How Trove handles your data.

Common Table Lab Inc. ("we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect information when you use the Trove mobile application, website, and related services (collectively, the "Service"). Trove saves links you send it, then uses automated services — including third-party AI — to read the linked page and turn it into structured, searchable content. Section 4 explains exactly what leaves our systems and who receives it. By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Service.

Last Updated: August 19, 2026

1. Information We Collect

We collect the following categories of information: Personal Information • Name • Email address • Account credentials and profile details Usage Data • App interactions and feature usage patterns • Saved posts, collections, and organizational activity • Device information, operating system, and browser type • Analytics and diagnostic data, tied to your account identifier (see Section 10) Content Data • Saved links and URLs • The content of the pages those links point to, retrieved on your behalf • Notes and user-generated text • Collections, lists, and organizational structures • Content shared with other users Location • Precise or approximate device location, when you grant permission, so the PinPath applet can center the map on where you are. Your coordinates are used to draw that map. They are not sent to our place-search provider, which receives only the words you type into a search. Location is never used for advertising, and you can revoke the permission at any time in your device settings. Microphone and Voice • Audio from your microphone, when you grant permission and use voice mode in the Mise applet. Your speech is turned into text by your device's own speech recognition rather than by us. On iPhone and iPad this happens on the device. On Android and in web browsers, the audio is sent to the platform's speech service — Google or Apple — and is handled under their privacy policies, not ours. We receive only the resulting text. We never receive or store the recording. • Spoken replies work the other way around: we send the text of the reply to our speech provider and receive audio back. No microphone audio is involved. • You can revoke the microphone permission at any time in your device settings. Transaction Data • Purchase and subscription records processed through the Apple App Store, Google Play Store, or our web payment provider

2. How We Use Your Information

We use the information we collect to: • Operate, maintain, and improve the Service • Retrieve, organize, display, and process your saved content, including the automated AI processing described in Section 4 • Provide customer support and respond to inquiries • Communicate with you about updates, features, and promotional offers • Analyze usage patterns to enhance user experience • Prevent fraud, abuse, and unauthorized access • Comply with legal obligations

3. Data Retention and Deletion

We retain personal data only for as long as necessary to provide the Service, fulfill the purposes described in this Privacy Policy, or comply with legal obligations. You can delete your account yourself at any time from your profile settings in the Trove app. You do not need to email us to ask. If you no longer have the app installed, mytrovelist.com/delete-account explains how to get your account deleted. Deleting your account removes your profile, saved content, notes, collections, and applet data from our systems. Some things do not disappear at the same moment, and we want to be plain about it: • The content we retrieve for a save, and everything our AI derives from it, is part of your save. Your copy is removed when you delete the save or your account. • One thing does survive: when several people save the same link, we keep a single shared record of that page and its extracted content, and your save points at it. That shared record and its source URL remain after you delete your account, because they are not specific to you. Nothing in it identifies you. • The internal job records that track enrichment work are removed about 7 days after the work finishes. • Audio generated for Mise's spoken replies is cached so we do not have to re-generate it, and is deleted after 60 days without use. • Our subscription provider (RevenueCat) keeps its own customer record of your purchase history after your Trove account is deleted. That record is retained by them as a processor; we no longer link it to an active Trove account. • We may retain records we are legally required to keep, such as transaction and tax records. If you want confirmation that a deletion has completed, or deletion of a record held by one of the providers listed in Section 4, contact us using the details in Section 13.

4. Automated Processing and Service Providers

We do not sell your personal data, and we do not share it with advertisers. When you save a link, that link and the content of the page it points to are sent to third-party services so they can be retrieved and turned into structured content. This includes sending saved content to large language model (AI) providers. Those providers process the content only to fulfill our request. We do not use your content to train AI models, and we do not authorize our providers to use it to train theirs. The providers we use, and what each receives: • Google Firebase (Google LLC) — authentication, database, hosting, and server functions. Receives your account details and all content you store in Trove. • Google Analytics 4 (Google LLC) — product analytics. Receives usage events keyed to your account identifier (see Section 10). • Apify and Supadata — web scraping. Receive the URLs you save and retrieve the content of those pages on our behalf. • OpenAI — AI extraction, classification, transcription, text-to-speech, and the Mise cooking assistant. Receives the retrieved page content, including the audio track of videos you save so it can be transcribed; the text of Mise's spoken replies so audio can be generated; and, when you use the Mise assistant, your messages to it along with the context it needs to answer — your recent messages in that conversation, your meal plan, your recipe titles, and your shopping list. It does not receive audio from your microphone. • Google Places (Google LLC) — place data and photos for the PinPath applet. Receives the words you type into a place search, and the identifier of a place you pick together with a token that groups the search with your selection. It does not receive your device location. • Mapbox — map rendering and city search in PinPath. Receives your device location, when you have granted permission, in order to center the map, and the words you type into a city search. • Google Cloud Vision (Google LLC) — optical character recognition. Receives images from the content you save, so that text appearing inside them can be read. • Cloudflare (Browser Rendering) — page retrieval. Receives the URLs you save and loads those pages on our behalf. • Unsplash — stock cover photography for PinPath. Receives the name of a city you are building a trip around, so a cover image can be chosen. It receives nothing else about you. • Replicate — an alternative text-to-speech provider we can switch to in place of OpenAI. When active, it receives the text of Mise's spoken replies. • Instacart — optional grocery ordering from Mise. Receives a recipe title and its ingredient lines, and only when you choose to build a cart. • RevenueCat — subscription management. Receives your account identifier and purchase records. • Apple and Google — in-app purchases. Process payments made through their stores under their own policies. • Stripe — web payments. Processes card payments made on our website under its own policies. • Have I Been Pwned — password breach screening when you choose a password. Your password is hashed on your device and only the first five characters of that hash are sent, which is not enough to identify you or to reconstruct your password. • Resend — transactional and account email delivery. Receives your email address and the message content. We also disclose information to legal authorities when required by law, regulation, legal process, or enforceable governmental request, and to other users only when you voluntarily choose to share or publish content.

5. Children's Privacy

Trove does not knowingly collect personal information from children under the age of 13 without verifiable parental consent. If we become aware that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us immediately.

6. Data Security

We implement reasonable technical, administrative, and organizational safeguards designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the right to: • Access the personal data we hold about you • Request correction of inaccurate or incomplete data • Request deletion of your personal data — you can do this yourself, see Section 3 • Withdraw consent for data processing where consent is the legal basis • Opt out of non-essential communications and marketing emails • Request portability of your data in a structured, machine-readable format To exercise any of these rights, please contact us using the information provided below.

8. Quebec Residents (Law 25)

If you live in Quebec, the following applies to you in addition to Section 7. Privacy Officer The person responsible for the protection of personal information at Common Table Lab Inc. is: David Khayutin Email: hello@mytrovelist.com You may contact our privacy officer to ask what personal information we hold about you, to have it corrected, to withdraw your consent, or to complain about how we handled it. Deprecated processing You may ask us to stop disseminating your personal information, or to de-index a link to it, where the dissemination contravenes the law or a court order, or where it causes you serious injury that outweighs the public interest in the information remaining accessible. Write to our privacy officer and we will respond within the time limits set by law. Storage and processing outside Quebec Your personal information is stored and processed outside Quebec, including in the United States, by us and by the service providers listed in Section 4. Those jurisdictions have data protection laws that differ from Quebec's. We assess the protection afforded before transferring personal information and rely on contractual commitments from our providers.

9. International Data Transfers

Your information may be transferred to, stored, and processed in countries other than your country of residence, including Canada and the United States. These countries may have data protection laws that differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to such countries.

10. Analytics and Tracking Technologies

We use Google Analytics 4 to understand how the Service is used. Analytics events are keyed to a persistent identifier for your account, not to an anonymous per-session identifier, which means usage over time can be associated with your account. We use this to improve the product, not to build advertising profiles, and we do not sell it. On the web we also use cookies and local storage to keep you signed in, remember preferences, and measure usage. You can control cookie preferences through your browser or device settings, though disabling them may affect functionality.

11. Third-Party Services

Trove retrieves content from, integrates with, and links to third-party services, including the providers listed in Section 4 and the platforms whose links you save. These services operate under their own privacy policies, and we encourage you to review them. We are not responsible for the privacy practices of third-party services.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will notify you of material changes by posting the updated policy within the Service or by other reasonable means. Your continued use of Trove following such changes constitutes your acceptance of the revised Privacy Policy.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: Common Table Lab Inc. Email: hello@mytrovelist.com