Trovery Privacy Policy
Trovery ("the app", "we") is a personal collection app operated by byVivian, based in Canada. This policy explains what information Trovery collects, how it's used, and your choices.
What we collect
Account information. When you create an account: your email address and a password (handled by our authentication provider — we never see your password in plain text). Optionally, a username, display name, and avatar photo for your profile.
Your content. The lists, items, notes, tags, ratings, reviews, due dates, and photos or screenshots you save in the app. Photos you upload are stored on our servers so they can appear on your devices and in lists you choose to share.
About photo URLs. Each photo you upload is stored at its own file address. That address isn't access-restricted — anyone who has the exact URL can view that one photo, whether or not you've shared the list it belongs to. We don't publish, index, or link to these URLs anywhere, so in practice they're only reachable if the URL itself is leaked or logged somewhere outside Trovery. If this matters to you, avoid sharing screenshots of the app that expose a photo's raw URL.
App analytics. We use PostHog to understand how the app is used — which screens are opened, which features are tapped, and whether core actions (like saving an item or sharing a list) succeed. Once you sign in this is tied to a random identifier for your account — not your name or email — so the picture stays consistent if you reinstall the app or use Trovery in a browser; before you sign in it's tied to a random identifier for that install. Screen names are recorded as generic patterns (for example "item details"), never the contents of your lists. There is no session recording. PostHog processes this data in the United States. See PostHog's privacy policy.
Abuse prevention. When you sign up or reset your password, we use hCaptcha to check that you're not an automated bot. hCaptcha (Intuition Machines, Inc.) receives device and interaction signals for this check. See hCaptcha's privacy policy.
We do not collect advertising identifiers, your device's location, contacts, or browsing history, and Trovery contains no ads. To make address search return nearby results, the app reads your device's time zone (a setting like "America/Toronto") — that is not your location.
Website analytics. This website uses Cloudflare Web Analytics to measure page views. It does not use cookies or any other client-side tracking, and it does not collect personal data — only aggregate, anonymous traffic counts.
AI features
Trovery's core features use AI. When you use them, relevant content is sent to the service provider to generate a result:
- Anthropic (Claude API): images you choose to analyse (screenshots, camera photos) and item/list text (titles, notes, list names) for auto-categorisation, tag and description suggestions, and recommendations. See Anthropic's privacy policy.
- Image suggestions: item or list titles may be sent as search queries to Brave Search, Unsplash, Apple (iTunes Search), Open Library, Wikipedia, and Openverse to find images. If you choose an Unsplash photo, our servers let Unsplash know it was used, as their terms require.
- Addresses and maps: an address you save on an item is sent to OpenStreetMap Nominatim to look up its coordinates, and those coordinates are sent to MapTiler to draw a small map.
- Link previews: URLs you paste are fetched by our servers to pull a title and image.
AI output can be wrong — you can always review and correct it.
Where your data lives
Your account and content are stored with Supabase in the ca-central-1 region (Canada). Payments, if offered, are processed by Google Play — we never see your payment details.
Sharing
Content is private by default. If you share a list with specific people, those people can view (or edit, if you allow) that list. If you make a list public, anyone with the link can view it. You can change or revoke sharing at any time in list settings.
Reporting. If you report a shared list or item, we store your report — the reason you choose, any note you add, and your account identifier (or "anonymous" if you're not signed in) — and email it to us through our email provider, Resend, so we can review it. We may make a reported list unavailable while we look into it.
How long we keep it
Your content is kept until you delete it or delete your account.
Deleting your account
You can delete your account in the app: Profile → Delete account. This permanently removes your profile, lists, items, images, and sharing records. The underlying authentication record is removed within 24 hours. You can also request deletion by emailing support@mytrovery.com, or use the web deletion instructions.
Your rights
Under Canadian privacy law (PIPEDA) and similar laws elsewhere, you may request access to, correction of, or deletion of your personal information by contacting us at support@mytrovery.com.
Children
Trovery is not directed at children under 13, and we do not knowingly collect their information.
Changes
We'll update this page if our practices change, and note the date above.