Privacy Policy

This privacy notice explains what Trovare LLC ("Trovare," "we," "us," or "our") collects about you, why, who we share it with, and the choices you have. It covers:

• the Trovare app for iPhone (the "app"),
• our website at trovare.app (the "website"), and
• emails and other messages between you and us.

Together we call these the "Services." Trovare helps you find and walk self-guided tours, with turn-by-turn directions, audio narration, and Alfred, an AI guide you can ask about the places around you.

Questions or concerns? If anything here is unclear, or you do not agree with how we handle your information, please contact us at collin@trovare.app before using the Services.

What changed in this version

This notice replaces the version dated June 24, 2024. The main changes, which reflect how Trovare 1.1.0 works:

• Removed. Firebase (analytics and messaging), AppsFlyer (install attribution), the Google Ads conversion kit, and push notifications are no longer part of the app. The earlier notice's references to Google Analytics, advertising networks, retargeting, social media plugins, cookies in the app, and push notifications no longer apply.
• Added: PostHog. We now use PostHog for product analytics and crash reporting, linked to your account when you are signed in. A switch in Settings turns it off; in the EEA, the UK, and Switzerland it is off until you turn it on. See section 6.
• Added: Alfred. An AI guide, run on Anthropic's models, that you switch on yourself. See section 4.
• Added: use without an account. You can now walk a tour and ask Alfred a few questions without signing up. Guest use is tied to an anonymous ID rather than to you.
• Added: Sign in with Apple, and purchase records that are stored on your account so unlocks work on all your devices. See section 5.
• Clearer disclosures. Exactly what we collect, who processes it, how long we keep it, and how this notice maps to the App Store privacy label.

Summary of key points

• What we collect. Your account details (name, email address, and an optional phone number), your location while you use the app, the questions you ask Alfred and any photo you attach, your App Store purchases, the tours you complete and trips you book, the search terms you type, and how you use the app, including crash reports.
• What we do not do. We do not sell your information, show advertising, use your information for advertising, or track you across other companies' apps and websites. We do not use Apple's advertising identifier.
• Who helps us. We rely on Apple, Supabase, PostHog, Anthropic, Mapbox, Algolia, Resend, and Vercel to run the Services. Each acts on our instructions. See section 8.
• Your controls. You decide whether to grant location and camera access, whether Alfred is on, and whether analytics and crash reports are sent. In the EEA, the UK, and Switzerland, analytics is off until you turn it on. You can delete your account and its data from inside the app at any time. See section 12.
• App Store label. Section 16 shows how this notice maps to the App Privacy label on our App Store page.

Table of contents

1. Who we are and what this notice covers
2. What information we collect
3. Location
4. Alfred, our AI guide
5. Purchases and unlock codes
6. Analytics, crash reports, and diagnostics
7. How we use your information and our legal bases
8. Who we share your information with
9. International data transfers
10. How long we keep your information
11. How we keep your information safe
12. Your choices and controls
13. Your privacy rights
14. Children
15. The trovare.app website
16. How this notice maps to Apple's App Privacy labels
17. Changes to this notice
18. How to contact us and exercise your rights

1. Who we are and what this notice covers

Trovare LLC is a company registered in the United States at 39 South St, Washington, CT 06793. We are the "controller" of the personal information described in this notice, which means we decide why and how it is used.

This notice applies to the app, the website, and our communications with you. It does not cover other apps you open from Trovare, such as Google Maps, Waze, or Citymapper when you ask for directions, or the Phone app when you tap a tour provider's number. Those apps have their own privacy notices.

2. What information we collect

In Short: We collect what you give us to run your account, what the app needs to guide you, and technical information about how the app performs. We do not collect payment card details, your contacts, your photo library, your microphone, or health data.

Information you give us

• Account details. To create an account you give us an email address and a password, or you use Sign in with Apple. With Sign in with Apple, Apple shares your name and email address with us; you can choose Apple's "Hide My Email" option, in which case we receive a private relay address instead of your real one. We send a verification code to your email when you sign up, and a reset link if you forget your password.
• Profile details. Your name (taken from Apple, or from the first part of your email address if Apple did not share one) and an optional phone number. You can change both in Settings. A profile photo, if you add one, is stored only on your device and is never uploaded to us.
• Questions for Alfred. The text you type, and any photo you take or attach. See section 4.
• Tour activity you record. Trips you book (the trip, the date, and the gear you tick off) and the rating you give a tour when you finish it.
• Unlock codes. Partner codes you redeem to unlock a collection of tours.
• Messages to us. Anything you include when you email us or apply to become a tour provider on the website.

Information collected automatically when you use the app

• Location. Your device's location while you use the app, if you allow it. See section 3.
• Tour activity. When you complete a tour we record which tour it was, the date, the total distance, how long it took, the elevation gained, and your average speed. We do not record the route you actually walked.
• Purchases. Records of what you have bought through the App Store. See section 5.
• Search terms. The words you type into the app's search.
• How you use the app. Which screens you open, which features you use, which tours you start and finish, which audio stops you play, which tours you save offline, and when you see or dismiss a purchase screen. See section 6.
• Device and diagnostic information. Your device model, iOS version, app version and build, language, time zone, screen size, whether you are on Wi-Fi or cellular, whether you installed the app through TestFlight, crash reports, and error messages.
• Identifiers. A random account ID we create when you sign up, a random install ID that our analytics tool creates on your device, and an anonymous guest ID if you try Alfred without an account. We do not use Apple's advertising identifier (IDFA).
• IP address. Like any internet service, our servers and service providers receive your IP address with each request. It is used to secure the Services, limit abuse, and derive an approximate city-level location for analytics.

Information from other sources

The only information we receive about you from others is what Apple sends when you sign in with Apple (your name and email address) and when you buy something through the App Store (a signed record of the purchase). We do not buy or receive information about you from data brokers, advertising networks, or social networks.

Information we do not collect

• Payment card or bank details. Apple processes all payments.
• Your contacts, calendar, or photo library. The app only receives a photo you deliberately take or choose for Alfred.
• Audio from your microphone. The app plays audio; it never records it.
• Health app data, or any medical or biometric information.
• Apple's advertising identifier, or any identifier used to follow you across other apps and websites.
• A history of where you have been. Location is used live and is not stored as a track.
• Your location in the background when you are not navigating a tour.

3. Location

In Short: The app asks for "While Using" location access only. Location is used to show tours near you, to guide you along a tour, and to help Alfred answer questions about where you are. During turn-by-turn navigation it keeps running with the screen locked so directions and narration continue.

We use your location for four things:

• Nearby tours. When you open the Home screen, the app sends an approximate location (accurate to about one kilometre) to our server to list the tours closest to you.
• Navigation. While you follow a tour, your precise location is used on your device to show where you are, give the next instruction, and detect when you reach a stop. Navigation needs precise location; it will not start if you have given the app only approximate location. If you leave the route, the app sends your current position and the point to rejoin to Mapbox to calculate a new route. Navigation continues in the background with the screen locked, and iOS shows the blue location indicator while it does. It stops when you end the tour.
• Alfred. If Alfred is on and you ask a question, your precise location, the town you are in, and your local time are sent with the question so the answer fits where you are. See section 4.
• Place names. The app asks Apple's geocoding service to turn your coordinates into a town name for Alfred, and uses Apple Maps search when you type a city into the Atlas. Apple receives the coordinates or the city name for those requests.

Map telemetry. Our maps are drawn by the Mapbox software kit. That kit sends Mapbox telemetry that Mapbox uses to improve its maps: the device's precise and approximate location while a map is in use, how the map is used, performance and diagnostic information about the map, and a random identifier the kit creates for itself. Mapbox states that this is not linked to your identity, and we do not give Mapbox your account details. You can turn it off by tapping the information (i) button on the Atlas map and choosing Mapbox Telemetry, or by not granting location access.

What we store. We do not keep a log of your location or the route you walked. The only lasting record is the completed-tour summary described in section 2, which shows which tours you finished and when.

Turning it off. You can change or withdraw location access at any time in iOS Settings under Privacy & Security, Location Services, Trovare, or from the Permissions section of the app's Settings. Without location you can still browse, buy, and read about tours, but nearby tours, navigation, and Alfred's sense of where you are will not work.

4. Alfred, our AI guide

In Short: Alfred is off until you agree to use it. When you ask a question, the question, any photo you attach, your location, and details of the tour you are on are sent to our server and then to Anthropic, the AI company whose models answer you.

Before Alfred sends anything, the app shows you exactly what it sends and asks you to agree. You can switch Alfred off at any time in the Alfred section of Settings, and review "What Alfred sends" there.

When you ask a question, the app sends:

• your question, word for word (up to 500 characters);
• any photo you take or attach, reduced in size, only when you choose to add one;
• your precise location, the town, region, and country you are in, your time zone, and your local time;
• the tour you are on, the stops near you and how far away they are, and whatever tour, stop, or place you had open when you asked, including up to 2,000 characters of the text on that page;
• a conversation ID so follow-up questions make sense together.

Our server checks the question for safety, adds background information about the place, and sends it to Anthropic. To answer, Anthropic may also run a web search that uses your approximate location. Anthropic processes this information as our service provider under its commercial terms and does not use it to train its models.

Guests. You can ask Alfred a few questions (currently three) without an account. To count them, the app creates an anonymous guest ID, which is not linked to your name or email address. Guests cannot attach photos.

What we keep. We do not store your conversations in our main database; we keep only a count of questions per guest ID, and may keep a daily count per account, so we can apply our usage limits. We do keep a copy of your questions and Alfred's answers, including the location details sent with them, in our analytics tool (PostHog), linked to your account, so we can review the quality and safety of answers and investigate problems. Photos are not part of that copy: the image data is stripped out before the record is stored. If analytics is switched off (see section 6), we do not keep this copy. It is deleted when you delete your account.

Please do not include personal details about yourself or anyone else in your questions or photos. Answers are written by AI and can be wrong; do not rely on them for safety decisions.

5. Purchases and unlock codes

In Short: Purchases go through Apple's App Store. We never see your card details. We keep a record of what you bought so it works on all your devices.

Some regions and collections of tours are unlocked with a one-time in-app purchase. Apple handles the payment and receives your payment details under Apple's privacy policy. Apple gives the app a signed record of the purchase, which contains the product bought, Apple's transaction and original transaction identifiers, the purchase date, and whether it was made in Apple's sandbox or production environment. The app sends that record to our server, which verifies it with Apple's certificates and stores it against your account. When you buy while signed in, we attach your account ID to the purchase so Apple's record and ours match.

If you buy while signed out, the record waits on your device and is linked to your account the next time you sign in. You can restore purchases from Settings at any time; this asks Apple for your current purchases and updates our record.

Unlock codes. Some partners give out codes that unlock a collection of tours. When you redeem one, we record which collection was unlocked on your account and which code was used, so we can honour the unlock and stop a code being reused beyond its limit.

6. Analytics, crash reports, and diagnostics

In Short: We use PostHog, a product analytics service, to understand how the app is used and to catch crashes. This information is linked to your account when you are signed in. It is not used for advertising.

The app records events such as opening the app, viewing a screen, searching (including the words you searched for), starting, finishing, and rating a tour, playing an audio stop, saving a tour offline, opening a shared link, seeing a purchase screen, buying, restoring or failing a purchase, redeeming a code, booking or cancelling a trip, and asking Alfred (how long the question was, whether it had a photo or location, and how long the answer took, but not the question text itself). Each event carries the device and diagnostic information listed in section 2, and where it is about a tour, the tour's ID, title, creator, region, type, and distance.

Our server also records a few events: when an account is created and by which method, when a purchase is recorded or cannot be verified, when a tour is completed (with the summary statistics), when a trip is added, when a collection is unlocked or its unlock is withdrawn, and when an Alfred question is asked, answered, or blocked, or a guest reaches the question limit.

Linking. Before you sign in, events are tied to a random install ID. When you sign in, we tell PostHog your account ID, email address, and name, and earlier events from the same install are joined to your account. This lets us help you with support requests and understand how real travellers use the app. When you sign out, the app returns to a fresh anonymous identity.

Crash and error reports. If the app crashes or hits an error, a report containing the technical details of what went wrong (the code path, device model, iOS version, and app version) is sent to PostHog, on the next launch in the case of a crash. Reports are linked to your account if you were signed in, so we can follow up on problems you tell us about.

What analytics does not include. Your precise location is not attached to analytics events. The one exception is the record of Alfred conversations described in section 4, which includes the location sent with each question. Your phone number and password are never sent to analytics.

Your options. You control all of this with the "Analytics and crash reports" switch in the Permissions section of the app's Settings. If you are in the European Economic Area, the United Kingdom, or Switzerland, the switch is off until you turn it on: we ask once, when you first set up the app, and you can change your answer at any time. Everywhere else the switch is on unless you turn it off. When it is off, nothing about your use of the app is sent to PostHog, including crash reports and the copy of Alfred conversations, and our server stops recording analytics events for your account. Deleting your account deletes the analytics and crash data linked to it. You can also email collin@trovare.app with any question about analytics.

7. How we use your information and our legal bases

In Short: We use your information to run your account, guide you on tours, answer your questions, process purchases, fix problems, keep the Services secure, and meet our legal obligations. We do not use it for advertising.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the law requires us to have a legal basis for each use. The table shows each purpose, the information involved, and the basis we rely on.

We do not currently send marketing emails. If we start, we will only email you with your permission, and every message will include a way to unsubscribe.

We do not make decisions about you using automated processing that have legal or similarly significant effects. Alfred's safety screening only decides whether a question is answered.

If you are in Canada, we process your information with your express or implied consent, which you can withdraw at any time, except where the law allows or requires us to process it without consent, for example to investigate a breach of an agreement or to comply with a subpoena or court order.

8. Who we share your information with

In Short: We share information with service providers who run parts of the Services for us, with Apple for sign-in and purchases, and with others only when the law requires it or you ask us to. We never sell your information.

Our service providers act on our instructions under contracts that restrict what they may do with your information. They are:

We may also share information:

• At your direction. When you open directions in Google Maps, Waze, Citymapper, or another navigation app, the app passes only the destination coordinates to that app. When you tap a tour provider's phone number, iOS opens the Phone app. When you share a tour card or link, you choose who receives it.
• To comply with the law. If we are required to by law, a court order, or a government request, or to protect the rights, property, or safety of Trovare, our users, or others.
• In a business transfer. If Trovare is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that deal. We will tell you before your information becomes subject to a different privacy notice.

We do not sell your personal information, share it for targeted advertising, share it with advertising networks or data brokers, or share it with the partners whose unlock codes you redeem.

9. International data transfers

In Short: Trovare is based in the United States, and your information is processed there and wherever our service providers operate.

If you use the Services from outside the United States, including from the European Economic Area, the United Kingdom, or Switzerland, your information will be transferred to the United States, where privacy laws may differ from those of your country. Our analytics and crash reports are stored in PostHog's US Cloud. Where required, we rely on our service providers' Standard Contractual Clauses approved by the European Commission and the UK, and on the EU-US Data Privacy Framework for providers that are certified under it, to protect your information. You can ask us for more detail about these safeguards using the contact details in section 18.

10. How long we keep your information

In Short: We keep your information for as long as you have an account. Deleting your account in the app deletes it.

We may keep information longer if the law requires it, or if we need it to resolve a dispute or enforce our terms. When we no longer need it, we delete it or make it anonymous.

11. How we keep your information safe

In Short: We use technical and organisational measures appropriate to the information we hold, but no system is completely secure.

All traffic between the app, the website, and our servers is encrypted in transit. Sign-in tokens are stored in your device's secure keychain. Purchase records are cryptographically verified against Apple's certificates before we accept them. Access to our systems is limited to the people who need it, and our service providers are chosen for their own security practices. Even so, no transmission over the internet or method of storage is fully secure, and we cannot guarantee that your information will never be accessed or altered without authorisation. If we learn of a breach that affects you, we will tell you and the relevant authorities as the law requires.

12. Your choices and controls

In Short: Most of what we collect is under your control in the app or in iOS Settings.

• Location. Grant, limit, or withdraw location access in iOS Settings under Privacy & Security, Location Services, Trovare, or from the Permissions section of the app's Settings.
• Camera. The app asks for camera access only when you tap to take a photo for Alfred. You can change this in iOS Settings at any time.
• Alfred. Turn Alfred on or off, and review "What Alfred sends," in the Alfred section of the app's Settings. Nothing is sent to Alfred until you ask a question.
• Profile. Change your name or phone number under Profile Details, and change your password under Change Password, in the app's Settings.
• Delete your account. Tap Delete Account near the bottom of the app's Settings. This revokes your Sign in with Apple authorisation with Apple if you used it, deletes your account and the data stored on it from our database, and deletes the analytics, crash data, and Alfred records linked to you. Information stored only on your device is removed when you delete the app.
• Purchases. Use Restore Purchases in Settings or on any purchase screen. Refunds are handled by Apple.
• Local storage. Use Clear Cache in Settings to remove cached images and files, and delete saved offline tours from the tour page.
• Map telemetry. Tap the information (i) button on the Atlas map to turn Mapbox Telemetry off.
• Analytics and crash reports. Use the "Analytics and crash reports" switch in the Permissions section of the app's Settings. Off means nothing about your use of the app is sent to our analytics tool. In the EEA, the UK, and Switzerland it starts off.
• Emails. We only send service emails. If we ever send marketing, every message will include an unsubscribe link.

13. Your privacy rights

In Short: Depending on where you live, you have rights to see, correct, delete, and receive a copy of your information, and to object to or restrict how we use it. You can exercise most of them from inside the app, or by contacting us.

If you are in the European Economic Area, the United Kingdom, or Switzerland

You have the right to:

• access the personal information we hold about you and receive a copy;
• have inaccurate information corrected;
• have your information erased;
• restrict how we use it in certain circumstances;
• receive the information you gave us in a portable, machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time where we rely on it, for example for location, Alfred, or analytics, without affecting processing that happened before;
• not be subject to automated decisions with legal or similarly significant effects; we do not make any.

In these regions, analytics and crash reporting run only with your consent. The app asks once when you first set it up, and the "Analytics and crash reports" switch in Settings lets you give or withdraw that consent at any time.

You also have the right to complain to your data protection authority. In the UK this is the Information Commissioner's Office; in Switzerland it is the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first.

If you are in Canada

You have the right to access and correct your personal information and to withdraw your consent. You may also complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

If you are a resident of a US state with a privacy law

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with similar laws have the right to know whether we process their personal information, to access it, to correct it, to delete it, to obtain a copy, and not to be discriminated against for exercising these rights. Some states also give you the right to a list of the categories or names of third parties to which we have disclosed personal information.

Categories of personal information. In the past twelve months we have collected the following categories, as defined by California law:

Sensitive personal information. Under California law, precise geolocation and account log-in credentials count as sensitive personal information. We use them only to provide the features you ask for (nearby tours, navigation, Alfred, and signing in), to keep the Services secure, and for the other purposes permitted by law. We do not use or disclose them to infer characteristics about you, so the right to limit their use does not apply.

Sale, sharing, and targeted advertising. We have not sold or shared personal information for cross-context behavioural advertising in the past twelve months, and we do not do so. We do not use your personal information for targeted advertising or for profiling that produces legal or similarly significant effects. We have disclosed categories A, B, D, F, G, H, and L to the service providers listed in section 8 for business purposes.

How to exercise these rights. Use the controls in the app described in section 12, or email collin@trovare.app. We will confirm your identity, usually by asking you to write from the email address on your account, and use the information you give us only for that purpose. You may authorise an agent to make a request for you; we may ask for proof of that authorisation. If we decline a request, you may appeal by replying to our decision, and we will explain the outcome in writing. If your appeal is denied, you may contact your state attorney general.

California "Shine the Light." California residents may ask once a year for information about any personal information we disclosed to third parties for their direct marketing. We do not disclose personal information for that purpose.

Do-Not-Track and opt-out signals. The website does not use cookies or tracking technologies, so there is nothing for a Do-Not-Track or Global Privacy Control signal to switch off. The app does not track you across other apps and websites.

14. Children

In Short: Trovare is not directed at children under 13, and users under 18 need a parent or guardian's permission.

We do not knowingly collect personal information from children under 13. As our terms explain, the Services are intended for people aged 13 and over, and anyone under the age of majority where they live must use them with the permission and supervision of a parent or guardian. If you believe we have collected information from a child under 13, please email collin@trovare.app and we will delete it.

15. The trovare.app website

In Short: The website uses no cookies, analytics, or advertising trackers. It collects information only if you apply to become a tour provider.

• No cookies or trackers. We do not set cookies, run analytics, or embed social media buttons or advertising pixels on the website. Fonts are served from our own site. Our hosting provider, Vercel, receives your IP address and standard request logs to serve the pages. The globe on our home page loads a public map file from the unpkg content delivery network, and some images are served by the image service of Sanity, where we manage our content. Both also receive your IP address.
• Tour provider applications. The form at trovare.app/creators/sign-up asks for your name, email address, organisation, the type of provider you are, how many tours you run, the regions you cover, your website, the kinds of tours you offer, a short pitch, and how you heard about us. Your browser keeps a draft in its local storage so you can finish later; that draft never leaves your device until you submit. When you submit, we email the application to our team and a receipt to you through Resend, and use it to assess your application and contact you about it.
• Shared links. Links to tours, trips, places, and regions on trovare.app/go open the item in the app, or take you to the App Store. To show a preview, the page looks up the shared item; it does not look up or store anything about you.

16. How this notice maps to Apple's App Privacy labels

In Short: The App Store shows a summary of the data each app collects. This table explains what each item on Trovare's label means in practice. "Linked to you" means we can connect the data to your account. Where it says "No," the data is collected anonymously by a software kit inside the app (Mapbox) and cannot be connected to you. None of it is used for tracking, which Apple defines as linking your data with other companies' data for advertising, or sharing it with data brokers.

Not collected: physical address, payment information, contacts, health data, audio, browsing history outside the app, advertising data, sensitive information such as race, religion, or sexual orientation, and any data from surroundings or body scanning.

17. Changes to this notice

We will update this notice when our practices change. The effective date at the top shows the current version, and earlier versions stay available at their own addresses so you can see what applied to older versions of the app. If a change is material, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent.

18. How to contact us and exercise your rights

To ask a question, exercise any of the rights in section 13, or ask us to review, correct, or delete your information, email collin@trovare.app or write to us at:

We respond within the time the law allows, and normally within 30 days. You can also review and change your details, and delete your account, from the Settings screen in the app at any time.