Privacy policy

Effective September 22, 2026 · Trove is built and operated by Hollyburn Analytics Inc., 200-120 Lonsdale Ave, North Vancouver, British Columbia, V7M 2E8, Canada, which is the data controller.

The short version: we collect what's needed to run your account and your connection, we don't sell it, we don't run ads, and you can delete all of it.

What we collect

• Account information — your name and email, handled by our sign-in provider (Clerk).
• Your configuration — which toolkits you've enabled and any toolkits you've deployed.
• Your content — documents you save to your library, stored in your own isolated per-user store.
• Toolkit credentials — API keys you provide, sealed in an encrypted, write-only vault (see the security overview).
• Operational records — tool-call metadata (which tool ran, when, and whether it succeeded) used for reliability, debugging, and abuse prevention. Tool arguments and results are not stored; short-lived operational logs expire within seven days, and the code paths that handle tool calls and credentials write no payloads or secret values into them.
• Site analytics — this website sends first-party, cookieless event counts (e.g. "the copy button was clicked") with no user identifiers, no cookies, and no fingerprinting. A random token generated per page view (never stored in your browser) lets us count steps within a single visit.

What we don't do

We don't sell your data. We don't share it with advertisers. We don't use your content to train models. Your content is processed only to provide the service — for example, generating the search embeddings that make your library searchable.

Services you connect

Some toolkits read your own data from a service you already use. Trove reaches such a service only after you have authorized it through that provider's own sign-in and consent screen, and we ask for the narrowest access the feature needs.

What comes back is used solely to answer your own requests. It is never sold, never shared for advertising, and never used to train machine-learning models. Access and refresh tokens are encrypted at rest, are used only to reach that provider on your behalf, and are disclosed to no one.

You can disconnect a service at any time, from your Trove dashboard or from the provider's own account settings. Disconnecting deletes the stored token immediately. Data retrieved from that service is deleted within 30 days of disconnection, of your request, or of your account closing — except where the law requires us to keep it.

Why we're allowed to process your data

For users in the European Union and the United Kingdom, we rely on two lawful bases under Article 6 of the GDPR: your consent, and the necessity of processing to perform our contract with you. If you don't provide the data a feature needs, we can't provide that feature. You can withdraw consent at any time by disconnecting a service, deleting your content, or asking us to close your account; withdrawal doesn't make earlier processing unlawful.

Your rights

Under the GDPR you have the rights to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, and to object. To exercise any of them, email us. If you think we've handled your data badly, tell us first so we can fix it — and you may also complain to the data protection authority for the country where you live or work, or where you believe the problem arose.

Age

You must be at least 16 to use Trove. We don't knowingly collect data from anyone younger, and we delete it if we discover we have.

Where your data lives

Trove runs on Cloudflare's developer platform, where your account data, your saved files and your per-user store live. Four providers process personal data on our behalf:

• Cloudflare — hosting, storage, and the AI models that generate search embeddings, transcribe audio, and format documents. These models run inside Cloudflare; your content does not leave it for them.
• Clerk — sign-in, and the account name and email that go with it.
• Turbopuffer — the search index. It holds the text of your documents and the queries you search them with, keyed to your account, on infrastructure in the United States.
• Anthropic — the model behind features that read your library to write something back: briefings, summaries, and the memories Trove forms about what you read. Anthropic does not train on this content.

We also send audio to a speech-to-text provider for the higher-quality transcription tier. Only the audio reaches them — no account identifier, nothing that ties a recording to you.

When a toolkit calls an upstream source, your query goes to that source under its own terms — that's the point of the tool — and each toolkit's page says exactly which source it talks to. Toolkits and sources you add yourself send data to whichever services you point them at.

These providers operate globally, so your data is processed in the United States. Where we transfer the personal data of users in the United Kingdom or the European Union, we do so only to a country the relevant authority has found adequate, or under appropriate safeguards such as standard contractual clauses.

How long we keep it

Account and library data is kept for as long as your account is open, so that the service works. Operational logs expire within seven days. Data from a connected service goes within 30 days of disconnection, as described above. Closing your account removes the rest.

Deletion

Deleting your account — from your account menu, or by emailing us — purges your per-user store, stored files, credentials, and connection state. You can also remove any individual credential or disable any toolkit at any time from your dashboard.

Changes & contact

If this policy changes materially, we'll note it here with a new effective date. Questions, or a deletion request we can help with? Email us — a human reads every message.