Privacy

Trove is a private library. The whole product is built on the idea that what you keep is yours, so this page is written to be read rather than to be survived: what is collected, where it goes, and how to take it all back.

Trove is currently operated by an individual, Rafael Cespedes, as a personal project. It is invite-only and not open to the public.

What Trove stores

If you ask for an invite. The email address and the note you write on the sign-in page, the X handle or portfolio link if you give one, and the time you sent them. The note is read by a person to decide whether to invite you; it is not sent to a model. Nothing else about you is collected, and asking does not create an account or subscribe you to anything.

Your account. Your email address, the name and one-line bio you choose, and an avatar if you upload one. The avatar is downscaled in your browser and stored as part of your account record.

Your sessions. When you sign in, Trove stores a session record containing your IP address and browser user agent. This is what makes the Devices list on your account screen possible, and what lets you end a session on a device you no longer have.

Sign-in codes. Stored hashed, expiring after ten minutes, and destroyed after three wrong attempts.

Your library. Everything you save: links, the text and media of saved posts, their authors as published, tags, the people you track, your quests, your notes, and your conversations with Mentor. Notes and conversations are your own words and are stored as you wrote them.

Capture keys. Stored as a hash, never as the key itself, alongside the label you give them and when each was last used.

Operational records. How many model tokens your library’s enrichment has spent, rate-limit counters, and a log of which saved things have been surfaced to you. These exist to run the service and understand its cost.

Where your data goes

Trove uses a small number of services to work. Each receives only what it needs, and none of them are advertising companies.

• Anthropic — when something is saved, its text and images are sent to Anthropic’s API to be described, typed and tagged. Your questions to Mentor, and the saved things relevant to them, are sent for each answer.
• Voyage AI — the text of saved things, your quests and your search queries are sent to be turned into embeddings, which is what makes search work by meaning rather than by keyword.
• Resend — receives your email address in order to deliver your sign-in code.
• Neon — hosts the PostgreSQL database where everything above is stored.
• Vercel — hosts and serves the application.
• X / Twitter — when you save a link to a post, Trove fetches that post’s public media and text from X’s public endpoint. Nothing about you is sent.

Trove does not sell your data, and does not share it for advertising. Nobody is given access to your library. Should that ever change, it would require your explicit consent first, and this page would say so before it happened rather than after.

The browser extension

The Chrome extension is a capture surface: it exists to put things into your library, and it does nothing until you act.

What it reads. When you save — by clicking the toolbar button, pressing the keyboard shortcut, or using a right-click menu — it reads the current page’s address, title, share image, and any text you had selected. On x.com’s bookmarks page, when you start a capture, it reads the posts your own signed-in browser has rendered. It does not read pages you merely visit, does not track your browsing, and holds no standing access to any site’s content beyond that.

Where it sends. Everything it reads goes to one place: your own library, over HTTPS. The extension contains no analytics, no trackers, and talks to no third party.

What it keeps on your device. Your capture key, your server setting, and save counters, in the browser’s extension storage. Unlike the server, which holds only a hash, the extension necessarily keeps the key itself — that is what lets it save on your behalf. Uninstalling the extension deletes all of it, and the key can be revoked at any time from your account screen, which cuts the extension off whether or not it is uninstalled.

Connecting. The one-click Connect uses your existing signed-in trove.quest session to create the capture key. It does not see or store your sign-in code, and the extension never handles a password because Trove has none.

Other people’s libraries

Every library is separate. Every read and every write in Trove is scoped to its owner, enforced in the database rather than only in the application. Another signed-in person cannot see your library, and you cannot see theirs.

What you can do about it

Both of these are built and live on your account screen — not requests you file and wait on:

• Export everything. Downloads your entire library as a single JSON file: every artifact, tag, person, quest, note and conversation.
• Delete your account. Removes your account and everything attached to it. There is no grace period and no recovery, which is why it asks you to type your email address first. Export before you press it if any of it should outlive the account.

You can also edit your name, bio and avatar at any time, and end any session from the Devices list.

How long things are kept

Your library is kept until you delete it, either item by item or by deleting your account. Archived artifacts remain until you empty the archive. Sessions expire a year after their last use, or immediately when you sign out or revoke them. Sign-in codes expire in ten minutes.

An invite request that is declined is deleted within 90 days. One that is accepted becomes an account, and is kept for as long as the account is. If you would rather your request were deleted sooner, write to the address below and it will be.

Security

Trove is served only over HTTPS. Sign-in codes and capture keys are stored hashed. Session cookies are HTTP-only and cannot be read by scripts in your browser. Access to the application requires a valid session; there is no public read path into any library.

No service can promise perfect security, and Trove is an early product run by one person. It has been built carefully, and it would be dishonest to claim more than that.

Cookies

Trove sets one cookie, to keep you signed in. There is no advertising, analytics or tracking cookie, and no third-party tracker anywhere in the application.

Where Trove operates

Trove is operated from the United States, and the services above store data in the United States. If you use Trove from elsewhere, your information is transferred there.

Trove does not knowingly collect information from anyone under 16. It is invite-only, so everyone here was invited by name.

Changes

If this page changes in a way that affects what is collected or who receives it, the date at the top changes and invited users are told by email before it takes effect.

Contact

Questions, corrections, or a request to see what is held about you: rafael@trove.quest.