The paperwork · privacy policy

How Trova handles your data.

Effective 30 September 2026. Application storage and provider processing, with unverified retention settings identified explicitly. The commercial side of the deal lives in the terms of service.

The short version: Trova stores subscriber provisioning and usage records. Stripe processes payments; hosting and email services also process requests. This page distinguishes application storage from provider logs and support correspondence. We do not sell subscriber data.
What we hold about subscribers: The application stores your email, Stripe customer and subscription identifiers, plan, subscription status, paid-through date and bearer access key. Daily usage rows store the subscriber identifier, UTC date and call count. These rows meter calls rather than storing tool arguments. Anonymous quota and abuse limits keep platform-reported client IP identifiers in server-instance memory; free quota windows last up to 24 hours and are also cleared by restarts or eviction. The application does not intentionally persist prompts in these usage rows; hosting and error-log configuration require a separate operational review.
If you join the waitlist: While checkout is closed, the pricing form stores the email you give and the plan you picked, with the time. It is used for one message, when checkout opens, and the row is deleted once that message is sent. It is never shared, sold or added to a newsletter. To be removed sooner, email the operator from the same address.
What Stripe holds: Checkout, card details, invoices, and your email address all live with Stripe, under their privacy policy. Card numbers never touch this application.
Cookies: Owner sign-in uses authentication cookies. Theme, sound, keyboard, and design-era preferences are stored locally in your browser. Reference shortlists, including the selected public notes and optional project brief, are also stored in this browser; they are not synced to an account or sent to application analytics. The project brief is included when you copy or download your brief, but not when you copy links. Share links contain public reference identifiers, not your project text or stored notes; anyone with the link can open that selection. Clear references in the shortlist tray and use “Clear project brief” to delete the project context separately, or remove this site's browser data to delete both. If storage is blocked, the shortlist and project context last only while the page remains open. Subscribers do not need an application account. Payment and recovery providers have their own storage practices; an application-level cookie statement does not describe every provider.
Infrastructure: Vercel hosts the application and processes request/access logs. Vercel production deployments load Web Analytics for website traffic measurement when enabled in the hosting account. Application analytics allow only the home, vault, pricing, guide, privacy and terms page paths, omit query strings and fragments, and exclude checkout, recovery and owner pages. When optional activation measurement is enabled, the application also reports reference saves, successful brief copies, clipboard failures, download starts, and free setup-configuration copies. These events contain only fixed action, page-category, and coding-tool labels. They do not contain project text, search terms, reference names or identifiers, email addresses, or keys. Reference-detail event URLs are grouped together, with query strings and fragments removed. Signed-in owners are excluded. A download start does not establish that a file was saved or used, and copying setup does not establish a working connection. Provider retention and collection settings still require operational confirmation. Neon stores the database. Stripe handles checkout, billing and receipts. When configured, Resend delivers recovery messages containing your email and access key. Manual support correspondence is held in the support mailbox. Provider log, mail and backup retention settings have not yet been verified; do not include prompts, keys or checkout URLs in support requests.
Retention and deletion: Provisioning records remain after cancellation so returning founding subscribers retain their number. The application currently has no automatic deletion schedule for provisioning or daily usage rows. Inactive subscriptions lose paid access. For deletion or access requests, email the operator from the email on your receipt; identity must be verified before records are changed. Payment records and provider backups follow their providers' retention requirements; deletion timing for those systems needs operational confirmation.
Changes: Policy updated 30 September 2026 to reflect stored subscriber email, anonymous quota identifiers, recovery email and support records, and on 10 October 2026 for the pre-launch waitlist. Provider retention periods and production log-redaction settings remain under review; this page will be revised after that inventory is verified.

Contact: hello@trova.design — deletion requests answered by a person, not a queue.