Privacy Policy

⚠️ UNREVIEWED DRAFT — DO NOT PUBLISH AS-IS. This document was drafted by an engineering-side compliance pass to accurately describe what TroveWright's systems actually do today. It has not been reviewed by a lawyer, does not constitute legal advice, and must not be treated as legally binding or published to a real user until qualified legal counsel has reviewed and approved it. Bracketed [LIKE THIS] values are facts only the business can supply (legal entity name, mailing address, jurisdiction) — the rest of the text is intentionally specific to TroveWright's actual product and data practices, not generic boilerplate, so counsel is reviewing real claims rather than filling in a template.

Effective date: [DATE — do not set until this document is approved for publication]

1. Who we are

TroveWright ("TroveWright," "we," "us," or "our") operates a marketplace and companion tools for trading card and collectible enthusiasts, connecting individual collectors with each other and with local game stores ("LGS") for buying, selling, trading, and organizing events around trading cards and collectibles. This policy explains what information we collect through the TroveWright app and related services, why we collect it, and what choices you have.

TroveWright is operated by Frosty Fitz Games LLC, a Massachusetts limited liability company, located at [COMPANY STREET ADDRESS], Massachusetts, USA. TroveWright is launching first for users in the United States; Section 10 and Section 11 below also describe your rights if you're located in California, the EU, or the UK, since we intend to support those users soon after. If you have questions about this policy or your information, contact us at privacy@trovewright.app — see Section 14.

2. Information we collect

Account information. When you create a TroveWright account, we collect the email address and password you register with (handled by Firebase Authentication, a Google service — we never see or store your password ourselves) and a display name you choose. If you sign up as a seller, we also collect your date of birth, which we use solely to confirm you meet TroveWright's minimum age requirement (see Section 6) — we do not use date of birth for any other purpose, and it is not shown to other users.

Profile and content information. Information you choose to add to your account or create within the app, including: a seller bio, listing descriptions and photos (stored via Firebase Storage), organization names and details (if you create or manage a store/LGS organization), public "stacks" (curated collections you choose to share via a link), and event details (if you create or manage events through an organization).

Subscription billing information. If you subscribe to a paid plan (Pro, Dealer, or Vendor), Stripe processes your subscription payment — the same privacy-preserving relationship described for marketplace transactions below: TroveWright does not collect or store your full payment card number. We retain a record of your plan, billing status, and subscription history as part of your account.

Transaction information (marketplace — not yet live). TroveWright's peer-to-peer marketplace has not yet launched to users; this paragraph describes how it will work once it does. When you buy or sell through the marketplace, payment will be processed by Stripe (via Stripe Checkout for buyers and Stripe Connect for sellers receiving payouts). TroveWright will not collect or store your full payment card number, bank account number, or other raw payment credentials — those will be handled directly by Stripe under Stripe's own privacy policy. We will retain records of the transactions themselves (what was purchased, for how much, and between which accounts) as part of your TroveWright order history.

Shipping address (marketplace — not yet live). Once the marketplace launches, if you buy an item on it, the recipient name and mailing address you enter at checkout will be stored as part of the order record and shared with the seller (Section 4) so they know where to send it. It will not be shown to any other user or made public.

Payment handles (optional). If you choose to accept Venmo, CashApp, and/or PayPal at in-person point-of-sale checkout, you can add your Venmo username, CashApp cashtag, and/or PayPal username to your account. We store whatever handle(s) you provide and use them solely to generate a QR code that lets a customer pay you directly through their own Venmo, CashApp, or PayPal app. TroveWright does not process, receive, or hold any money through this feature and is not a party to that payment — it is separate from the Stripe-processed marketplace transactions described above.

Communications. If you join TroveWright's waitlist or otherwise provide your email for updates, we use that address to send you the specific message you signed up for (e.g., a waitlist invitation) via our email provider, Resend. Every such email includes an unsubscribe link.

Reports and moderation records. If you report another user's content, or if content you post is reported or reviewed by TroveWright's moderation team, we retain a record of that report (who filed it, what it concerned, and how it was resolved) as part of maintaining a safe marketplace.

What we do not collect. TroveWright does not currently use any third-party analytics or advertising tracking SDKs. We do not collect precise device location, contacts, or browsing history outside the app. We do not buy or sell personal information to data brokers.

3. How we use your information

We use the information above to: operate your account and authenticate you; display your listings, storefront, and public stacks to other users as you've configured them; process marketplace transactions and payouts; send you transactional communications (order confirmations, account notices) and, where you've opted in, other communications like waitlist invitations; verify eligibility to use age-gated features; investigate and act on reports of content or accounts that violate our Terms of Service; and maintain the security and integrity of the platform (e.g., detecting abuse, enforcing blocks between users).

We do not use your date of birth, transaction history, or account information to build an advertising profile, and we do not sell your personal information.

4. How we share your information

With other users, as you direct. Your display name, seller bio, listings, and any public stack you choose to share are visible to other TroveWright users by design — that's how a marketplace and collection-sharing feature work. You control what you make public. If you've enabled a Venmo, CashApp, or PayPal handle for point-of-sale payments (Section 2), that handle is shown to the customer completing a transaction with you at checkout. Once the marketplace launches, if you buy an item that ships, the shipping name and address you provide will be shared with the seller so they can fulfill your order (Section 2).

With service providers who process data on our behalf:

• Google Firebase — authentication, image storage, and underlying app infrastructure.
• Stripe — payment processing (Checkout) and seller payouts (Connect). Stripe's handling of your payment information is governed by Stripe's own privacy policy.
• Resend — delivery of waitlist and transactional emails.

Each of these providers processes data only as needed to provide their service to TroveWright and is contractually restricted from using it for their own purposes.

For legal reasons. We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith it's necessary to protect the rights, property, or safety of TroveWright, our users, or the public.

We do not sell your personal information to third parties, and we do not share it with advertisers.

5. Children's privacy and minimum age

TroveWright is not directed at children, and no one under 13 is permitted to use TroveWright. Sellers are required to confirm their date of birth before listing items for sale, and TroveWright's systems enforce this minimum age at both the app and server level. If we learn that we've collected personal information from a child under 13 in violation of this policy, we will delete that information and the associated account. See TroveWright's Terms of Service for the full eligibility requirements.

6. Reporting, blocking, and content moderation

TroveWright provides tools to report content or accounts that violate our Terms of Service, and to block other users so their content is no longer shown to you. Filing a report or block is visible only to TroveWright's moderation team, not to the person you reported or blocked — we do not notify a user that they've been reported or blocked. We retain report records for moderation and safety purposes even after a report is resolved.

7. Data retention and deletion

We retain your account information for as long as your account is active, and transaction records for as long as needed for legitimate business, tax, and legal purposes after that.

Requesting deletion. At this time, TroveWright does not yet offer a fully self-service "delete my account" option inside the app. To request deletion of your account and associated personal information, email privacy@trovewright.app from the email address associated with your account. We will process deletion requests manually, subject to any records we're legally required to retain (for example, transaction records needed for tax purposes).

If you signed up but never completed account setup (for example, you started creating an account but didn't finish age verification), that incomplete account and its data are removed automatically as part of that flow.

8. Your choices

• Waitlist emails: every waitlist email includes a one-click unsubscribe link.
• Blocking: you can block another user from your account settings at any time; this hides their content from your searches and prevents new transactions between you.
• Reporting: you can report a listing, seller profile, organization, public stack, or user account directly from that content.
• Public content: you control what you make public (your seller profile, listings, and any stack you choose to share via link) and can take that content down at any time through the app.
• Payment handles: you can add, change, or remove your Venmo, CashApp, and PayPal handles from your account settings at any time; removing a handle disables that payment option at checkout.

9. Security

We use industry-standard measures to protect your information, including relying on Firebase Authentication for credential security (we never store raw passwords) and Stripe for payment credential handling (we never store raw card numbers). No system is perfectly secure, and we cannot guarantee absolute security of information transmitted to or from TroveWright.

10. California Privacy Rights (CCPA/CPRA)

If you're a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), gives you specific rights over your personal information, in addition to the choices described in Section 8.

Categories of personal information we collect. In the past 12 months, we've collected the following categories of personal information, as the CCPA defines them:

• Identifiers — email address, display name, unique account ID, and (if you complete a marketplace purchase that ships to you) your shipping name and postal address.
• Protected classification characteristics — date of birth, collected only from sellers and solely to confirm minimum-age eligibility (Section 2); not shown to other users.
• Commercial information — subscription plan and billing history, and (once the marketplace launches) records of marketplace purchases, sales, and transaction history.
• Financial information — if you enable point-of-sale peer-to-peer payment (Section 2), the Venmo, CashApp, or PayPal handle you provide; we do not collect bank account or payment card numbers ourselves (Section 2, "Transaction information").
• Internet or other electronic network activity — basic in-app activity needed to operate the Service (e.g., what listings or stacks you view); we do not use third-party analytics or advertising tracking SDKs (Section 11).
• User-generated content — listings, seller bios, organization details, public stacks, event details, and reports you file.

We collect these categories from the sources and for the purposes described in Sections 2 and 3.

We do not sell or share personal information. As those terms are defined by the CCPA, TroveWright does not sell personal information and does not share it for cross-context behavioral advertising. There's no "Do Not Sell or Share My Personal Information" link because there's nothing to opt out of.

Your rights. Subject to certain exceptions, California residents have the right to: know what personal information we've collected, used, and disclosed, and why; delete personal information we've collected from you (Section 7 describes how deletion currently works); correct inaccurate personal information we hold about you; non-discrimination for exercising any of these rights; and appeal a denial of a rights request. TroveWright doesn't collect any category the CCPA defines as "sensitive personal information" (e.g., government ID numbers, precise geolocation, financial account credentials), so the right to limit use of sensitive personal information doesn't apply.

How to exercise these rights. Email privacy@trovewright.app from the email address associated with your account; we verify your identity via your account before acting on the request. You may designate an authorized agent to submit a request on your behalf, subject to our ability to verify both the agent's authority and your identity.

[Open item for legal review: confirm the category classifications above (especially treating date of birth as a "protected classification characteristic" rather than something requiring stricter handling, and treating a self-entered Venmo/CashApp/PayPal handle as "financial information" under Cal. Civ. Code § 1798.80(e) rather than a plain identifier, since it is a username the user chooses to publish rather than an account credential) against current CCPA/CPRA regulations, and confirm whether a documented appeal process beyond re-contacting privacy@ is required before this ships to California users.]

11. EU and UK users (GDPR / UK GDPR)

If you're located in the European Economic Area or the United Kingdom, the EU General Data Protection Regulation and/or UK GDPR give you additional rights over your personal information.

Legal basis for processing. We rely on: performance of a contract for account creation, marketplace transactions, and core Service functionality (Section 3); legitimate interests for platform security, fraud/abuse prevention, and the reporting and moderation system (Section 6), balanced against your rights; consent for optional communications like waitlist emails, which you can withdraw at any time (Section 8); and legal obligation where retention is legally required (Section 7).

Your rights. Subject to certain exceptions, you have the right to access the personal information we hold about you, request correction of inaccurate information, request erasure, restrict or object to certain processing, and receive your data in a portable format. Email privacy@trovewright.app to exercise any of these rights.

International data transfers. TroveWright's service providers — Google Firebase and Stripe (Section 4) — operate globally, so your information may be transferred outside the EEA/UK, including to the United States.

[Action item, not something this draft can confirm unilaterally: verify and document the specific transfer safeguard each vendor relies on (e.g., Standard Contractual Clauses) from Google's and Stripe's own data processing agreements before this section is finalized.]

EU/UK representative. [Action item: TroveWright does not currently have a physical presence in the EU or UK. If TroveWright processes EU/UK residents' personal information at a scale that triggers the Article 27 GDPR / UK GDPR representative requirement, a representative needs to be appointed before launching to those users — a business/legal decision, not something this draft resolves on its own.]

Complaints. You have the right to lodge a complaint with your local data protection supervisory authority.

12. Cookies and similar technologies

TroveWright's mobile app does not use tracking cookies or third-party advertising identifiers. The app relies on Firebase Authentication session tokens, which are functionally necessary to keep you signed in and are not used for tracking or advertising purposes. TroveWright's website(s) may use functionally necessary cookies (e.g., to support the waitlist form); if that changes to include analytics or advertising cookies in the future, this section will be updated and, where legally required, a cookie consent mechanism will be added.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll provide notice (for example, through the app or by email) before the changes take effect. The "Effective date" above reflects the date this policy was last updated.

14. Contact us

Questions about this policy or your information: privacy@trovewright.app

General support: support@trovewright.app (see Terms of Service and the in-app "Contact support" link)