Skip to content
Trace Docs

Privacy API

These endpoints help you fulfill GDPR obligations on behalf of your users. Use them to process right-to-erasure requests and data subject access requests (DSARs).

Submit an erasure request

Section titled “Submit an erasure request”
POST /v1/privacy/erase

Request deletion of all data associated with a user’s IP address or user ID. Trace processes erasure requests asynchronously — data is scrubbed within 15 minutes.

Request body

Section titled “Request body”
{
  "ipAddress": "203.0.113.42",
  "userId": "user_12345",
  "requesterEmail": "user@example.com"
}
FieldTypeRequiredDescription
ipAddressstringno*The user’s IP address. Trace hashes this to find matching records.
userIdstringno*The user’s ID in your system. Trace looks up associated IP hashes from install records.
requesterEmailstringnoEmail of the person making the request, for audit trail purposes.

*At least one of ipAddress or userId is required.

Response 202 Accepted

Section titled “Response 202 Accepted”
{
  "requestIds": ["550e8400-e29b-41d4-a716-446655440000"],
  "status": "pending",
  "message": "Erasure request(s) submitted. Data will be scrubbed within 15 minutes."
}

What gets erased

Section titled “What gets erased”

When an erasure request is processed, Trace nullifies:

  • Clicks — IP hash, user agent, device model, fingerprint
  • Installs — IP hash, user agent, device model
  • Events — user ID, all properties
  • Open events — IP hash, user agent, device model, user ID

The record shells (IDs, timestamps, campaign IDs) are retained for aggregate analytics but contain no personal data.

Example

Section titled “Example”
Terminal window
curl -X POST https://api.traceclick.io/v1/privacy/erase \
  -H "X-Api-Key: tr_live_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"userId": "user_12345", "requesterEmail": "user@example.com"}'

Check erasure status

Section titled “Check erasure status”
GET /v1/privacy/erase/{requestId}

Check the status of a previously submitted erasure request.

Response

Section titled “Response”
{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "completed",
  "requestedAt": "2024-07-15T12:00:00Z",
  "completedAt": "2024-07-15T12:15:00Z"
}
StatusMeaning
pendingRequest received, waiting for next processing cycle (runs every 15 minutes)
completedAll matching records have been scrubbed

Example

Section titled “Example”
Terminal window
curl https://api.traceclick.io/v1/privacy/erase/550e8400-e29b-41d4-a716-446655440000 \
  -H "X-Api-Key: tr_live_xxxxxxxxxxxx"

Export user data

Section titled “Export user data”
POST /v1/privacy/export

Export all data associated with a user. Use this to fulfill data subject access requests (DSARs) under GDPR.

Request body

Section titled “Request body”
{
  "ipAddress": "203.0.113.42",
  "userId": "user_12345"
}

At least one of ipAddress or userId is required. When both are provided, Trace cross-references them to find all associated records.

Response

Section titled “Response”
{
  "clicks": [
    {
      "id": "...",
      "campaignId": "summer_sale",
      "platform": "ANDROID",
      "clickedAt": "2024-07-10T08:30:00Z"
    }
  ],
  "installs": [
    {
      "id": "...",
      "attributionMethod": "INSTALL_REFERRER",
      "platform": "ANDROID",
      "installedAt": "2024-07-10T09:00:00Z"
    }
  ],
  "events": [
    {
      "id": "...",
      "eventName": "purchase_completed",
      "properties": "{\"value\":\"49.99\"}",
      "createdAt": "2024-07-11T14:00:00Z"
    }
  ],
  "openEvents": [
    {
      "id": "...",
      "campaignId": "summer_sale",
      "attributionMethod": "CLICK_ID",
      "openedAt": "2024-07-12T10:00:00Z"
    }
  ]
}

Example

Section titled “Example”
Terminal window
curl -X POST https://api.traceclick.io/v1/privacy/export \
  -H "X-Api-Key: tr_live_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"userId": "user_12345"}'