Privacy

Your trove is yours. We treat it that way.

Trovfolio is a private catalog of what you own. This page explains, in plain language, what we collect, what we never do with it, and the controls you hold over everything in your account.

Last updated: October 8, 2026 · Operated by Fist Bump Labs, LLC ("Trovfolio," "we," "us")

Private by default

Your inventory isn’t shared with other people unless you send them an export or create a share link. To make an estimate, we send item photos and related details to the services that power valuations (see Third-party processors). A share link works for anyone who has it until you revoke it.

Never sold

We don’t sell or rent your data or your photos, and we don’t use advertising networks or ad pixels on Trovfolio. We use Google Analytics for Firebase to understand how Trovfolio is used. Our business is the subscription, not your collection.

Yours to export

Download your catalog and reports any time. Delete your account in the app any time; that deletes your sign-in, items, photos, documents, and share links. If you share a household, its items stay with the other members. We keep a few records longer, such as purchase history and messages you sent us (see Data retention).

Served over HTTPS

Trovfolio is served over HTTPS. Saved items stay in your account, and you sign in to see them, except what you include in a share link.

This policy explains how Fist Bump Labs, LLC collects, uses, and shares information when you use Trovfolio.

01

Information we collect

Information you provide: account data (name, email, plan status); item content (photographs, and details you enter — category, brand, model, condition, purchase price, receipts, appraisals, notes, and beneficiary designations you choose to add); support communications.

Information generated by the Service: valuations and metadata (estimated values, value types, sources, confidence levels, timestamps); usage and device data (app interactions, refresh activity, device/OS, diagnostics).

Information from third parties: payment status from app stores/processors (we do not store full card numbers); market data used to generate estimates (about items, not about you).

Contact-form messages and beta requests: if you use our contact form, your name, email, the topic you pick, your message, your company if you give it, and your account ID if you're signed in; if you request beta access, your email, your name if you give it, what you collect, any referral or campaign tag in the link you used, and a hashed version of your IP address.

We do not intentionally collect special-category data, and we ask that you not upload government IDs, full financial account numbers, or others' personal information.

02

How we use information

  • To provide the Service — store your catalog, generate and refresh valuations, display your portfolio;
  • To operate paid plans — manage subscriptions, enforce plan limits and refresh guardrails, and prevent abuse;
  • To improve and secure the Service — analytics, debugging, fraud prevention, aggregate/de-identified analysis;
  • To communicate service messages and (with consent where required) product updates;
  • To comply with law and enforce our Terms.

We do not sell your personal information, and we do not use your photos or item content to train third-party AI models for purposes unrelated to serving you.

03

How valuations work and what is shared

To generate a valuation, the Service transmits relevant data — such as an item photograph and the attributes needed to identify it — to third-party AI providers and queries third-party market-data sources. We send the minimum reasonably necessary.

Share links. When you create a share link, anyone who has the link can see whatever the shared report includes, which may include your display name, item descriptions, photos, estimates, and other details shown on the report. You can turn a link off at any time, and the shared page stops working once you do. People who viewed it before then may have saved or copied what they saw, including links to photos.

04

Third-party processors

We use service providers ("sub-processors") to run Trovfolio:

PurposeProvider
Hosting, database, sign-in and storageGoogle Firebase / Google Cloud
AI valuationAnthropic (receives item photos, documents and item details)
Market dataeBay (receives search text only)
Payments & subscriptionsApp Store / Google Play / RevenueCat; Stripe for web checkout
Email deliveryResend (some emails, such as digests and revaluation notices, include item names and estimated values)
Contact-form and support recordsAttio
AnalyticsGoogle Analytics for Firebase
Sign-in providersGoogle, Apple
05

Data retention

We keep your account and item data while your account is active.

When you delete something. Deleting an item deletes it, along with its photos and documents, from your account. Deleting your account in the app deletes your sign-in, profile, items, photos, documents, people, share links, credit history, and activity. If you belong to a shared household and aren't its last owner, the household's items stay with the other members. Copies in backups may remain for a limited time.

What we keep longer. We keep purchase and subscription records and billing event records, including those held by our payment providers, for as long as the law requires. We keep messages you send us through the contact form, requests to join the beta, and the related records in our support tools until you ask us to delete them. We keep limited security and audit records. We keep usage records for as long as we need them to run and improve Trovfolio. Analytics data is kept according to our analytics provider's retention setting. Item photos we sent to the services that power valuations are kept by those services under their own retention terms. To ask us to delete anything listed here, use our contact form and choose Security or privacy request.

06

Your choices and rights

  • Access, edit, delete — view and edit your items in-app and delete items or your entire account at any time.
  • Export — export your data from Profile.
  • Regional rights — depending on where you live (e.g., EU/UK, California), you may have rights to access, correct, delete, port, or restrict processing, and to complain to a regulator. Reach us through our contact form.
07

Security

We use reasonable technical and organizational measures (the site is served over HTTPS, and we use access controls). No system is perfectly secure.

08

International transfers

Your data may be processed in countries other than your own, including the United States, with appropriate safeguards where required.

09

Children

The Service is not directed to children and is intended for adults 18 and over. We do not knowingly collect data from children. If a child has provided us data, contact us and we will delete it.

10

Changes

We may update this policy. Material changes will be notified in-app or by email.

11

Contact

Privacy questions: reach us through our contact form · Fist Bump Labs, LLC