The Trove — Privacy Policy
Effective date: 21 September 2026
The Trove is operated by Niall McHale, trading as The Trove, a sole trader based in Cork, Ireland (the "data controller"). Our postal address is available on request by emailing privacy@thetrovecollective.app.
Contact for privacy / data requests: privacy@thetrovecollective.app
1. Who we are
The Trove is a book passage-capture app. This policy explains what personal data we collect, why, and your rights under the GDPR.
2. What we collect
- Account data: your email address and authentication details.
- Payment data: handled by Stripe. We receive confirmation of payment and limited billing info, but we never receive or store your full card number.
- Your content: the books, captured passages, collections, ranks and titles you create in the app.
- Scanned page text: when you scan a page, the image/text is sent — using your own Google Gemini API key — to Google to extract the passage (see §5).
- Usage data: first-party analytics about how the app is used (e.g. features used, actions taken).
- Technical data: device/browser type and similar information needed to run and secure the service.
3. Why we use it and our legal bases
- To provide the service (create your account, store your library, run the ranking system) — performance of a contract.
- To take payment and prevent fraud — contract / legal obligation.
- To improve and secure the app via analytics — legitimate interests.
- To contact you about your account or, if you opt in, product updates — contract / consent.
4. We do not sell your data
We don't sell your personal data or your library, and we don't show third-party ads inside the app.
5. Third parties who process data for us
- Stripe — payment processing.
- Our hosting provider — the infrastructure the app runs on.
- Google (Gemini API) — text extraction from scanned pages, accessed via your own API key; this processing is subject to Google's terms and privacy policy, which we don't control.
- Zoho — our business email provider. Where our stack changes, we keep this list up to date.
6. International transfers
Some providers (e.g. Stripe, Google) may process data outside the EEA. Where they do, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.
7. How long we keep it
We keep your account and content for as long as your account exists. If you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep limited records (e.g. payment/tax records) for legal reasons.
8. Your rights (GDPR)
You have the right to access your data, correct it, delete it, restrict or object to processing, and receive a portable copy. To exercise any of these, email privacy@thetrovecollective.app. You can also delete your account and data from within the app. If you're unhappy with how we handle your data, you can complain to the Irish Data Protection Commission (dataprotection.ie).
9. Security
We use industry-standard measures: encrypted connections (HTTPS), payment handling via Stripe so card data never touches our systems, access controls, and account protections. No system is perfectly secure, but we take reasonable steps and will notify you and the DPC of a qualifying data breach as required by law.
10. Children
The Trove isn't intended for anyone under 16, and we don't knowingly collect data from children under that age.
11. Cookies
The Trove uses only the cookies necessary to run the service and keep you signed in. If we add non-essential/analytics cookies that require consent, we'll show a consent banner and update this policy.
12. Changes
We'll post updates here with a new effective date and, for material changes, notify you.
13. Contact
privacy@thetrovecollective.app · The Trove · Cork, Ireland (postal address on request)