The paperwork · privacy policy

Taste without trackers.

Effective 28 July 2026. The complete inventory of what this service knows, holds, and never collects. The commercial side of the deal lives in the terms of service.

The short version: Subscribers don't get accounts, so there is almost nothing to hold. Stripe holds your email and payment details; we hold a provisioning record and a daily usage count. No analytics scripts, no ad trackers, no data sales — the site's security policy blocks third-party scripts outright, so this isn't a promise, it's a property.
What we hold about subscribers: One row: your Stripe customer id, your plan, your issued trova_sk_… key, and a per-day count of billable calls (that's how the 500-call meter works). No name, no email, no password — your email lives with Stripe, on your receipt. Tool calls are metered by count, not logged by content: we do not keep a record of what your agent asked.
What Stripe holds: Checkout, card details, invoices, and your email address all live with Stripe, under their privacy policy. Card numbers never touch this application.
Cookies: Exactly one, and probably not for you: a session cookie set when the vault's owner signs in. Visitors and subscribers browse cookie-free — there is nothing to consent to, which is why there is no banner.
Infrastructure: The application runs on Vercel (hosting, which keeps standard request logs), stores data in Neon (Postgres), and bills through Stripe. Those three are the complete list of parties that ever see a request.
Retention and deletion: When a subscription lapses, the key is revoked but the provisioning record is kept — founding keys are numbered by order of purchase, and the record is what keeps a returning subscriber's number theirs. Want it gone entirely? Email us and we'll delete our record; ask Stripe for theirs.
Changes: If the app starts holding something new, this page says so in the same release — it is maintained as part of the schema, not as legal wallpaper. Material changes get a dated note here.

Contact: support@trova.design — deletion requests answered by a person, not a queue.