Website (trovedeck.com): We collect standard server logs — IP address, user-agent string, and timestamp — for security and abuse detection only. There are no third-party analytics scripts or ad-tracking pixels on the homepage.

Contact form: When you submit the contact form, we collect your name, email address, and message. This information is stored solely to respond to your inquiry and is not used for marketing.

In-house products (PowerDash, POS, TroveChat, VellumNote, TroveTrack, TroveDial, TroveScope, MTPines, ReplyAI, CC Remote — each product's subdomain may carry a specific privacy supplement with additional detail):

• Account email, password (stored as a bcrypt hash — never plaintext), and display name
• Product-specific data you create: POS orders, PowerDash dashboard entries, VellumNote notes (end-to-end encrypted — see Section 3), TroveChat messages, TroveTrack habit records, and equivalent data in other products
• Billing data is processed entirely by Stripe — we receive only transaction metadata (subscription tier, payment status). We never see or store your full card number.

Custom development engagements: We collect project requirements, communication records, and any code or data you provide to fulfil the delivery. This data is governed by the terms of your engagement contract.

• We do not sell, rent, or broker your personal data to any third party.
• We do not run ad tracking, retargeting, or third-party analytics on trovedeck.com.
• We do not perform cross-site profiling or build behavioral advertising profiles.
• We do not use your strategy logic, business data, or code for our own marketing.
• We do not disclose your private code, configurations, or business intelligence without your explicit authorization.

End-to-end encryption (selected products): Sensitive product data — such as VellumNote notes — is encrypted using Argon2id key derivation combined with AES-256-GCM authenticated encryption. The encryption key is derived from your password client-side. We cannot decrypt your raw content server-side, even as the operator.

Password storage: Account passwords are hashed with bcrypt (or equivalent adaptive hashing). We never store plaintext passwords.

Infrastructure practices:

• Least-privilege access control across all services
• Layered key management and environment isolation
• Default minimum-visibility policy for all sensitive data handling
• Nightly encrypted database backups with rolling retention

• To deliver the products and services you signed up for
• To respond to your contact-form inquiries
• To process subscription billing through Stripe (we receive transaction metadata, not card data)
• To improve security posture, system stability, and support response quality
• To fulfil contractual, legal, and risk-control obligations where applicable

• Website server logs: Retained for 30 days for security and abuse detection, then rotated.
• Contact-form submissions: Retained until your inquiry is resolved, plus a reasonable follow-up window.
• In-house product data: Retained while your account is active. On account deletion, data is purged within 30 days unless retention is legally required (e.g., billing records may be retained for up to 5 years for tax compliance).
• Custom development data: Retained per the terms of your engagement contract.

You may request access, export, correction, or deletion of your personal data at any time.

• For in-house products, account deletion is typically available in product Settings.
• For all other requests, email [email protected] — we respond within a reasonable window, usually 7–14 business days.
• You may also reach us on Telegram at @trovedeck.

• Stripe — payment processing. Handles all billing card data. Subject to Stripe's Privacy Policy.
• Resend — transactional email. Sends welcome, password-reset, and receipt emails on our behalf.
• Cloudflare — DNS and CDN for some subdomains. Passes traffic and may log IP addresses at the edge per Cloudflare's Privacy Policy.

We do not use Google Analytics, Facebook Pixel, or any advertising network on trovedeck.com. Individual products may use minimal first-party telemetry — refer to each product's privacy supplement for specifics.

The trovedeck.com homepage uses a single localStorage entry to remember your language preference (EN / 中文). No tracking cookies and no third-party advertising cookies are set on the homepage.

Individual in-house products may use session cookies for authentication. Refer to each product's privacy supplement for details.

Trove Deck Solution is based in Malaysia. The third-party services we rely on (Stripe, Resend, Cloudflare) operate global infrastructure, meaning your data may transit through their servers in various regions, subject to their respective privacy policies and security standards.

We select providers with adequate security practices and, where applicable, contractual data-protection commitments.

This Privacy Policy may be updated from time to time. Material changes will be communicated with reasonable notice. The latest version is always available at trovedeck.com/privacy.html.

Privacy questions and rights requests:

• Email: [email protected]
• Telegram: @trovedeck

Effective date: 2026-05-09