Legal

Privacy Policy

Effective: 2026-10-11 · Trove is being built and is not yet in testing

The short version

Trove is a personal finance tracker built by Vroe Labs, and right now it is being built. Your financial data belongs to you: in the app, only you and anyone you choose to share a view with can see it. We don't sell it, and you can export your transactions or delete your account yourself, anytime, from Settings.

1. Where we are today

Trove is a young product being actively built. That honesty matters for privacy too: features change quickly, and while we treat your data carefully, you shouldn't treat an early app as the only copy of anything important. What works today: manual transaction tracking with receipts, importing statements and other documents, budgets, goals, subscription tracking, net worth, Ask (questions about your own figures), reports with PDF/CSV/Excel export, search, and profile settings like display currency and themes.

2. What we collect

• Account basics. Your email, name and settings (such as currency, time zone, and your notification and analytics choices). If you sign in with Google, we also keep the link to your Google profile photo.
• Where you signed up from. If you reach sign-up from one of our own pages, such as the money map, we keep that page's name with your account, so we can count which pages lead to sign-ups. Nothing you entered on that page is sent to us: the money map keeps your entries in your own browser.
• The financial data you enter. Transactions, budgets, goals, subscriptions, accounts, net-worth items, receipt images, and the statements and other documents you upload to the inbox (we keep the original file). Trove doesn't connect to your bank; everything in the app is data you added yourself.
• Messages you send us. The contact form stores your name, email, topic and message, with your IP address and browser details. Support requests from inside the app are stored with your account.
• An activity log. Actions on your account, such as adding, changing or deleting a record, exporting, sharing, or deleting the account, are logged with the time and, for many of them, your IP address and browser details. You can read your own entries.
• Basic traffic data. Aggregate page views via Cloudflare Web Analytics, which uses no cookies and does not fingerprint or track you across sites. On the public website only (never inside the signed-in app), Google Analytics 4 also counts visits, but only if you accept it in the cookie banner. There is no session-recording tool.

3. Who can see your data

You. Every table that holds your data enforces row-level security, a rule at the database layer that each row is only readable and writable by the account that owns it. Your transactions, goals, and budgets are not visible to other users. There are two exceptions. If you share a read-only view with someone, they see the parts you chose until the share expires or you revoke it. And the founder, who runs Trove alone, can reach the database through the hosting provider's console to fix a problem or answer a request you send; Trove has no in-app admin screens. Background jobs, such as the nightly net-worth snapshot, run on our servers with an administrator key. Secret keys never leave our servers.

4. What we never do

• We never sell your data.
• We never share your data with advertisers.
• We never train AI models on your personal financial data.
• We never move money. Trove only records what you tell it.

5. Your controls

From Settings you can export your transactions as a CSV file (and as PDF or Excel from Reports), erase your financial data while keeping your account, turn product analytics on or off, or permanently delete your account. Deletion is immediate and removes your profile, transactions, budgets, goals, subscriptions, receipts and uploaded documents. Some things stay: activity-log entries, no longer linked to your account (a few hold an amount, such as a goal contribution, and the entry for the deletion holds your email address); any message you sent through the contact form; and your data in any database backup taken by hand before the deletion, until that backup is deleted. For anything else, email us (section 11).

6. How long we keep data

• Your account and financial data: until you delete them or the account.
• Uploaded documents: until you delete the inbox item or the account.
• Notifications: deleted 60 days after you read them. Generated insights: deleted after 90 days.
• Contact messages and the activity log: there is no automatic deletion yet. We will set a period before launch.

7. Services we rely on

• Supabase. Database, sign-in (email and password, or Google), and receipt and document storage. Your data is stored in Mumbai, India (AWS ap-south-1). Supabase also sends the sign-up confirmation and password-reset emails.
• Cloudflare. Hosting, DNS, CDN and cookieless traffic analytics. Cloudflare Turnstile checks the contact form for bots, using your IP address and browser signals. Cloudflare Workers AI is one of the language-model options below.
• Language models. When you use Ask, import a document into the inbox, ask Trove to read a sentence its own rules could not, research a purchase, or estimate what something you own is worth (including the nightly refresh if you leave it on), the text needed is sent to one language-model provider: Anthropic (Claude), OpenRouter, Groq (or a similar service), or Cloudflare Workers AI, whichever is set up first in that order. That text can be the document you uploaded, your question and the figures it needs, merchant names, or the item you describe. For OpenRouter we ask that only providers that do not train on or keep prompts are used; for the others, their own API data policies apply. Nothing is sent otherwise.
• Sentry. Crash reports from the app. When something breaks, the error text (with email addresses, ids and numbers of five or more digits removed, cut to 300 characters) and the page path (with ids removed) are sent. The report carries no account id, no cookies and no request body. A report from your browser goes straight to Sentry, so Sentry receives your IP address with it; Trove does not put it in the report.
• PostHog. Product milestones such as “finished setup”, only if you turn product analytics on (Settings → Privacy, or the last setup step). Sent from our server, never your browser, under a keyed hash of your account id. Never amounts, names, merchants, your questions or anything you type, and no session recording. PostHog's servers are in the United States.
• Google. Sign-in with Google, if you choose it. Google Analytics visit counts for the public website, loaded only after you accept. Google may process this data in the United States.
• Resend. Sends Trove's own email (the welcome note, the weekly digest if you turn it on, and replies to messages you send us). It receives your email address, the subject and the message. Resend's servers are in the United States.
• Frankfurter. Daily exchange rates (European Central Bank data). Our server asks for the rates; nothing about you is sent.

That is the whole list. Until email delivery is switched on, the welcome note, the weekly digest and reminders appear inside the app instead. Google Analytics never reaches the signed-in app.

If we add anything new, like bank connections, we'll update this policy first.

Voice entry

You can add an expense by speaking it. Trove does not record, store or upload audio. Your own browser turns the words into text, and that text only fills in the form for you to check before saving.

One thing worth knowing, because it is your browser's choice rather than ours: Chrome and Edge transcribe speech by sending the audio to Google's servers. Safari and iOS do it on your device. If you would rather nothing left your device at all, type the expense instead. Every field works the same way.

8. Early-stage caveats

While Trove is being built we may occasionally need to reset or migrate data as the product evolves. We'll tell you before anything destructive. Keep your own records for anything critical.

9. Cookies

One essential cookie keeps you signed in, and opening a shared view sets one for that view. Analytics cookies are optional, set only on the public website and only if you accept them; you can change your mind at any time on the cookie policy page. A browser sending Global Privacy Control is treated as a refusal.

10. Children

Trove isn't for children under 13, and we don't knowingly collect their data. There is no age check at sign-up.

11. Questions

Email [email protected]. A real person reads it: Dev Patel, the founder, who is also the contact for privacy requests and complaints.

Vroe Labs is not yet a registered company. Trove is being built and is not yet in testing. Full legal details will be published before launch.