Privacy Policy

Last updated: 2026-05-15
Effective date: 2026-05-15

This Privacy Policy describes how Trovio ("we", "our", "the App") collects, uses, and protects your personal data when you use our mobile application.

Data Controller: Eduardo Assis da Silva (individual, Brazil).
Contact: silvaassiseduardo88@gmail.com

1. About Trovio

Trovio is a location-based messaging service. Users create messages anchored to physical locations; recipients can only unlock and read those messages when physically present within a configured radius around the anchor point.

2. Age Requirement

Trovio is intended for users aged 16 years or older. We do not knowingly collect personal data from anyone under 16. If we become aware that we have collected data from a user under 16, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at the email above.

3. Data We Collect

3.1 Data you provide directly

Data	Purpose	Legal basis (GDPR)
Email address	Account identification, login, password reset	Contract (Art. 6(1)(b))
Display name	Identify you to other users	Contract
Profile photo (optional)	Identify you to other users	Consent (Art. 6(1)(a))
Password (hashed)	Authentication	Contract
Date of birth	Verify minimum age (16+)	Legal obligation (Art. 6(1)(c))
Message content (text, images, audio)	Deliver geo-anchored messages to other users	Contract

3.2 Data collected automatically

Data	Purpose	Legal basis
Precise location (GPS)	Unlock messages within their physical radius; show nearby messages	Consent (Art. 6(1)(a)) — you may revoke at any time in device settings
Push notification token	Send notifications about nearby messages, follow requests, interactions	Consent
Authentication session token (JWT)	Keep you logged in securely	Contract

3.3 Social graph data

When you follow another user or accept a follow request, we store the relationship between accounts. This data is used solely to determine who can send you private geo-anchored messages.

4. How We Use Your Data

To provide the core service (create, deliver, and unlock geo-anchored messages)
To authenticate you and keep your session secure
To send you push notifications about messages, follow requests, and interactions
To enforce community safety (block, report, content takedown)
To comply with legal obligations

5. Data Sharing

We do not sell your personal data.

We do not share your data with third parties for advertising or analytics purposes.

We use the following infrastructure providers strictly to operate the service:

Fly.io (Amsterdam region) — application hosting
PostgreSQL (managed database) — data storage
Google Firebase Cloud Messaging (FCM) — push notification delivery to Android devices
Expo Push Notifications — push notification routing
Google Sign-In — optional federated authentication (only if you choose to sign in with Google)

These providers process data only on our behalf, under contractual data-processing agreements, and only to the extent necessary to deliver the service.

6. Data Retention

Account data: retained while your account is active. Deleted within 30 days of account deletion request.
Message content: retained until you delete the message or your account.
Location data: not stored historically — only evaluated in real-time to determine message unlock eligibility. Coordinates of messages you create are stored as part of the message itself.
Logs: server logs retained for up to 30 days for security and troubleshooting.

7. Your Rights (GDPR / LGPD)

You have the right to:

Access the personal data we hold about you
Rectify inaccurate data
Erase your data ("right to be forgotten")
Restrict or object to certain processing activities
Port your data to another service in a structured, machine-readable format
Withdraw consent at any time (for processing based on consent)
Lodge a complaint with your data protection authority (in Brazil: ANPD; in the EU: your national DPA)

To exercise any of these rights, contact us at silvaassiseduardo88@gmail.com. We will respond within 30 days.

8. Security

We protect your data using industry-standard measures:

Passwords are stored as bcrypt hashes (never in plaintext)
All network traffic uses TLS 1.2+ encryption
Authentication tokens are stored on your device using OS-level secure storage (iOS Keychain / Android Keystore)
Database access is restricted to least-privilege application users
Backups are encrypted at rest

9. International Data Transfers

Our infrastructure is hosted in the European Union (Amsterdam, Netherlands). If you access Trovio from outside the EU, your data is transferred to and processed in the EU. We rely on the EU's adequacy decisions and Standard Contractual Clauses where applicable.

10. Children's Privacy

Trovio is not directed to children under 16. We do not knowingly collect data from children. See Section 2 for details.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent change. For material changes, we will notify you in the App or by email before the changes take effect.

12. Contact Us

For privacy questions, data subject requests, or any other concern related to your personal data:

Email: silvaassiseduardo88@gmail.com
Data Controller: Eduardo Assis da Silva (individual)
Country: Brazil