Privacy

Trove is a private library. The whole product is built on the idea that what you keep is yours, so this page is written to be read rather than to be survived: what is collected, where it goes, and how to take it all back.

Trove is currently operated by an individual, Rafael Cespedes, as a personal project. It is invite-only and not open to the public.

What Trove stores

Your account. Your email address, the name and one-line bio you choose, and an avatar if you upload one. The avatar is downscaled in your browser and stored as part of your account record.

Your sessions. When you sign in, Trove stores a session record containing your IP address and browser user agent. This is what makes the Devices list on your account screen possible, and what lets you end a session on a device you no longer have.

Sign-in codes. Stored hashed, expiring after ten minutes, and destroyed after three wrong attempts.

Your library. Everything you save: links, the text and media of saved posts, their authors as published, tags, the people you track, your quests, your notes, and your conversations with Mentor. Notes and conversations are your own words and are stored as you wrote them.

Capture keys. Stored as a hash, never as the key itself, alongside the label you give them and when each was last used.

Operational records. How many model tokens your library’s enrichment has spent, rate-limit counters, and a log of which saved things have been surfaced to you. These exist to run the service and understand its cost.

Where your data goes

Trove uses a small number of services to work. Each receives only what it needs, and none of them are advertising companies.

• Anthropic — when something is saved, its text and images are sent to Anthropic’s API to be described, typed and tagged. Your questions to Mentor, and the saved things relevant to them, are sent for each answer.
• Voyage AI — the text of saved things, your quests and your search queries are sent to be turned into embeddings, which is what makes search work by meaning rather than by keyword.
• Resend — receives your email address in order to deliver your sign-in code.
• Neon — hosts the PostgreSQL database where everything above is stored.
• Vercel — hosts and serves the application.
• X / Twitter — when you save a link to a post, Trove fetches that post’s public media and text from X’s public endpoint. Nothing about you is sent.

Trove does not sell your data, and does not share it for advertising. Nobody is given access to your library. Should that ever change, it would require your explicit consent first, and this page would say so before it happened rather than after.

Other people’s libraries

Every library is separate. Every read and every write in Trove is scoped to its owner, enforced in the database rather than only in the application. Another signed-in person cannot see your library, and you cannot see theirs.

What you can do about it

Both of these are built and live on your account screen — not requests you file and wait on:

• Export everything. Downloads your entire library as a single JSON file: every artifact, tag, person, quest, note and conversation.
• Delete your account. Removes your account and everything attached to it. There is no grace period and no recovery, which is why it asks you to type your email address first. Export before you press it if any of it should outlive the account.

You can also edit your name, bio and avatar at any time, and end any session from the Devices list.

How long things are kept

Your library is kept until you delete it, either item by item or by deleting your account. Archived artifacts remain until you empty the archive. Sessions expire a year after their last use, or immediately when you sign out or revoke them. Sign-in codes expire in ten minutes.

Security

Trove is served only over HTTPS. Sign-in codes and capture keys are stored hashed. Session cookies are HTTP-only and cannot be read by scripts in your browser. Access to the application requires a valid session; there is no public read path into any library.

No service can promise perfect security, and Trove is an early product run by one person. It has been built carefully, and it would be dishonest to claim more than that.

Cookies

Trove sets one cookie, to keep you signed in. There is no advertising, analytics or tracking cookie, and no third-party tracker anywhere in the application.

Where Trove operates

Trove is operated from the United States, and the services above store data in the United States. If you use Trove from elsewhere, your information is transferred there.

Trove does not knowingly collect information from anyone under 16. It is invite-only, so everyone here was invited by name.

Changes

If this page changes in a way that affects what is collected or who receives it, the date at the top changes and invited users are told by email before it takes effect.

Contact

Questions, corrections, or a request to see what is held about you: rafael@trove.quest.