Privacy Policy

1. Information we collect

Account information: When you create an account via Google OAuth or email signup, we collect your name, email address, and profile picture (if provided by Google).

Usage data: We collect information about how you interact with Trovlet — products you view, save, click, and search for. This helps us improve recommendations and curate better content.

Device and log data: We automatically collect your IP address, browser type, device type, and referring URL. This is standard for all web services and helps us maintain security and fix bugs.

2. How we use your information

We use your information to operate and improve Trovlet: personalizing product recommendations, powering search, sending notifications you opt into (like price drop alerts), and understanding what content resonates with our users.

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We never will.

3. Affiliate links and third-party cookies

Trovlet earns revenue through affiliate commissions. When you click a product link and purchase from a retailer, we receive a commission. These retailers (including Amazon, Etsy, and brand-direct stores) may set cookies on your browser to attribute the purchase.

We use essential first-party cookies for authentication and preferences. We do not use third-party advertising trackers or sell data to ad networks.

4. Data sharing

We share data only when necessary to operate the platform:

• Hosting: Amazon Web Services (AWS) hosts our infrastructure in the US.

• Authentication: Google provides OAuth sign-in.

• Analytics: We may use privacy-respecting analytics tools to understand usage patterns.

We will never share your personal information with advertisers.

5. Data retention and deletion

You can delete your account at any time by emailing hello@trovlet.com. When you delete your account, we remove your personal data (name, email, saves, ratings) within 30 days. Anonymized, aggregated usage data may be retained for analytics.

We retain inactive accounts for 24 months, after which they may be automatically deleted.

6. Your rights

Depending on your location, you may have the right to access, correct, delete, or export your data. California residents have additional rights under the CCPA. EU residents have rights under GDPR. To exercise any of these rights, contact us at hello@trovlet.com.

7. Security

We use industry-standard security measures including encrypted connections (HTTPS), secure authentication, and access controls. No system is 100% secure, but we take reasonable steps to protect your data.

8. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to registered users. Continued use of Trovlet after changes constitutes acceptance.