TrovoPilot

Privacy Policy

Last updated: October 11, 2026

TrovoPilot ("we," "us," "our") provides AI-powered auction intelligence tools for resellers. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

01Data We Collect

We collect Google profile data, auction/lot data, photos, GPS (field scan only), push subscriptions (opt-in), and bid history. Data is never sold to third parties.

We collect data necessary to provide auction intelligence services:

  • Google profile data — email address, display name, and profile picture, received via Google OAuth during sign-in.
  • Auction data — auction names, lot descriptions, bid amounts, and lot statuses that you import or enter manually.
  • Lot photos — images you upload or capture for evaluation, scouting, or field scanning.
  • GPS location — captured only when you use the field scan feature, with your browser's permission. Not collected passively.
  • Push subscription — Web Push endpoint and keys, stored only if you opt in to push notifications (outbid alerts, closing-soon reminders).
  • Bid history — timestamped bid snapshots fetched from auction platforms during refresh, used for velocity analytics.

Waitlist. If you join our waitlist, we keep your email address and the date you joined. We use it only to tell you when sign-ups reopen. We won't share it, sell it or use it for marketing, and any email we send will let you unsubscribe. To be removed from the list, email privacy@trovopilot.com and we'll delete your address.

02How Data Is Stored

  • All application data is stored in Supabase (PostgreSQL) with Row Level Security (RLS) policies ensuring each user can access only their own data.
  • Photos are stored in Supabase Storage (private buckets with signed URL access).
  • Your session is stored in an encrypted JWE cookie (tp_session) using AES-256-GCM encryption via the jose library. The cookie expires after 7 days. No session data is stored server-side.

03Third-Party Services

TrovoPilot integrates with the following third-party services to provide its features:

  • Google OAuth — authentication only. We request your email, name, and profile picture. We do not access your contacts, calendar, or other Google services.
  • Supabase— database hosting, authentication token management, and file storage.
  • Google Gemini API — AI-powered lot evaluation and scouting. Lot descriptions and photos may be sent to Gemini for analysis.
  • Google Vision API — image recognition and web entity detection for lot evaluation.
  • Anthropic Claude API — alternative AI provider for lot evaluation and scouting. Lot descriptions and photos may be sent to Claude for analysis.
  • Third-party auction platforms— auction catalog import, lot data refresh, and bid monitoring via platform APIs.
  • Web Push (VAPID) — browser push notifications for outbid alerts and closing-soon reminders. Subscription data is stored per-user and can be removed at any time.
  • eBay — OAuth connection for browsing and selling data, plus comparable sold listing searches used in AI evaluation results. Privacy Policy
  • Vercel— application hosting and serverless function execution.
  • Stripe — payment processing, including credit card data and subscription management. Privacy Policy
  • Resend — email delivery for the support form, processing sender email addresses. Privacy Policy
  • OpenStreetMap / Nominatim — reverse geocoding that converts GPS coordinates into human-readable location names for field scan display. Only geographic coordinates are sent to this service; no personal data, account information, or device identifiers are included in these requests. Privacy Policy

04Data Retention

We retain your data for as long as your account is active. Auction data, bid history, and scout results are retained indefinitely to support analytics and historical reporting. You may request deletion of your data at any time (see below).

05Your Rights

You can access, export, or permanently delete all your data at any time via Settings or by contacting support.

You have the following rights regarding your data:

  • Access— request a copy of all data associated with your account.
  • Deletion— delete your account from Settings. Deletion has a 30-day grace period during which it can be cancelled; after that, all associated data is permanently removed.
  • Export— request an export of your auction data, lot records, and evaluation history in a portable format.

06Contact

For privacy-related requests or questions, contact us at privacy@trovopilot.com.