This policy explains how Fist Bump Labs, LLC collects, uses, and shares information when you use Trovfolio.
01Information we collect
Information you provide: account data (name, email, plan status); item content (photographs, and details you enter — category, brand, model, condition, purchase price, receipts, appraisals, notes, and beneficiary designations you choose to add); support communications.
Information generated by the Service: valuations and metadata (estimated values, value types, sources, confidence levels, timestamps); usage and device data (app interactions, refresh activity, device/OS, diagnostics).
Information from third parties: payment status from app stores/processors (we do not store full card numbers); market data used to generate estimates (about items, not about you).
Contact-form messages and beta requests: if you use our contact form, your name, email, the topic you pick, your message, your company if you give it, and your account ID if you're signed in; if you request beta access, your email, your name if you give it, what you collect, any referral or campaign tag in the link you used, and a hashed version of your IP address.
We do not intentionally collect special-category data, and we ask that you not upload government IDs, full financial account numbers, or others' personal information.
03How valuations work and what is shared
To generate a valuation, the Service transmits relevant data — such as an item photograph and the attributes needed to identify it — to third-party AI providers and queries third-party market-data sources. We send the minimum reasonably necessary.
Share links. When you create a share link, anyone who has the link can see whatever the shared report includes, which may include your display name, item descriptions, photos, estimates, and other details shown on the report. You can turn a link off at any time, and the shared page stops working once you do. People who viewed it before then may have saved or copied what they saw, including links to photos.
04Third-party processors
We use service providers ("sub-processors") to run Trovfolio:
| Purpose | Provider |
|---|
| Hosting, database, sign-in and storage | Google Firebase / Google Cloud |
| AI valuation | Anthropic (receives item photos, documents and item details) |
| Market data | eBay (receives search text only) |
| Payments & subscriptions | App Store / Google Play / RevenueCat; Stripe for web checkout |
| Email delivery | Resend (some emails, such as digests and revaluation notices, include item names and estimated values) |
| Contact-form and support records | Attio |
| Analytics | Google Analytics for Firebase |
| Sign-in providers | Google, Apple |
05Data retention
We keep your account and item data while your account is active.
When you delete something. Deleting an item deletes it, along with its photos and documents, from your account. Deleting your account in the app deletes your sign-in, profile, items, photos, documents, people, share links, credit history, and activity. If you belong to a shared household and aren't its last owner, the household's items stay with the other members. Copies in backups may remain for a limited time.
What we keep longer. We keep purchase and subscription records and billing event records, including those held by our payment providers, for as long as the law requires. We keep messages you send us through the contact form, requests to join the beta, and the related records in our support tools until you ask us to delete them. We keep limited security and audit records. We keep usage records for as long as we need them to run and improve Trovfolio. Analytics data is kept according to our analytics provider's retention setting. Item photos we sent to the services that power valuations are kept by those services under their own retention terms. To ask us to delete anything listed here, use our contact form and choose Security or privacy request.
06Your choices and rights
- Access, edit, delete — view and edit your items in-app and delete items or your entire account at any time.
- Export — export your data from Profile.
- Regional rights — depending on where you live (e.g., EU/UK, California), you may have rights to access, correct, delete, port, or restrict processing, and to complain to a regulator. Reach us through our contact form.
07Security
We use reasonable technical and organizational measures (the site is served over HTTPS, and we use access controls). No system is perfectly secure.
08International transfers
Your data may be processed in countries other than your own, including the United States, with appropriate safeguards where required.
09Children
The Service is not directed to children and is intended for adults 18 and over. We do not knowingly collect data from children. If a child has provided us data, contact us and we will delete it.
10Changes
We may update this policy. Material changes will be notified in-app or by email.