes advance the date and remain publicly readable.

This notice is effective September 3, 2026. Material changes to the fields collected, purposes, processors, or user choices will update the effective date and the public copy. A policy date is not advanced merely to make the page appear fresh.

Security controls reduce risk but cannot promise absolute security. If TraceAxiom learns of an incident requiring notice, affected people will be contacted through the information available and according to applicable obligations.