Privacy Policy

This Privacy Policy explains how Council Fire (“Trovance,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects information in connection with the Trovance application available at app.trovance.ai and related services (the “Service”). It applies to visitors of our sites, people who create an account, members of a workspace, and end users who interact with the Service.

Trovance is “the growth engine for the agentic web.” The Service monitors how AI answer engines (such as ChatGPT, Perplexity, Google AI Overviews, Gemini, and Claude) respond to buyer questions about your brand; runs a first-party, cookieless analytics pixel you can install on your own website to measure human and AI-assistant traffic; connects — with your permission — to your Google Analytics and Google Search Console accounts to show your reporting alongside AI-visibility data, to generate content recommendations, and to measure the results of what you publish; reads results and documents from other tools you choose to connect (HubSpot, Attio, Klaviyo, Mailchimp, Notion, and Google Drive); drafts marketing content for your brand; and lets you work with Trovance by text message over iMessage (“Text Trovance”).

1. Who we are

The data controller responsible for your information is Council Fire. You can reach us at zachc@councilfire.org with any privacy question, or to exercise the rights described below.

2. Data we collect

Account and profile data

• Email address. Used to authenticate you, to name your workspace (from the email’s local part), and to identify you to fellow workspace members.

• Password. Set at sign-up and hashed and held by our authentication provider (Supabase Auth). Trovance never sees or stores your plaintext password.

• Anonymous / URL-only sign-up sessions. You can start onboarding with only your website URL. We create an anonymous session on a placeholder account that becomes a permanent account when you claim it; unclaimed sessions are kept until you claim them or ask us to delete them.

• Member profile. Optional display name, job title, avatar photo, and an author “voice” text sample used to match content to your writing style.

• Team invitations. Email addresses, roles, and invite tokens for teammates you invite to a workspace.

• Collaboration data. Comment bodies, @-mention identities, quoted selections, and decision/publish attribution.

Usage and analytics data

• Product analytics (Mixpanel) — on by default. When you use the app while signed in, we send behavioral analytics to Mixpanel to understand activation, funnels, retention, and feature usage. This includes your account identifier (used as a distinct id), registered properties (brand id, plan, role, plan status), and events such as page views (URLs with path), onboarding steps, card actions, and publishing, plus server-side events for subscription and engine-cycle outcomes. This analytics is enabled by default and does not honor the browser “Do Not Track” signal. You can turn it off at any time using the in-app opt-out in Settings, which stops tracking and deletes your Mixpanel identity. See Cookies & tracking.

• Cookieless traffic pixel. If you install the Trovance Pixel on your website, we collect website-visitor telemetry to measure human pageviews and AI-assistant referrals: pathname, full URL, document referrer, and UTM parameters, plus a random per-event id and (via an optional server middleware snippet) the names of AI crawlers that fetch your pages. The pixel is cookieless — it sets no cookie. A visitor’s IP address and user-agent are used only transiently to compute a daily-rotating, salted SHA-256 visitor hash and are never stored in raw form. Because the salt rotates daily, visitors can be counted within a day but not tracked across days.

• IP address (transient). Because all traffic passes through our hosting provider, we briefly process client IP addresses to build the cookieless visitor hash and a rate-limiting hash for our public onboarding “door,” and to send to our bot-protection provider for verification. We do not store raw IP addresses.

• Standard logs. Our hosting and infrastructure providers generate access logs (URLs, user agents, timestamps) as part of serving requests.

Connected-service data

• Google Analytics 4 & Google Search Console. If you connect them, we access your Google reporting and search-performance data on a read-only basis. This is described in full in the dedicated Google user data section below.

• Bing Webmaster Tools. We read Bing/Copilot search-performance metrics for the connected site to display in your dashboard and to generate recommendations. This currently uses a Trovance-owned platform key, not a per-user Microsoft sign-in.

• HubSpot and Attio (CRM). If you connect them, we read your deal pipelines: stage names and where recent deals sit in them (HubSpot: the stages of deals created in the last 30 days, through the read-only crm.objects.deals.read scope; Attio: 30-day counts of deals by stage, through read-only access to records and their configuration). If someone on your team marks a deal stage as an outcome to measure, we also read each deal’s stage history, amount, and currency, and keep a ledger of those outcomes keyed by one-way hashes of the deal records. We don’t store deal names, contacts, or titles.

• Klaviyo and Mailchimp (email). If you connect them, we read your account or organization name and your last 30 days of sent campaigns: their names, send times, and delivery and engagement counts (Klaviyo: deliveries and unique clicks, through the read-only accounts:read, campaigns:read, and metrics:read scopes; Mailchimp: sends, bounces, unique clicks, and unsubscribes, through Mailchimp’s account-wide access, which we use only to read these reports). We don’t read your subscriber lists.

• Notion and Google Drive (documents). If you connect them, we read only the Notion pages you share with Trovance’s integration, or the Google Docs and Slides you pick, and save a copy of each one you import into your Brain. For Notion we also store the connected workspace’s name and id. Google Drive is covered in the Google user data section below.

• How these six connections work. We only read from them. Each one is summarized daily into a snapshot that members of your brand can see, and our assistant can pass that snapshot to Anthropic when you ask it about your business. Campaign results from Klaviyo and Mailchimp can also become recommendations.

• Stripe (billing). When you subscribe, we store Stripe object identifiers (customer id, subscription id, price/plan, status) and the brand id linking checkout to your brand. Card and payment details are entered on Stripe-hosted checkout and are held by Stripe — the Service never receives or stores your card data.

• Stored third-party credentials. To publish and integrate on your behalf, we store credentials you provide or authorize: Google OAuth refresh tokens (for Analytics, Search Console, and Drive), WordPress usernames and application passwords, webhook signing secrets, and other connector access/refresh tokens. We encrypt the tokens, passwords, and secrets at the application layer (AES-256-GCM) when we store them; they are locked to an internal worker role and are never readable by the browser. API keys for our MCP/agent server are stored as hashes (digests) only.

Content you create

• Brand details (name, website domain, settings, pixel id), your Brand Core, ICP personas, taxonomy, notes, and sources.

• Drafts and other brand-authored and AI-generated content you create in the editor, including images you select from the stock-image search.

• Crawled content from your own website and from competitor websites (public pages, extracted entities, crawl runs) used to build your brand model and recommendations.

• Documents you upload to your Brain, such as PDFs, Office documents, and images: the original file, kept in private storage that members of your brand can download; a readable Markdown copy, split into sections; and, once you approve the import, a copy among your sources and a Brain note. We extract the text ourselves, without an outside parsing service. Scanned pages and images are sent to Anthropic for transcription only with your consent, and we record who gave it and when.

Text messages (Text Trovance)

• Mobile number. When you text Trovance or connect your phone in Settings, we store your number encrypted (AES-256-GCM), a keyed one-way hash of it so we can recognize your texts, and its last four digits so you can see which phone is connected. If you start an account by text, the account is created with your mobile number instead of an email address and password: our authentication provider (Supabase Auth) holds the number, and you sign in through one-time links we text you.

• Messages and files. We store the texts you send from a connected phone, and every reply we send, encrypted. If a number we don’t recognize texts us without starting a company preview, we keep only a one-way key for that message, not its text or the number. When you confirm a draft, note, or Brand Core change by text, it is saved to your workspace like an edit made on the web. Files you text from a connected phone are saved to your workspace’s private document storage when they arrive, and are added to your Brain only if you approve the import.

• Company previews. If you text us your company’s website before you have an account, we create a preview workspace for it, holding your company’s name, domain, description, and audience; the priority you tell us; sample buyer questions with the AI answers and sources we found; and a sample draft.

• Consent, codes, and preferences. We record the version of the consent wording you agreed to, and whether you replied STOP. Codes and links that connect a phone or open the app from a text are stored only as hashes or encrypted, and expire within 10 to 30 minutes. If you ask for activity summaries, we store their schedule (frequency, day, hour, and time zone) encrypted.

Contact form and newsletter

• Contact form. If you write to us through the contact page on trovance.ai, we receive your name, email address, company (if you give it), and message by email, sent through Resend, and use them to reply. The site doesn’t store them; to slow repeated sends, it briefly keeps a salted hash of your IP address in memory.

• Newsletter. The newsletter form on trovance.ai opens our Substack page with the email address you enter filled in; you subscribe there, under Substack’s own terms and privacy policy. The site itself doesn’t store the address.

3. Google user data (Google Analytics, Search Console & Drive)

This section describes exactly what Google data Trovance accesses, how we use it, where we store it, how long we keep it, and how you can revoke access. Connecting Google is entirely optional and initiated by you.

Trovance requests three Google OAuth scopes. The first two are read-only; the third reaches only the files you pick:

• Google Analytics — https://www.googleapis.com/auth/analytics.readonly

• Google Search Console — https://www.googleapis.com/auth/webmasters.readonly

• Google Drive — https://www.googleapis.com/auth/drive.file, which reaches only the files you choose in Google’s file picker

A brand owner or editor connects each service through Google’s standard offline OAuth flow. At the callback we exchange the authorization code for an offline refresh token and store only that token, per brand. We only read your Google data — we never create, modify, or delete anything in your Google Analytics or Search Console accounts.

Google Drive is connected separately, with its own Google consent screen. You choose files in Google’s own file picker, which runs in your browser with a short-lived access token that only the person who connected Drive receives. Although the drive.file scope would allow changes to the files you pick, Trovance only reads them; it never creates, changes, or deletes anything in your Drive. For Drive we also store the connected account’s display name and Google permission id, which members of your brand can see.

What we access

• Google Analytics 4 (Data API + Admin API): aggregate, non-personal traffic metrics — active users, new users, sessions, engaged sessions, user engagement duration, screen/page views, and key events (by event name), by date — plus breakdowns by session source, default channel group, hostname, page path (including any query string), and landing page, and the list of your GA4 properties (account summaries) so you can choose which property to display.

• Google Search Console (Search Analytics API): totals (clicks, impressions, CTR, average position) and breakdowns by date, by search query (the actual search-term strings), and by page URL, plus per-page query drill-downs and the list of your verified sites.

• Google Drive (Drive API, with the Google Picker): for each Google Doc or Slides file you pick, its file details (such as its name) and a plain-text export of its contents.

How we use it

All Google data is used solely to (a) display your own analytics and search-performance data inside your Trovance dashboards; (b) generate content recommendations for your own brand; (c) measure how pages you publish or change through Trovance perform afterward; (d) add questions to track in AI answers, drawn from your own Search Console queries; and (e) bring the Google Docs and Slides you pick into your Brain. We do not sell it, use it for advertising, or use it to develop, improve, or train any generalized or non-personalized AI/ML models. We share it only with service providers that process it on our behalf to provide these features: Anthropic receives a Search Console query and the page it concerns when drafting a page recommendation, and the text of the Drive files you import; and when one of your Search Console queries becomes a tracked question, its text is sent to the AI answer engines we monitor for you (see Section 6).

How we store and retain it

• Refresh token. Stored per brand in our database (Supabase Postgres), in a column granted only to an internal worker role and never selectable by the browser, and scoped by row-level security to members of the owning brand. We encrypt it at the application layer (AES-256-GCM) when we store it; the encryption is reversible because the token must be usable to call Google’s APIs. The Google Drive refresh token is stored the same way, with your other connections. Short-lived access tokens are minted on demand from the refresh token and are never persisted.

• Analytics & Search Console dashboard reads. Fetched live from Google each time a dashboard renders and are not written to our database.

• Results history. To measure what your published work changes, we also collect a rolling 90-day history of your reports into tables only our internal worker role can read: Search Console clicks, impressions, and position by page and query; and Analytics views and engagement time by page, sessions and engaged sessions by landing page and channel, and key events by name, each by date. Days older than 90 are deleted as new ones arrive. For pages you publish or change through Trovance, we keep their daily clicks, impressions, and views as a fixed baseline, so a result can still be checked after those 90 days.

• Recommendations (Search Console). Our recommendations “organic loop” reads your top Search Console query rows and persists derived recommendation cards whose stored title, angle, and evidence embed the actual search-query strings and their clicks, impressions, and position into our database. Page recommendations likewise store the search query they respond to, with its clicks, impressions, and position, and the page’s Analytics views; and each week up to ten of your Search Console queries can become saved, tracked questions.

• Retention & deletion. Disconnecting Analytics or Search Console deletes that connection’s refresh token and its 90-day results history; disconnecting Drive deletes its token. Recommendation cards, tracked questions, result baselines, and imported Drive copies stay with your brand until the brand is deleted (row deletions cascade on brand deletion) or you ask us to delete them. You can disconnect at any time in the app, or email us at zachc@councilfire.org to request deletion. You may also revoke Trovance’s access directly from your Google Account’s third-party access settings.

Limited Use

Limited Use Disclosure. Trovance’s use and transfer of information received from Google APIs — including data obtained through the Google Analytics Data API (https://www.googleapis.com/auth/analytics.readonly), the Google Search Console API (https://www.googleapis.com/auth/webmasters.readonly), and the Google Drive API (https://www.googleapis.com/auth/drive.file) scopes — will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically: (1) we only access your Google Analytics, Google Search Console, and Google Drive data to provide and improve user-facing features that are prominent in Trovance’s interface (your reporting, traffic, and search-performance dashboards and analyses, the measured results of your published work, and the documents you import into your Brain); (2) we do not transfer or sell this data to third parties such as advertising platforms, data brokers, or information resellers; (3) we do not use this data for serving advertisements, including personalized, retargeted, or interest-based advertising; (4) we do not allow humans to read this data unless we first obtain your explicit consent to view specific data, it is necessary for security purposes (such as investigating abuse) or to comply with applicable law, or the data is aggregated and anonymized and used for internal operations; and (5) we do not use this data to develop, improve, or train generalized or non-personalized AI and/or ML models. We access your Google data on a read-only basis and do not modify or delete it.

4. How we use information

• Provide, operate, secure, and maintain the Service and your account.

• Authenticate you and manage workspaces, teams, roles, and invitations.

• Monitor AI answer engines and search engines for your brand and display AI-visibility, traffic, and search-performance results.

• Generate drafts, brand models, recommendations, and other content for your brand.

• Measure what your published work changes, using results from Google and the tools you connect, and learn from those results to shape later recommendations.

• Process subscriptions, billing, and plan management through Stripe.

• Send transactional and lifecycle email (digests, alerts, sign-off requests, notifications).

• Reply to texts you send Trovance; send the updates you ask for and notices about your workspace (such as a draft being ready, or billing notices for owners and admins), only in a conversation you started; and carry out the actions you confirm by text, such as saving or publishing a draft. We don’t send marketing texts.

• Understand product usage and improve the Service (product analytics), subject to your opt-out.

• Detect, prevent, and investigate abuse, fraud, and security incidents.

• Comply with legal obligations and enforce our terms.

5. Legal bases for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to create your account, provide the Service, run monitoring and content generation, and process billing.

• Consent — to connect your Google Analytics and Search Console accounts and other integrations, to connect your phone and receive texts from Trovance, and where consent is otherwise required. You may withdraw consent at any time (e.g. by disconnecting an integration, replying STOP to Trovance, or opting out of analytics).

• Legitimate interests — to secure the Service, prevent abuse, measure and improve our product, and operate our cookieless traffic analytics, balanced against your rights.

• Legal obligation — to meet accounting, tax, and other legal requirements.

6. Sharing and subprocessors

We do not sell your personal information. We share data only with the service providers (subprocessors) below, who process it on our behalf to run the Service, and only as needed for the purposes described. We may also disclose information to comply with law, enforce our terms, or protect rights and safety, and in connection with a merger, acquisition, or asset sale.

Workspace member email addresses are visible only to fellow members of the same workspace. Content you publish (e.g. to your WordPress site) and webhook payloads are sent only to the destinations you configure.

Texts with Trovance travel over Apple’s iMessage service, which Apple operates under its own privacy policy. We don’t sell your mobile number, and we don’t share it, or your consent to receive texts, with anyone for their marketing: it goes only to the messaging providers above, to deliver your conversation with Trovance. When we build a company preview, the AI answer engines receive only sample buyer questions, which don’t name you or your company.

7. Data retention

We retain personal information for as long as your account, workspace, or brand is active and as needed to provide the Service. When a brand or workspace is deleted, associated rows are deleted and cascade accordingly. Google refresh tokens and the 90-day Google results history are retained until you disconnect Google or the brand is deleted; recommendation cards, tracked questions, and result baselines drawn from Google data stay until the brand is deleted (see Section 3). Disconnecting another connection deletes its tokens and daily snapshot; recommendations drawn from it are archived rather than deleted, documents imported from it stay in your Brain, and a CRM outcome ledger stays until the brand is deleted. Removing an uploaded document deletes the file, its sections, and its Brain note; an archived copy of its text stays among your brand’s sources, and drafts already written from it are kept. Cookieless traffic events contain only a daily-rotating hashed visitor identifier and derived pageview metadata; raw IP addresses and user-agents are never stored. Text Trovance records (your encrypted number and messages, a connection’s history, opt-outs, and company previews) are not deleted automatically. Disconnecting your phone or replying STOP ends messaging and cancels anything pending but keeps that history; it is deleted when your account, brand, or workspace is deleted, or when you ask us. If a number that isn’t connected replies STOP, we keep a one-way hash of it and the time, so we don’t text it again. Unclaimed company previews are kept until you claim them or ask us to delete them. We may retain limited records longer where required for legal, tax, security, or dispute-resolution purposes.

8. Security

We take reasonable technical and organizational measures to protect your information. Access to the database is governed by row-level security scoped to workspace and brand membership. Sensitive credential columns — including Google and connector refresh tokens and webhook secrets — are granted only to an internal worker role and are never readable by the browser. MCP/agent API keys are stored as hashed digests. Passwords are hashed by our authentication provider and never seen by the app. Card data is handled entirely by Stripe. Outbound network calls are centrally allowlisted per vendor and protected against server-side request forgery. Because Google refresh tokens and connector secrets must be usable to call the respective third-party APIs, we encrypt them at the application layer (AES-256-GCM) when we store them, rather than one-way hashing them, and lock them to the worker role. Phone numbers and text messages are encrypted the same way, with their own key, and the messaging tables are open only to the worker role. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights and choices

GDPR (EEA, UK, and Switzerland)

If the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal data we hold about you and obtain a copy.

• Rectify inaccurate or incomplete data.

• Erase your data (“right to be forgotten”), subject to legal exceptions.

• Restrict or object to certain processing, including processing based on legitimate interests.

• Data portability — receive your data in a structured, machine-readable format.

• Withdraw consent at any time, without affecting prior processing.

• Lodge a complaint with your local supervisory authority (Data Protection Authority).

To exercise these rights, email zachc@councilfire.org. We will respond within the timeframes required by applicable law.

CCPA/CPRA (California)

If you are a California resident, you have the right to:

• Know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of parties with whom we share it.

• Delete personal information we collected from you, subject to legal exceptions.

• Correct inaccurate personal information.

• Opt out of the “sale” or “sharing” of personal information. Trovance does not sell your personal information and does not share it for cross-context behavioral advertising.

• Non-discrimination — we will not discriminate against you for exercising your rights.

You may exercise these rights, including through an authorized agent, by emailing zachc@councilfire.org. We will verify your request as required by law.

Text messages

Reply STOP at any time to stop all texts from Trovance, or UPDATES OFF to stop activity summaries only. You can also disconnect your phone in Settings. Neither deletes your history; to have it deleted, email zachc@councilfire.org.

10. Cookies & tracking

• The Trovance traffic Pixel is cookieless. It sets no cookies and stores no raw IP addresses or user-agents; it identifies visitors only through a daily-rotating, salted, non-reversible hash, so visitors can be counted within a day but not tracked across days or across sites.

• Product analytics is on by default. Our in-app product analytics (Mixpanel) is enabled by default and intentionally does not honor the browser “Do Not Track” signal. You can turn it off at any time using the opt-out switch in Settings; doing so stops tracking and deletes your analytics identity. Your choice is remembered on your device and, for signed-in accounts, on our servers.

• We and our authentication provider use strictly necessary cookies/local storage to keep you signed in and to remember your analytics and theme preferences.

• Text Trovance links. The Text Trovance button on trovance.ai is a plain link that opens your messaging app: the site collects nothing when you use it and sets no cookies. Our cookieless site analytics count its uses, such as taps and QR-code scans, by page name only, and the QR page notes a scan in your browser’s session storage so it’s counted once per visit. When you open a link we texted you, the app sets a short-lived, strictly necessary cookie to finish that step (messaging-trial, 30 minutes; messaging-access, 10 minutes), and product analytics doesn’t load on those pages.

• Our marketing site uses Fathom Analytics. trovance.ai runs Fathom, a cookieless analytics service that counts pageviews and named events (such as a tap on Text Trovance) without cookies or cross-site tracking. It is not used inside the application.

11. International data transfers

Trovance is operated from the United States, and our subprocessors may process data in the United States and other countries. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism. Contact us for more information about the safeguards we use.

12. Children

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us at zachc@councilfire.org and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

14. Governing law

This Privacy Policy is governed by the laws of the State of Maryland, USA, without regard to its conflict-of-laws rules, except where mandatory local data-protection law provides you additional rights.

15. Contact us

Questions, requests, or complaints about this policy or your data? Contact Council Fire at zachc@councilfire.org.