Troven Privacy Policy

Last updated: 13 September 2026

Troven ("Troven", "we", "us") is a mobile app that helps you discover movies and TV series, save them, and decide what to watch with friends. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the choices you have. Troven Lab is the data controller; Google Firebase and other processors act on our instructions (see Section 3).

This Policy supports Google Play Data safety and App Store privacy disclosures and GDPR-oriented transparency for users in the EEA/UK and elsewhere. It is not legal advice.

1. Information we collect

Account & authentication

• Email address and a unique account identifier (UID) when you sign in (Email/Password, Google, Apple, Play Games, or similar).
• Display name and chosen username.
• Authentication provider used to sign in.

Anonymous "guest" sign-in may be supported for limited flows; it does not require an email.

Content you create

• Taste preferences (genres, favorite titles, onboarding choices, streaming platforms).
• Library: watchlist, watched, skipped titles, and swipe activity.
• Friend relationships, blocks, group watch sessions, and match results.
• Messages you send in chats (friend, group, and support), including optional image attachments and bug-report metadata you choose to send.

Website waitlist

• If you join the waitlist on trovenlab.com, we collect your email address, the time you consented, and that the source was the website.
• We use this only to email you when Troven is available to download. We do not sell waitlist addresses or use them for other marketing unless you later opt in.
• You can ask us to erase your waitlist email at any time using the contact address below.

Device, diagnostics & identifiers

• Push notification token (Firebase Cloud Messaging).
• App Instance ID and usage events via Firebase Analytics (only after you accept analytics consent).
• Crash traces, device/OS info, and optional breadcrumb logs via Firebase Crashlytics (only after you accept crash-report consent).
• Advertising ID / similar ad identifiers when ads are shown and permitted (AdMob / UMP consent where required).
• App version, platform, and basic technical logs needed to operate the service.

2. How we use your information

• To provide core features: sign-in, recommendations, library, chat, friends, and group sessions.
• To connect you with friends and compute group matches.
• To send notifications (messages, session invites, and marketing). Marketing is on by default; you can turn it off in Settings → Push notifications.
• To respond to support requests and bug reports.
• To email waitlist subscribers when the app is publicly available.
• With your consent: analytics and crash reporting to improve stability and product quality.
• To show ads (where enabled) according to your ad consent choices.
• To prevent abuse and enforce our Terms.

3. Third-party services (processors)

We rely on providers that process data on our behalf, including:

• Google Firebase (Authentication, Firestore, Cloud Functions, Cloud Messaging, Analytics, Crashlytics, Hosting, Storage, Realtime Database) - see Firebase privacy.
• The Movie Database (TMDb) - movie/series metadata and images. Troven uses TMDb but is not endorsed or certified by TMDb.
• Google AdMob - advertising (test units during development; production units when live).

As controller we remain responsible for compliance. Google acts as a processor for Firebase. Where required, we maintain a Data Processing Agreement with Google via the Firebase / Google Cloud console.

4. Legal bases, consent, and this website

• Contract / legitimate interest: account, library, friends, chats, and recommendations needed to run the app.
• Consent: Firebase Analytics, Crashlytics, FIAM targeting, and personalized ads. Collection starts only after you accept the in-app User Agreement (diagnostics are enabled by default on that acceptance and can be turned off anytime in Settings → Privacy & diagnostics without losing core features).
• Waitlist: consent, via the unchecked checkbox on the website form.
• Marketing push: enabled by default in the app; you can turn it off anytime in Settings → Push notifications.

Cookies: this website does not set tracking, analytics, or advertising cookies and does not load Google Analytics or similar trackers. Joining the waitlist is a form submission of personal data described above, not a cookie. The Troven mobile app has a separate consent flow for Analytics, Crashlytics, and ads.

5. Friends, chats & visibility

• Your display name, username, and messages are visible to people you chat with or join sessions with.
• Support threads are visible to Troven support operators so we can help you.
• You can block users and report abuse from the app.
• After account deletion, remaining participants may still see historical message text until retention purge, but your profile is shown as "Deleted user" and your media files are removed.

6. Data sharing

We do not sell your personal data. Limited content you choose to share is visible to the people you share it with. Service providers listed above process data to operate the app. We may disclose information if required by law.

7. Retention & deletion

We keep account data while your account is active. You can delete your account in the app (Settings → Delete account) or via our web deletion page / email dev.vaderducking@gmail.com.

Chat messages (friend, group, and support) are retained for up to 12 months from when they were sent, then deleted or anonymized (message body and attachments cleared). You can also delete individual messages you sent in the app. Account deletion removes your personal data sooner as described below. Resolved support threads may be archived on a shorter operator timeline.

On account deletion we remove personal data from active use: Auth account deleted, username released, subcollections purged, avatars and your chat images deleted. We retain a non-identifying Firestore tombstone (users/{uid} with status: DELETED and emptied fields) for integrity and abuse prevention. Waitlist emails are kept until you ask us to remove them or we send the launch notice and then delete the list, whichever comes first (you can still request erasure sooner). We aim to complete requests within 30 days, except where law requires longer retention.

8. Security

Data is encrypted in transit. Access is restricted by Firebase Security Rules and server-side functions. No method of transmission or storage is 100% secure.

9. Children

Troven is not directed to children. You must be at least 13 years old (or the minimum age of digital consent in your country, e.g. 16 in parts of the EU) to use Troven.

10. International transfers

Firebase and Google services may process data in the United States and other countries. Where required, transfers rely on appropriate safeguards (e.g. Standard Contractual Clauses) provided by Google.

11. Your choices & rights

• Withdraw analytics / crash consent in Settings → Privacy & diagnostics.
• Disable notifications (including marketing) in Settings → Push notifications or in device settings.
• Access, correction, deletion, and objection rights under applicable law (GDPR) - contact us below. California residents: we do not sell or share personal information as those terms are used in CPRA.
• Store listings: Google Play Data safety and Apple App Privacy labels describe the same categories.

12. Changes

We may update this policy. We will revise the "Last updated" date and, where appropriate, notify you in the app.