Privacy Policy

This privacy notice explains what Trovare LLC ("Trovare," "we," "us," or "our") collects about you, why, who we share it with, and the choices you have. It covers:

• the Trovare apps for iPhone and Android (together, the "app"),
• our website at trovare.app (the "website"), and
• emails and other messages between you and us.

Together we call these the "Services." Where the iPhone and Android apps work differently, this notice says so. Trovare helps you find and walk self-guided tours, with turn-by-turn directions, audio narration, and Alfred, an AI guide you can ask about the places around you.

Questions or concerns? If anything here is unclear, or you do not agree with how we handle your information, please contact us at go@trovare.app before using the Services.

What changed in this version

This notice replaces the version dated June 24, 2024. The main changes, which reflect how Trovare 1.1.0 works:

• Removed. Firebase (analytics and messaging), AppsFlyer (install attribution), the Google Ads conversion kit, and push notifications are no longer part of the app. The earlier notice's references to Google Analytics, advertising networks, retargeting, social media plugins, cookies in the app, and push notifications no longer apply.
• Added: PostHog. We now use PostHog for product analytics and crash reporting, linked to your account when you are signed in. A switch in Settings turns it off; in the EEA, the UK, and Switzerland it is off until you turn it on. See section 6.
• Added: Alfred. An AI guide, run on Anthropic's models, that you switch on yourself. See section 4.
• Added: use without an account. You can now walk a tour and ask Alfred a few questions without signing up. Guest use is tied to an anonymous ID rather than to you.
• Added: Sign in with Apple, and purchase records that are stored on your account so unlocks work on all your devices. See section 5.
• Clearer disclosures. Exactly what we collect, who processes it, how long we keep it, and how this notice maps to the App Store privacy label.

Since the October 1, 2026 version, this notice also covers the Trovare app for Android. Nothing changed in how the iPhone app handles your information. We added:

• the Android app, and where it differs from the iPhone app: Sign in with Google instead of Sign in with Apple, Google's geocoding and Google Play services for location, the system photo picker, and no in-app purchases, with paid tours opening only for accounts that already own them (section 2, section 3, and section 5);
• Google to the list of service providers (section 8);
• the Android settings and controls, including how to delete an account made with Sign in with Apple (section 12);
• how this notice maps to the Data safety section on Google Play (section 16).

Since the September 30, 2026 version, we had also:

• said how long Anthropic keeps Alfred questions, that its web search goes through a search provider, and that we do not train AI models on your information (section 4 and section 10);
• added the state privacy laws that take effect in 2027 and 2028, and how we use precise location (section 13);
• set out when we confirm and answer requests, and how to ask us to review an answer (section 18);
• stopped keeping your precise location with the analytics copy of Alfred questions, which now keeps only your town and region, and turned Mapbox's map telemetry off unless you turn it on (section 3, section 4, and section 6);
• explained the age checks the iPhone app makes where an app store age law applies, such as in Texas (section 14);
• changed our contact address to go@trovare.app.

Summary of key points

• What we collect. Your account details (name, email address, and an optional phone number), your location while you use the app, the questions you ask Alfred and any photo you attach, your App Store purchases (iPhone only), the tours you complete and trips you book, the search terms you type, and how you use the app, including crash reports.
• What we do not do. We do not sell your information, show advertising, use your information for advertising, or track you across other companies' apps and websites. We do not use Apple's advertising identifier or Google's advertising ID.
• Who helps us. We rely on Apple, Google, Supabase, PostHog, Anthropic, Mapbox, Algolia, Resend, and Vercel to run the Services. Each acts on our instructions. See section 8.
• Your controls. You decide whether to grant location access, which photos you share, whether Alfred is on, and whether analytics and crash reports are sent. In the EEA, the UK, and Switzerland, analytics is off until you turn it on. You can delete your account and its data from inside the app at any time. See section 12.
• App store labels. Section 16 shows how this notice maps to the App Privacy label on our App Store page and the Data safety section on our Google Play page.

Table of contents

1. Who we are and what this notice covers
2. What information we collect
3. Location
4. Alfred, our AI guide
5. Purchases and unlock codes
6. Analytics, crash reports, and diagnostics
7. How we use your information and our legal bases
8. Who we share your information with
9. International data transfers
10. How long we keep your information
11. How we keep your information safe
12. Your choices and controls
13. Your privacy rights
14. Children
15. The trovare.app website
16. How this notice maps to the App Store and Google Play labels
17. Changes to this notice
18. How to contact us and exercise your rights

1. Who we are and what this notice covers

Trovare LLC is a company registered in the United States at 39 South St, Washington, CT 06793. We are the "controller" of the personal information described in this notice, which means we decide why and how it is used.

This notice applies to the app, the website, and our communications with you. It does not cover other apps you open from Trovare, such as Google Maps, Waze, or Citymapper when you ask for directions, or your phone app when you tap a tour provider's number. Those apps have their own privacy notices.

2. What information we collect

In Short: We collect what you give us to run your account, what the app needs to guide you, and technical information about how the app performs. We do not collect payment card details, your contacts, your photo library, your microphone, or health data.

Information you give us

• Account details. To create an account you give us an email address and a password, or you use Sign in with Apple (iPhone app only) or Sign in with Google (Android app only). With Sign in with Apple, Apple shares your name and email address with us; you can choose Apple's "Hide My Email" option, in which case we receive a private relay address instead of your real one. With Sign in with Google, Google shares your name, email address, and a link to your Google profile picture with us; the app does not download or show that picture. We send a verification code to your email when you sign up, and a reset link if you forget your password.
• Profile details. Your name (taken from Apple or Google, or from the first part of your email address if neither shared one) and an optional phone number. You can change both in Settings. A profile photo, if you add one, is stored only on your device and is never uploaded to us.
• Questions for Alfred. The text you type, and any photo you take or attach. See section 4.
• Tour activity you record. In the iPhone app, trips you book (the trip, the date, and the gear you tick off) and the rating you give a tour when you finish it. The Android app does not have trips or ratings yet.
• Unlock codes. Partner codes you redeem to unlock a collection of tours.
• Messages to us. Anything you include when you email us or apply to become a tour provider on the website.

Information collected automatically when you use the app

• Location. Your device's location while you use the app, if you allow it. See section 3.
• Tour activity. When you complete a tour we record which tour it was, the date, the total distance, how long it took, the elevation gained, and your average speed. We do not record the route you actually walked. In the Android app this summary is kept on your device rather than on your account, and only your total number of finished tours and total distance go to our analytics tool (see section 6).
• Purchases. Records of what you have bought through the App Store in the iPhone app. The Android app has no in-app purchases; it reads the purchase records already on your account to decide which paid tours you can open. See section 5.
• Search terms. The words you type into the app's search.
• How you use the app. Which screens you open, which features you use, which tours you start and finish, which audio stops you play, which tours you save offline, and when you see or dismiss a purchase screen. See section 6.
• Device and diagnostic information. Your device model and manufacturer, operating system (iOS or Android) and its version, app version and build, language, time zone, screen size, whether you are on Wi-Fi or cellular, on Android the name of your mobile network, on iPhone whether you installed the app through TestFlight, crash reports, and error messages.
• Identifiers. A random account ID we create when you sign up, a random install ID that our analytics tool creates on your device, an anonymous guest ID if you try Alfred without an account, and, when you are signed in to the iPhone app, the ID Apple gives your App Store copy of the app (see section 5). We do not use Apple's advertising identifier (IDFA) or Google's advertising ID.
• IP address. Like any internet service, our servers and service providers receive your IP address with each request. It is used to secure the Services, limit abuse, and derive an approximate city-level location for analytics.

Information from other sources

The only information we receive about you from others is what Google sends when you sign in with Google (your name, email address, and a link to your profile picture), what Apple sends when you sign in with Apple (your name and email address), when you buy something through the App Store (a signed record of the purchase), and in the notices Apple sends us about refunds and other changes to purchases, and about a parent or guardian withdrawing consent (see section 5). We do not buy or receive information about you from data brokers, advertising networks, or social networks.

Information we do not collect

• Payment card or bank details. Apple processes all payments, and the Android app takes none.
• Your contacts, calendar, or photo library. The app only receives a photo you deliberately take or choose for Alfred.
• Audio from your microphone. The app plays audio; it never records it.
• Health app data, or any medical or biometric information.
• Apple's advertising identifier, Google's advertising ID, or any identifier used to follow you across other apps and websites.
• A history of where you have been. Location is used live and is not stored as a track.
• Your location in the background when you are not navigating a tour.

3. Location

In Short: The app asks for location only while you are using it ("While Using" on iPhone; on Android, never "Allow all the time"). Location is used to show tours near you, to guide you along a tour, and to help Alfred answer questions about where you are. During turn-by-turn navigation it keeps running with the screen locked so directions and narration continue.

We use your location for four things:

• Nearby tours. When you open the Home screen, the app sends an approximate location (accurate to about one kilometre) to our server to list the tours closest to you.
• Navigation. While you follow a tour, your precise location is used on your device to show where you are, give the next instruction, and detect when you reach a stop. Navigation needs precise location; it will not start if you have given the app only approximate location. If you leave the route, the app sends your current position and the point to rejoin to Mapbox to calculate a new route. Navigation continues in the background with the screen locked. On iPhone, iOS shows the blue location indicator while it does; on Android, the app shows a notification for as long as navigation is running. It stops when you end the tour.
• Alfred. If Alfred is on and you ask a question, your precise location, the town you are in, and your local time are sent with the question so the answer fits where you are. See section 4.
• Place names. The app asks your phone's geocoding service to turn your coordinates into a street and town name for Alfred, and to find a city you type into search or the Atlas. On iPhone this is Apple's service (and Apple Maps search); on most Android phones it is Google's. Apple or Google receives the coordinates or the city name for those requests.

How Android finds your location. On Android, the app gets your position from Google Play services, which may use GPS, Wi-Fi, mobile networks, and sensors. Google's handling of that is governed by your phone's location settings and Google's privacy policy.

Map telemetry. Our maps are drawn by the Mapbox software kit, which can send Mapbox telemetry that Mapbox uses to improve its maps: the device's precise and approximate location while a map is in use, how the map is used, performance and diagnostic information about the map, and a random identifier the kit creates for itself. On iPhone this is off unless you turn it on, by tapping the information (i) button on a map and choosing Mapbox Telemetry. If you turn it on, Mapbox states that the telemetry is not linked to your identity, and we do not give Mapbox your account details. You can turn it off again the same way. The Android app switches Mapbox telemetry off every time it starts.

What we store. We do not keep a log of your location or the route you walked. The only lasting record is the completed-tour summary described in section 2, which shows which tours you finished and when.

Turning it off. You can change or withdraw location access at any time: on iPhone in iOS Settings under Privacy & Security, Location Services, Trovare; on Android in your phone's Settings under Apps, Trovare, Permissions, Location; or, on either, from the Permissions section of the app's Settings. Without location you can still browse, buy, and read about tours, but nearby tours, navigation, and Alfred's sense of where you are will not work.

4. Alfred, our AI guide

In Short: Alfred is off until you agree to use it. When you ask a question, the question, any photo you attach, your location, and details of the tour you are on are sent to our server and then to Anthropic, the AI company whose models answer you.

Before Alfred sends anything, the app shows you exactly what it sends and asks you to agree. You can switch Alfred off at any time in the Alfred section of Settings, and review "What Alfred sends" there.

When you ask a question, the app sends:

• your question, word for word (up to 500 characters);
• any photo you take or attach, reduced in size, only when you choose to add one (on Android you choose it with the system photo picker, and the app receives only that photo);
• your precise location, the town, region, and country you are in, your time zone, and your local time;
• the tour you are on, the stops near you and how far away they are, and whatever tour, stop, or place you had open when you asked, including up to 2,000 characters of the text on that page;
• a conversation ID so follow-up questions make sense together.

Our server checks the question for safety, adds background information about the place, and sends it to Anthropic. To answer, Anthropic may also run a web search that uses your approximate location, through a search provider that Anthropic uses for this. Anthropic processes this information as our service provider under its commercial terms and does not use it to train its models. Neither do we: we do not use your personal information, including your questions and photos, to train large language models or any other AI model.

Guests. You can ask Alfred a few questions (currently three) without an account. To count them, the app creates an anonymous guest ID, which is not linked to your name or email address. Guests cannot attach photos.

What we keep. We do not store your conversations in our main database; we keep only a count of questions per guest ID, and may keep a daily count per account, so we can apply our usage limits. We do keep a copy of your questions and Alfred's answers in our analytics tool (PostHog), linked to your account, so we can review the quality and safety of answers and investigate problems. The copy includes the town and region you were in, your local time, and the tour, stop, or page you had open, but not your precise location or how far you were from nearby stops. Photos are not part of that copy either: the image data is stripped out before the record is stored. If analytics is switched off (see section 6), we do not keep this copy. It is deleted when you delete your account.

Please do not include personal details about yourself or anyone else in your questions or photos. Answers are written by AI and can be wrong; do not rely on them for safety decisions.

5. Purchases and unlock codes

In Short: Purchases go through Apple's App Store in the iPhone app. We never see your card details. We keep a record of what you bought so it works on all your devices. The Android app has no in-app purchases; collections can be unlocked there with a code.

Paid tours on Android. Tours sold in the iPhone app stay locked in the Android app unless your account already owns them. To check, the Android app reads the product identifiers of the purchases on your signed-in account from our server, and keeps a copy of that list on your device so the check also works offline. It does not record anything new about your purchases.

In the iPhone app, some regions and collections of tours are unlocked with a one-time in-app purchase. Apple handles the payment and receives your payment details under Apple's privacy policy. Apple gives the app a signed record of the purchase, which contains the product bought, Apple's transaction and original transaction identifiers, the purchase date, and whether it was made in Apple's sandbox or production environment. The app sends that record to our server, which verifies it with Apple's certificates and stores it against your account. When you buy while signed in, we attach your account ID to the purchase so Apple's record and ours match.

If you buy while signed out, the record waits on your device and is linked to your account the next time you sign in. You can restore purchases from Settings at any time; this asks Apple for your current purchases and updates our record.

Notices from Apple. Apple sends our server a notice when something changes about a purchase, such as a refund, and when a parent or guardian withdraws consent for a child or teen to use the app where the law gives them that right. Each notice carries Apple's identifiers for the purchase or for your copy of the app, not your name or email address. So that we can match a notice to your account, the app sends us, when you are signed in, the signed record Apple keeps of your copy of the app, and we store the ID in it against your account. We keep a record of each notice for three years.

Unlock codes. Some partners give out codes that unlock a collection of tours, in either app. When you redeem one, we record which collection was unlocked on your account and which code was used, so we can honour the unlock and stop a code being reused beyond its limit.

6. Analytics, crash reports, and diagnostics

In Short: We use PostHog, a product analytics service, to understand how the app is used and to catch crashes. This information is linked to your account when you are signed in. It is not used for advertising.

The app records events such as opening the app, viewing a screen, searching (including the words you searched for), starting, finishing, and rating a tour, playing an audio stop, saving a tour offline, opening a shared link, seeing a purchase screen, buying, restoring or failing a purchase, redeeming a code, booking or cancelling a trip, signing in or out, and asking Alfred (how long the question was, whether it had a photo or location, and how long the answer took, but not the question text itself). Each event carries the device and diagnostic information listed in section 2, and where it is about a tour, the tour's ID, title, creator, region, type, and distance.

Our server also records a few events: when an account is created and by which method, when a purchase is recorded or cannot be verified, when a tour is completed (with the summary statistics), when a trip is added, when a collection is unlocked or its unlock is withdrawn, and when an Alfred question is asked, answered, or blocked, or a guest reaches the question limit.

Linking. Before you sign in, events are tied to a random install ID. When you sign in, we tell PostHog your account ID, email address, and name, and earlier events from the same install are joined to your account. This lets us help you with support requests and understand how real travellers use the app. When you sign out, the app returns to a fresh anonymous identity.

Crash and error reports. If the app crashes or hits an error, a report containing the technical details of what went wrong (the code path, device model, operating system version, and app version) is sent to PostHog, on the next launch in the case of a crash. Reports are linked to your account if you were signed in, so we can follow up on problems you tell us about.

What analytics does not include. Your precise location is never sent to our analytics tool. The record of Alfred conversations described in section 4 keeps only the town and region you were in. Your phone number and password are never sent to analytics.

Your options. You control all of this with the "Analytics and crash reports" switch in the Permissions section of the app's Settings. If you are in the European Economic Area, the United Kingdom, or Switzerland, the switch is off until you turn it on: we ask once, when you first set up the app, and you can change your answer at any time. The iPhone app works out where you are from your App Store country; the Android app uses the country of your SIM card or mobile network, on your phone, and if it cannot tell, treats you as being in one of these places. Everywhere else the switch is on unless you turn it off. When it is off, nothing about your use of the app is sent to PostHog, including crash reports and the copy of Alfred conversations, and our server stops recording analytics events for your account. Deleting your account deletes the analytics and crash data linked to it. You can also email go@trovare.app with any question about analytics.

7. How we use your information and our legal bases

In Short: We use your information to run your account, guide you on tours, answer your questions, process purchases, fix problems, keep the Services secure, and meet our legal obligations. We do not use it for advertising.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the law requires us to have a legal basis for each use. The table shows each purpose, the information involved, and the basis we rely on.

We do not currently send marketing emails. If we start, we will only email you with your permission, and every message will include a way to unsubscribe.

We do not make decisions about you using automated processing that have legal or similarly significant effects. Alfred's safety screening only decides whether a question is answered.

If you are in Canada, we process your information with your express or implied consent, which you can withdraw at any time, except where the law allows or requires us to process it without consent, for example to investigate a breach of an agreement or to comply with a subpoena or court order.

8. Who we share your information with

In Short: We share information with service providers who run parts of the Services for us, with Apple and Google for sign-in, place names, and (on iPhone) purchases, and with others only when the law requires it or you ask us to. We never sell your information.

Our service providers act on our instructions under contracts that restrict what they may do with your information. They are:

We may also share information:

• At your direction. When you open directions in Google Maps, Waze, Citymapper, or another navigation app, the app passes only the destination coordinates to that app. When you tap a tour provider's phone number, your phone opens its dialler. When you share a tour card or link, you choose who receives it.
• To comply with the law. If we are required to by law, a court order, or a government request, or to protect the rights, property, or safety of Trovare, our users, or others.
• In a business transfer. If Trovare is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that deal. We will tell you before your information becomes subject to a different privacy notice.

We do not sell your personal information, share it for targeted advertising, share it with advertising networks or data brokers, or share it with the partners whose unlock codes you redeem.

9. International data transfers

In Short: Trovare is based in the United States, and your information is processed there and wherever our service providers operate.

If you use the Services from outside the United States, including from the European Economic Area, the United Kingdom, or Switzerland, your information will be transferred to the United States, where privacy laws may differ from those of your country. Our analytics and crash reports are stored in PostHog's US Cloud. Where required, we rely on our service providers' Standard Contractual Clauses approved by the European Commission and the UK, and on the EU-US Data Privacy Framework for providers that are certified under it, to protect your information. You can ask us for more detail about these safeguards using the contact details in section 18.

10. How long we keep your information

In Short: We keep your information for as long as you have an account. Deleting your account in the app deletes it.

We may keep information longer if the law requires it, or if we need it to resolve a dispute or enforce our terms. When we no longer need it, we delete it or make it anonymous.

11. How we keep your information safe

In Short: We use technical and organisational measures appropriate to the information we hold, but no system is completely secure.

All traffic between the app, the website, and our servers is encrypted in transit. Sign-in tokens are stored in your device's secure keychain on iPhone, and in the app's private storage on Android, which other apps cannot read. The Android app turns off device backups, so its data is not copied to your cloud backup. Purchase records are cryptographically verified against Apple's certificates before we accept them. Access to our systems is limited to the people who need it, and our service providers are chosen for their own security practices. Even so, no transmission over the internet or method of storage is fully secure, and we cannot guarantee that your information will never be accessed or altered without authorisation. If we learn of a breach that affects you, we will tell you and the relevant authorities as the law requires.

12. Your choices and controls

In Short: Most of what we collect is under your control in the app or in your phone's settings.

• Location. Grant, limit, or withdraw location access in iOS Settings under Privacy & Security, Location Services, Trovare; in Android Settings under Apps, Trovare, Permissions, Location; or from the Permissions section of the app's Settings.
• Camera and photos. The iPhone app asks for camera access only when you tap to take a photo for Alfred; you can change this in iOS Settings at any time. The Android app does not ask for camera or photo library access: you pick a photo with the system photo picker, and the app receives only that photo.
• Alfred. Turn Alfred on or off, and review "What Alfred sends," in the Alfred section of the app's Settings. Nothing is sent to Alfred until you ask a question.
• Profile. Change your name or phone number under Profile Details, and change your password under Change Password, in the app's Settings.
• Delete your account. Tap Delete Account near the bottom of the app's Settings. This revokes your Sign in with Apple authorisation with Apple if you used it, deletes your account and the data stored on it from our database, and deletes the analytics, crash data, and Alfred records linked to you. Information stored only on your device is removed when you delete the app. Exception: Sign in with Apple is not available in the Android app, so an account made with Sign in with Apple cannot be signed in to, or deleted from, the Android app. Delete it from the iPhone app, or email go@trovare.app and we will delete it for you.
• Purchases. In the iPhone app, use Restore Purchases in Settings or on any purchase screen. Refunds are handled by Apple.
• Local storage. Use Clear Cache in Settings to remove cached images and files, and delete saved offline tours from the tour page.
• Map telemetry. Mapbox telemetry is off unless you turn it on. On iPhone, tap the information (i) button on a map to turn it on or off. The Android app keeps it off.
• Analytics and crash reports. Use the "Analytics and crash reports" switch in the Permissions section of the app's Settings. Off means nothing about your use of the app is sent to our analytics tool. In the EEA, the UK, and Switzerland it starts off.
• Emails. We only send service emails. If we ever send marketing, every message will include an unsubscribe link.

13. Your privacy rights

In Short: Depending on where you live, you have rights to see, correct, delete, and receive a copy of your information, and to object to or restrict how we use it. You can exercise most of them from inside the app, or by contacting us.

If you are in the European Economic Area, the United Kingdom, or Switzerland

You have the right to:

• access the personal information we hold about you and receive a copy;
• have inaccurate information corrected;
• have your information erased;
• restrict how we use it in certain circumstances;
• receive the information you gave us in a portable, machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time where we rely on it, for example for location, Alfred, or analytics, without affecting processing that happened before;
• not be subject to automated decisions with legal or similarly significant effects; we do not make any.

In these regions, analytics and crash reporting run only with your consent. The app asks once when you first set it up, and the "Analytics and crash reports" switch in Settings lets you give or withdraw that consent at any time.

You also have the right to complain to your data protection authority. In the UK this is the Information Commissioner's Office; in Switzerland it is the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first.

If you are in Canada

You have the right to access and correct your personal information and to withdraw your consent. You may also complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

If you are a resident of a US state with a privacy law

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with similar laws have the right to know whether we process their personal information, to access it, to correct it, to delete it, to obtain a copy, and not to be discriminated against for exercising these rights. Some states also give you the right to a list of the categories or names of third parties to which we have disclosed personal information. We extend the same rights to residents of Oklahoma and Louisiana (whose laws take effect on January 1, 2027), Alabama (May 1, 2027), and Vermont (January 1, 2028).

Sensitive data. Several state privacy laws, including Connecticut's, treat precise location as sensitive data. The app uses your precise location only after your phone (iOS or Android) has asked whether Trovare may use your location, and only while you are using the app or following a tour. We use it for the purposes in section 3: showing where you are and guiding you along a tour, re-routing you through Mapbox, and Alfred. Alfred sends your location with a question only after you have agreed to it on the Alfred consent screen. We do not keep your precise location: the analytics copy of Alfred questions keeps only your town and region (section 4). Mapbox's map software sends location telemetry only if you turn it on, which only the iPhone app allows (section 3). You can stop any of these at any time: location in your phone's settings, Alfred in the Alfred section of the app's Settings, and Mapbox telemetry with the (i) button on a map. We do not sell your precise location or use it for advertising, and we do not use your personal information to train large language models. To ask us to stop any other use of your precise location, email go@trovare.app.

Categories of personal information. In the past twelve months we have collected the following categories, as defined by California law:

Sensitive personal information. Under California law, precise geolocation and account log-in credentials count as sensitive personal information. We use them only to provide the features you ask for (nearby tours, navigation, Alfred, and signing in), to keep the Services secure, and for the other purposes permitted by law. We do not use or disclose them to infer characteristics about you, so the right to limit their use does not apply.

Sale, sharing, and targeted advertising. We have not sold or shared personal information for cross-context behavioural advertising in the past twelve months, and we do not do so. We do not use your personal information for targeted advertising or for profiling that produces legal or similarly significant effects. We have disclosed categories A, B, D, F, G, H, and L to the service providers listed in section 8 for business purposes.

How to exercise these rights. Use the controls in the app described in section 12, or email go@trovare.app. We will confirm your identity, usually by asking you to write from the email address on your account, and use the information you give us only for that purpose. You may authorise an agent to make a request for you; we may ask for proof of that authorisation. If we decline a request, you may appeal by replying to our decision, and we will explain the outcome in writing. If your appeal is denied, you may contact your state attorney general.

California "Shine the Light." California residents may ask once a year for information about any personal information we disclosed to third parties for their direct marketing. We do not disclose personal information for that purpose.

Do-Not-Track and opt-out signals. The website does not use cookies or tracking technologies, so there is nothing for a Do-Not-Track or Global Privacy Control signal to switch off. The app does not track you across other apps and websites.

14. Children

In Short: Trovare is not directed at children under 13, and users under 18 need a parent or guardian's permission.

We do not knowingly collect personal information from children under 13. As our terms explain, the Services are intended for people aged 13 and over, and anyone under the age of majority where they live must use them with the permission and supervision of a parent or guardian. If you believe we have collected information from a child under 13, please email go@trovare.app and we will delete it.

Age checks required by law. In places where an app store age law applies, such as Texas, the iPhone app asks Apple whether your Apple Account belongs to someone under 13, 13 to 15, 16 to 17, or 18 and over, and Apple may ask you or your parent or guardian to share that. Apple tells us only the age range, not your date of birth. The age range stays on your device: it is not sent to us or to our analytics tool. We use it to apply the law. Trovare is not available to someone under 13. Where the law requires it, we ask a parent or guardian to approve significant changes to the app before a teenager can keep using the affected features, and a parent or guardian can withdraw their consent through Apple at any time. When they do, Apple stops the app opening on that device and tells us, and we keep a record of it (see section 5). The Android app does not currently ask Google Play for an age range.

15. The trovare.app website

In Short: The website uses no cookies, analytics, or advertising trackers. It collects information only if you apply to become a tour provider.

• No cookies or trackers. We do not set cookies, run analytics, or embed social media buttons or advertising pixels on the website. Fonts are served from our own site. Our hosting provider, Vercel, receives your IP address and standard request logs to serve the pages. The globe on our home page loads a public map file from the unpkg content delivery network, and some images are served by the image service of Sanity, where we manage our content. Both also receive your IP address.
• Tour provider applications. The form at trovare.app/creators/sign-up asks for your name, email address, organisation, the type of provider you are, how many tours you run, the regions you cover, your website, the kinds of tours you offer, a short pitch, and how you heard about us. Your browser keeps a draft in its local storage so you can finish later; that draft never leaves your device until you submit. When you submit, we email the application to our team and a receipt to you through Resend, and use it to assess your application and contact you about it.
• Shared links. Links to tours, trips, places, and regions on trovare.app/go open the item in the app, or take you to the App Store or Google Play. To show a preview, the page looks up the shared item; it does not look up or store anything about you.

16. How this notice maps to the App Store and Google Play labels

In Short: The App Store and Google Play each show a summary of the data an app collects. This table explains what each item on the iPhone app's App Store label means in practice, and the list after it covers Google Play. "Linked to you" means we can connect the data to your account. Where it says "No," the data is collected anonymously by a software kit inside the app (Mapbox) and cannot be connected to you. None of it is used for tracking, which Apple defines as linking your data with other companies' data for advertising, or sharing it with data brokers.

Not collected: physical address, payment information, contacts, health data, audio, browsing history outside the app, advertising data, sensitive information such as race, religion, or sexual orientation, and any data from surroundings or body scanning.

Google Play's Data safety section

The Android app's Data safety section on Google Play describes the same practices as this notice, with these differences from the Apple table above:

• Not collected on Android: purchase history (there are no in-app purchases; the app only reads the purchase records already on your account to unlock paid tours), and the trips and ratings listed under other user content. The completed-tour summary stays on your device; only your total number of finished tours and total distance go to our analytics tool.
• No Mapbox telemetry: the Android app keeps it off, so nothing is collected by the Mapbox kit.
• Sharing: Google Play counts data as "shared" only when it goes to a third party for that party's own use. Our service providers in section 8 act on our instructions, so we do not share your data in that sense.
• Optional data: analytics and crash reports, Alfred questions and photos, search, and your phone number are optional. Data is encrypted in transit, and you can delete your account from inside the app (see section 12).

17. Changes to this notice

We will update this notice when our practices change. The effective date at the top shows the current version, and earlier versions stay available at their own addresses so you can see what applied to older versions of the app. If a change is material, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent.

18. How to contact us and exercise your rights

To ask a question, exercise any of the rights in section 13, or ask us to review, correct, or delete your information, email go@trovare.app or write to us at:

We will confirm that we have received your request within 10 business days, and respond within one month if you are in the EEA, the UK, or Switzerland, or within 45 days elsewhere. If a request is complex and the law allows more time, we will tell you within that period why we need it and when you will hear from us. If you are unhappy with how we handled a request or complaint, reply to our answer and we will review it. You can also review and change your details, and delete your account, from the Settings screen in the app at any time.