Privacy Policy

What we collect

• Your account. If you sign in with Google we receive your name, email address, profile picture and Google account ID. If you sign in with an email link we receive your email address.
• What you tell Trove. Your startup details, business profile, house rules, custom instructions for each Trove, tasks, goals, schedules and facts you ask the crew to remember.
• Your conversations. Messages you send to your Troves, their replies, approvals you decide, briefs, standups and the history of what the crew did, including the proof behind each action (Receipts).
• Data from connected apps. When you connect an app (for example Gmail, Google Calendar, Stripe, Slack or GitHub), a Trove reads only what it needs for the task you or your schedule gave it. We store the results that appear in your chats, briefs and records, not copies of your whole inbox or account.
• Founder ops records. Launch plans, investor update drafts, customer notes the crew builds from your connected apps, and the competitor sites you ask it to watch.
• Invoices. Your clients' names, emails and addresses, line items, amounts, and the payment details you choose to show (for example bank/IBAN, JazzCash, Easypaisa, Payoneer, Wise or a Stripe link). Trove doesn't receive or hold your clients' money.
• Files and pictures you attach. Pictures, PDFs and text files you add to a chat are sent to the AI model for that reply. We keep the file names and the text of your message, not the pictures themselves.
• WhatsApp (when switched on). If you link WhatsApp, we store your phone number and the messages you exchange with your crew there. This feature is coming soon and isn't active yet.
• Billing. If you buy a plan, Paddle collects your payment details. We receive your plan, billing country, email, subscription status and transaction amounts, never your full card number.
• Referrals and affiliates. If you arrive through an invite or affiliate link, the code that sent you (see our Cookie Policy). If you join the affiliate program, your payout details and the signups and payments credited to you.
• Device details for notifications. If you turn on push notifications we store your browser's push address so we can reach you.
• Site analytics. When you visit our pages we record the page, the site that sent you, campaign tags, your country and city (worked out from your IP address, which we don't store), device and browser type, and how long the page was open. Visits are grouped with an ID that is a one-way hash that changes every day, plus a random ID kept in your browser tab's session storage. No cookies are used for this.
• Technical logs. Errors and request times, used to keep Trove running.
• Settings kept on your device (theme, language, drafts, sound, your cookie choice) in your browser's local storage.

How we use it, and why we're allowed to

• To run your crew (performing our contract with you): answer your messages, act in your apps under your house rules, write briefs, run reminders and scheduled tasks, show invoices and public pages you publish.
• To keep Trove secure and working (our legitimate interests): prevent abuse, fix errors, and understand which pages are used.
• To credit referrals and affiliates: with your consent where the law requires it (for example in the EU and UK), otherwise our legitimate interest in paying the people who send us customers.
• To bill you and meet legal duties (legal obligation): tax, accounting and responding to lawful requests.
• To contact you about your account or important changes.

We do not sell your data, we do not use it for advertising, and we do not use your data to train AI models ourselves.

What other people can see

• Invoice links. Anyone with an invoice's link can open it. Links use a long random ID that can't be guessed, but treat them like the invoice itself.
• Build-in-public page. Off by default. If you turn it on, the page at /p/your-handle is public and shows only the sections you choose.

Who helps us run Trove

We use these service providers. Each only gets what it needs to do its job:

• Supabase for sign-in and the database that stores your account, chats and records.
• Vercel to host the site and app, including Vercel Analytics and Speed Insights (privacy-friendly page counts and speed, without cookies).
• Google (Gemini API) and, if configured, other AI model providers, to understand your messages and write replies. The text of a request, which can include content from your connected apps, is sent to the model. Note: while Trove uses Google's free Gemini API tier, Google may use the content sent to it to improve its products, and people at Google may review it. Avoid putting highly sensitive information in chats until we move to a paid tier, and we'll update this policy when we do.
• Composio to connect your apps and run actions in them. Your app sign-ins (OAuth tokens) are held by Composio, not in Trove's database.
• Cloud browser providers (Composio's browser service or Browserbase) when a Trove uses its browser.
• Serper (Google search results) when a Trove searches the web or reads a page. Only the search words or the page address are sent.
• Paddle.com, our merchant of record, for checkout, payments, tax, invoices and refunds. Paddle processes your payment data under its own privacy policy.
• Meta (WhatsApp Cloud API) or Twilio, only once WhatsApp is switched on and you link your number.
• Formspark for feedback and requests you send from the site or app.
• Your browser's push service (for example Google, Apple or Mozilla) to deliver notifications you turned on.

Google user data

Trove's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In short:

• We only use Google Workspace data you connect (such as Gmail, Calendar or Drive) to provide the features you ask for in Trove.
• We don't sell it, use it for ads, or use it to build or train AI models ourselves.
• People at Trove don't read it, unless you ask us to for support, it's needed for security or the law, or it has been made anonymous.
• Google account connections for these apps are made through Composio; you can disconnect them in Settings → Connectors or from your Google account at any time.

The Windows app

The Trove desktop app shows the same account in its own window plus a small Trove in the corner of your screen. It stores your corner Trove settings on your computer and checks Trove for new items about every 20 seconds while it runs.

Your choices and rights

• Download your data any time in Settings → Data controls.
• Delete chats, history, memory or your whole account in Settings. Deleting your account removes your data from our database and disconnects your apps.
• Disconnect any app in Settings → Connectors.
• Change your cookie choice with “Cookie choices” in the site footer.
• Depending on where you live (for example the EU, UK or California), you may have rights to access, correct, delete, restrict, port or object to processing of your data, and to withdraw consent. Email us to use them; we answer within one month. You can also complain to your local data protection authority.

How long we keep data

We keep your account data while your account is open. When you delete something it is removed from our database right away; backups held by our providers roll off on their normal schedule. Site analytics don't name you and are used only in aggregate. Billing records are kept as long as tax law requires.

Children

Trove is for founders and businesses and is not meant for anyone under 16.

International transfers

We're based in Pakistan and our providers may process data in other countries, including the United States and the EU. We rely on our providers' standard safeguards, such as Standard Contractual Clauses, for these transfers.

Changes

If we change this policy in a meaningful way we'll tell you in the app or by email before it takes effect.

Contact

Questions or requests: hello@trytros.com, or write to Trove, Karachi, Sindh, Pakistan. See also our Cookie Policy, Security page and Terms of Service.