Privacy Policy

1.Who we are

Trov is a service of TrovLabs, Inc., a New Jersey corporation in the United States. For the personal data in this policy, TrovLabs, Inc. is responsible ("controller"). Questions and requests: hello@trov.dev.

2.What we collect

Your account. When you sign in with GitHub (through Trov's GitHub App), Trov reads your GitHub username, display name, profile picture, GitHub account id and your primary, verified email address, and nothing else. With Google we receive your Google account id, name, picture and verified email address (openid email profile). We use the provider's access token only during sign-in and do not store it. You choose a handle, a display name and a color; you may upload a photo and change the address digests go to.

What your organization records about you. Your role (owner, admin, member), and optionally a title and a note on what you are responsible for, set by an admin. Your title is shown to your team; the responsibilities note is readable by the organization's admins and by the agents its members connect, which use it to assign work.

What you and your agents write. Docs and their versions, decisions, feed entries, tickets and comments, sprints and the roadmap, handoffs, prompts, artifacts and the files and images you upload — with who wrote each one and when.

Ask Trov. The questions you ask and its answers, the files you attach (kept as your private artifacts), what you tell it about how to answer you, and the "Wrong?" reports you send. Your conversations are visible only to you. When you report that an item an answer cited is wrong or out of date, people in the organization see the report on that item in Review, as a reason only, without your name or the conversation.

Connected repository data. When an admin connects a GitHub repository, Trov's GitHub App reads it with read-only permissions (metadata, contents, pull requests, issues, Actions, checks, deployments and commit statuses) and captures pull requests and issues (titles and descriptions), pushes, reviews, deployments and CI results, including the GitHub usernames of the people involved — also people who never signed in to Trov, such as outside contributors. It does not store commit authors' email addresses. The repository owner's GitHub picture becomes the organization's image. While connecting, Trov uses a short-lived GitHub token to list the installations you can reach, then revokes it.

Integrations an organization adds. Tokens for Railway, Cloudflare Analytics or its own metrics endpoint, stored encrypted and used only to read figures (requests, errors, CPU, memory, active users) from those services; and the website addresses it asks Trov to health-check.

Agent connections. The app's name and return address, the organizations it may use, and when it was created and last used. Tokens are stored only as one-way hashes.

Billing. When an owner buys a plan, Stripe collects the payment details, billing address and any tax id on its own page. We send Stripe the buyer's verified email address, their handle and, for an upgrade, the organization's address, and keep what Stripe sends back: the Stripe customer and subscription ids, the plan, its status, the number of seats, the current period's end, and whether it is set to cancel.

Bug reports and support messages. What you write, with the screen you were on, your organization, the app version and your browser's user agent; signed out (the Contact form), the page, your browser and the email address you type, which we use only to reply. No screenshot, page content or IP address is stored with a report.

Email. Your email preferences, whether you unsubscribed, and a log of the digests sent to you (when, which, and whether delivery worked).

Usage and security. Counts of what each person does in an organization each day (reads, writes, agent requests by tool), which Trov's operators see as totals, to understand how Trov is used; rate-limit counters, which for the signed-out Contact form use a keyed hash of your IP address, never the address itself.

Technical data. Our host, Cloudflare, processes your IP address and request details to serve and protect Trov. Its logs keep the addresses Trov was asked for (which can contain a handle or an organization's address) and Trov's own log lines, which are scrubbed of secrets.

3.How we use it, and why we may

• to sign you in, keep you signed in and keep accounts secure;
• to provide Trov — store, search, show and attribute your team's content, and let connected agents read and propose changes as you;
• to take payment for a paid plan, keep an organization on the plan it paid for, and apply each plan's limits;
• to summarize captured pull requests and issues;
• where an organization's AI switch is on, to answer the questions a person asks Ask Trov, to set a screen's filters from words a person types, to write notes, briefs, the weekly email's highlights and suggestions from the organization's own content, and to sort and check its items (Terms, section 10, AI features);
• where an admin of an organization turns it on, to add one of the organization's tags to its feed entries, docs and decisions that Sift, using a TypeSafe AI model, judges fit it (or to suggest it, for a person to decide, where Sift is less sure), when an admin adds that tag or asks for it;
• to send the emails described in section 7;
• to answer support messages, and to run, debug and protect the service.

We do this because it is necessary to provide the service you signed up for and to carry out a purchase (contract); for our legitimate interest in keeping Trov secure, working and supported; and to meet legal duties such as keeping tax records. We do not use your content to train AI models, and we do not use it for advertising.

4.Who can see it, and who processes it

Your team. What you add to an organization is visible to its members and the agents they connect; an artifact you keep private is visible only to you. Owners and admins manage content and members. Members can see the organization's plan and limits; only owners open its invoices and payment details, which Stripe shows.

Trov's operators. The people at TrovLabs who run Trov can see each organization's name, address, plan and status, its members' names, handles, roles and titles, pending invitations, usage counts and sizes, its admin history, and the support messages people send. Their tools do not show an organization's content. They can act on an account or organization — for example add themselves as an owner, suspend it or delete it — and may access stored data, only for support, security or legal reasons. Adding themselves to an organization is recorded in its history.

Service providers that process data for us, to run Trov:

The model that sorts and checks items is TypeSafe AI's own, on services hosted in the United States, and TypeSafe AI does not train or fine-tune any model on what Trov sends it. TypeSafe AI's own subprocessors are listed at trust.typesafe.ai/subprocessors.

Anthropic handles the text sent for summaries under Anthropic's Commercial Terms of Service, which apply to Trov's API account. Railway, Cloudflare Analytics and an organization's own endpoint receive only Trov's requests with the token its admins saved, and send back figures. The agent clients you connect (Claude Code, Cursor and others) receive what they read on your behalf; they are your tools, under their own terms, not our processors.

Everything else Trov sends Anthropic, for Ask Trov and the features in section 3, goes through the same API account, under the same terms. Neither Anthropic nor TypeSafe AI is sent a connected repository's source code or diffs, secrets, integration keys, or anything from another organization. Source code reaches Anthropic only when you attach a file of it to a question in Ask Trov, and the file is sent as it is.

We may also disclose data if the law requires it, or to protect the rights and safety of people and the service. If TrovLabs is part of a merger or acquisition, personal data may pass to the new owner under this policy. We do not sell or rent personal data, and we do not share it for advertising.

5.What your browser loads from others

Trov's pages, typefaces and diagram renderer are all served from trov.dev, so opening the site or the app sends nothing to Google Fonts or a script CDN. A few things do load from elsewhere, and send your IP address to whoever serves them:

• Profile pictures from GitHub or Google, unless the person uploaded a photo to Trov: they load from GitHub's and Google's servers wherever that person is shown.
• Images a doc links from another website load from that website.
• HTML artifacts a team uploads run in a sandbox, cut off from your session, and may load scripts from the cdnjs and jsDelivr code CDNs, and styles and fonts from Google Fonts, if their author used them.
• Payment happens on Stripe's own page, under Stripe's privacy policy. When Trov shows Stripe's payment form on its own payment page instead, Stripe's script (Stripe.js) runs on that page, and only there, and sets Stripe's own cookies, including ones Stripe uses to prevent fraud.

6.Cookies and browser storage

Trov sets only the cookies it needs to work. They are first-party, sealed, sent only over HTTPS and not readable by scripts. There are no analytics, advertising or tracking cookies, so there is nothing to ask your consent for and no cookie banner. The one other party that sets cookies is Stripe, on its own pages and on Trov's payment page when that shows Stripe's form, to take the payment and prevent fraud (section 5).

Your browser's storage keeps only preferences and where to bring you back after signing in. It never leaves your device:

7.Email

Trov sends no marketing email. What it sends:

• Digests, on by default: a daily one on weekdays and a weekly one on Mondays, at your organization's send hour, and only when there is something for you. Change or stop them in Settings › Email notifications.
• A welcome email when you first join an organization.
• One-off emails that answer something someone did: an invitation, word that an organization you were given or paid for is ready (with your plan's renewal and cancellation terms), and a test digest you send yourself.
• Stripe's own receipts and invoices, sent by Stripe.

A digest leads with your brief, the same one My Work shows: while your organization's AI switch is on, Trov writes it with Anthropic Claude; while it is off, the digest lists your assigned items instead. While the switch is on, the weekly digest also has "This week": up to 3 highlights of the organization's week, written by Anthropic Claude once a week for the whole organization and the same for every member who gets it.

If you choose "Only when something needs me" in Settings › Email notifications, Trov sends you a digest only when your brief has something next for you, or when something Sift rated notable or breaking touched your work. Both are judgements Trov's AI made earlier, so the AI decides whether that email is sent; deciding sends nothing more to Anthropic or TypeSafe AI. When there is no brief, for example while your organization's AI switch is off, a ticket assigned to you counts instead, and the ratings Sift made earlier still count, so whether that email is sent can still depend on them.

Every digest and welcome email has an Unsubscribe link at the bottom that works without signing in, a one-click unsubscribe your mail app can use, and a switch in Settings. Unsubscribing stops digests and the welcome email from every organization; the one-off emails above still arrive, because each answers something someone did. An unsubscribe link names your handle and does not expire.

Our emails load nothing remote — no web fonts, images or scripts. They are delivered by Resend, which receives the recipient, the subject and the body. We keep a log of the digests sent (not their text).

8.How long we keep it

9.Deleting your account or an organization

You can delete your account in Settings › Delete account, and an owner can delete an organization in Org settings › General › Delete organization. You can also ask us at hello@trov.dev, and our operators can delete accounts and organizations too. Deletion is immediate and cannot be undone.

Deleting an organization removes everything in it: its content and every version, what was captured from GitHub, its settings, credentials and integrations, its members' memberships and agent connections to it, its email settings and send log, its usage counts, admin history and support messages, its billing records, and the files only it used. A paid subscription is cancelled at Stripe first, with no refund for the rest of the period.

Deleting your account removes your profile, photo, sign-ins, sessions, agent connections and tokens, email settings and send log, memberships, support messages, and any organization nobody else is in. If you are the only owner of an organization others are in, or pay for one that carries on, Trov asks you to hand it over, cancel or delete it first.

It also removes your Ask Trov conversations, the files you attached in Ask Trov and did not publish to the organization, and what you told it about how to answer you.

What is kept, and why:

• What you wrote in organizations that carry on — docs, tickets, comments, history — stays for the people you worked with, credited to "Deleted user" (a placeholder with no personal data) instead of your handle. Text other people typed that mentions you is not rewritten.
• Your GitHub username in repository activity Trov captured, because it is a copy of that repository's history on GitHub.
• One record of each deletion: who asked, when, and for an organization its address, member count and Stripe ids (for billing disputes). For an account it holds a one-way code, not your handle.
• Stripe keeps its records of payments and invoices for tax and accounting law; Resend keeps its delivery logs; Anthropic, and Google for summaries made before October 14, 2026, may have the text sent earlier for summaries — each under its own terms.
• Anthropic and TypeSafe AI may have the text sent earlier for Ask Trov and Trov's other AI features, each under its own terms.
• Cloudflare's database history (up to 30 days) and logs (a few days) keep deleted data until they age out.

10.Your rights and choices

In Trov you can change your name, handle, color, photo and email address in Settings, unlink a sign-in method, revoke agent connections, stop email, and delete your account. An organization's owner can update its payment method, download invoices and cancel its plan.

Depending on where you live, you may have the right to access your personal data and get a copy of it (in a portable format), to correct it, to have it deleted, and to restrict or object to how we use it — under the GDPR and UK GDPR, for example, and under US state privacy laws such as California's. To use any of them, write to hello@trov.dev from the address on your account (or tell us how to confirm it is you). We will answer within 30 days, and will not treat you differently for asking. If we decline a request, we will say why, and you can ask us to reconsider. You can also complain to your local data protection authority.

We do not sell personal data or share it for targeted advertising, and we do not use it to make decisions about you that have legal or similar effects.

11.International transfers

Trov is run from the United States and hosted on Cloudflare's network, and our providers process data mostly in the United States. If you use Trov from elsewhere, your data is transferred there. Where the law requires it, those transfers rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses.

12.Children

Trov is a tool for working teams and is not for anyone under 16. Everyone confirms they are 16 or older when they sign up. If you believe someone younger has given us personal data, write to hello@trov.dev and we will delete it.

13.Security

What we do: sign-in goes through GitHub or Google; session cookies are sealed, HTTP-only and secure; agent tokens are stored only as hashes; integration credentials are stored encrypted and never shown again; GitHub and Stripe notifications are signature-checked; artifact pages run in a sandbox cut off from your session; card data never touches Trov's servers; traffic is encrypted in transit; and secrets are scrubbed from our logs.

No system is perfectly secure, and we cannot promise that data will never be accessed without permission. If something happens that puts your personal data at risk, we will tell you as the law requires. If you find a vulnerability, please report it privately to hello@trov.dev.

14.Changes to this policy

If we change how we handle personal data we will update this page and its date, and tell you in the app or by email before a material change takes effect.

15.Contact

TrovLabs, Inc., New Jersey, United States. Privacy questions and requests: hello@trov.dev.