Trovii Privacy Policy

1. Overview

Trovii ("the App") is developed and published by Kynoss Studios ("we," "us," or "our"). Trovii is a privacy-first kids' artwork archive for iPhone (iOS 26 and later). Parents capture photos of their kids' drawings, paintings, and crafts; Trovii's on-device Vision framework auto-crops the artwork from the surrounding surface; the artwork is organized by sibling group and capture date; and at year-end you can export a multi-kid PDF photobook. Two optional sharing surfaces let you invite a co-parent to the full archive (both phones see every capture and either parent can add new artwork) or send a monthly 5-card digest to grandparents — both through Apple's secure CloudKit family-sharing.

This Privacy Policy explains exactly what data Trovii accesses, where that data is stored, and what Kynoss Studios can or cannot see. The default architecture is on-device — your kids' artwork lives on your iPhone in a Core Data store backed by Apple's NSPersistentCloudKitContainer. The store has three slots: a local-only slot (per-device metadata that never syncs), a private CloudKit slot (default state — your archive synced only to your own iCloud, no one else can see it), and a shared CloudKit slot (populated only when you accept a co-parent's invitation OR initiate one yourself). Data only leaves your device when you actively opt in to one of the two sharing surfaces, and even then it travels through Apple's CloudKit infrastructure — never to a Kynoss server.

Kynoss Studios is a sole-developer studio. We do not run servers, databases, analytics pipelines, or marketing infrastructure. The CKShare-resident data Trovii creates — only when you opt in to sharing — lives in your iCloud account and is shared with the family iCloud accounts you designate. Apple operates that infrastructure on our behalf, and we never receive or store identifiable copies of it.

2. What Trovii Stores & Where

Trovii's data model spans three locations: your device (private to you, the default for everything), Apple's CloudKit (only when you opt in to co-parent sharing or family-digest sharing), and Apple's StoreKit (purchase records). The table below is a complete inventory.

What's stored on your device (Core Data, encrypted at rest)

What's stored in Apple's CloudKit — only if you opt in to co-parent sharing or family-digest sharing

Trovii uses two separate NSPersistentCloudKitContainer stacks, each tied to your iCloud account, each populated only when you opt in:

• Co-parent archive container (read-write across two parents): if you accept or send a co-parent invitation, your full archive (sibling group structure, kid metadata, every captured artwork) lives in this stack's CKShare with the specific second parent's iCloud account you designate. Either parent can add new artwork from their phone; both see captures from both phones.
• Family-digest container (read-only family fanout): if you send a monthly digest, a separate SharedDigest record (just the 5 highlight artworks for that month) lives in this stack's CKShare with the grandparent / family iCloud accounts you designate.

The two containers are independent — opting into one does not enable the other. See Section 4 (CKShare) for the complete disclosure. If you never enable either sharing surface, Trovii writes nothing to CloudKit and the app is completely on-device.

What's stored with Apple StoreKit (Trovii Pro)

Apple processes Trovii's in-app purchase tiers (monthly subscription, yearly subscription, or one-time lifetime). Kynoss Studios does not receive payment information. Your purchase status is verified locally on your device using Apple's on-device Transaction.currentEntitlements API.

What's NOT stored anywhere

• No analytics events leave your device. Trovii uses Apple's OSLog and MetricKit signposts internally for paywall and feature instrumentation; those signposts stay on-device unless you have separately opted into Apple's system-wide diagnostics sharing in iOS Settings, in which case Apple receives them — never Kynoss.
• No advertising identifier (IDFA) is read.
• No third-party SDKs are bundled — Trovii uses only Apple's first-party frameworks.
• No keystrokes, no clipboard reads, no contacts access, no location, no microphone access, no photo library access beyond what you explicitly pick.

3. Camera & Photo Access

Trovii needs the iOS Camera permission to capture artwork photos. This is the standard NSCameraUsageDescription permission — iOS prompts you at first capture. Captured photos are written directly to Trovii's sandboxed SwiftData store; they are not added to your system Photos library unless you explicitly choose "Save to Photos" from the artwork detail menu.

If you prefer not to grant the Camera permission, you can import existing photos from your Photo Library. Trovii uses PHPickerViewController for this, which Apple sandboxes — Trovii receives only the specific photos you pick, not access to the rest of your library.

4. CKShare (Co-Parent Sharing + Grandparent Digest)

Trovii offers two distinct CKShare-based sharing surfaces. Both are opt-in. Both use Apple's CKShare framework, which is Apple-managed infrastructure scoped to the participants you designate. Neither is enabled by default; you can use either, both, or neither.

4a. Co-parent archive sharing (added in v1.1.0)

From Settings → "Share with another parent," you can invite a second parent to your family archive. Trovii calls Apple's NSPersistentCloudKitContainer.share() on your ArchiveSiblingGroup and presents a standard iOS share-sheet so you can send the invitation URL via Mail, iMessage, AirDrop, or any system-supported channel.

What's shared with the co-parent:

• Your full sibling group structure and per-kid metadata (display names, kid colors, capture dates)
• Every captured artwork (original + auto-cropped versions), favorite flags, capture dates
• Any monthly digests you've created (history list)
• Any photobooks you've generated

The share is read-write — the co-parent's phone can add new artwork too, and new captures from either phone sync to both. Saved-recipient lists (the local Mail-handoff list for grandparent-digest sharing) are not shared with the co-parent — those stay on the originating device.

You can revoke the co-parent share at any time from Settings → "Share with another parent" → "Stop sharing with the other parent." Revoking deletes the CKShare record (the second parent loses access immediately) but does not delete your own archive — only the link is revoked.

4b. Grandparent digest sharing (since v1.0)

Each month (or on-demand), Trovii prepares a SharedDigest record containing five highlight artworks — these are the artworks you've favorited, or the most recent if no favorites are set. The SharedDigest contains:

• Five processed artwork images (the cropped versions Trovii produced via Vision auto-crop)
• The capture month and year
• Per-artwork metadata: kid display name (only the first name you entered locally), capture date, optional caption

The original (unprocessed) artworks, the rest of your timeline, your sibling group structure, and any non-highlight artworks are not shared via this surface. Only the five-card digest is.

Who can see either share

• Only the iCloud accounts you designate as CKShare participants. You initiate sharing from Settings → "Share with another parent" (co-parent) or Settings → "Share with Family" (digest); Trovii calls Apple's NSPersistentCloudKitContainer.share() and presents a standard iOS share-sheet so you can send the share URL via Mail, iMessage, AirDrop, or any system-supported channel.
• Recipients must accept the share via Apple's standard "Accept Shared Content" prompt; until they accept, they cannot see anything.
• You can revoke either share at any time from the corresponding in-app sharing settings.

Who CANNOT see either share

• Kynoss Studios cannot see CKShare records. Apple's CKShare access model restricts visibility to the participants themselves. Kynoss has no dashboard view, no API access, and no operational ability to read shared records.
• Other users of Trovii cannot see your archive or digest. CKShare is scoped per-share — there is no public CloudKit container, no global feed, no cross-user surfacing.
• Apple cannot read CKShare content under normal operation. Apple operates the CKShare infrastructure but the content is encrypted under your iCloud account; Apple's standard iCloud privacy posture applies.

Both surfaces are optional

You can use Trovii's full local feature set — capture, auto-crop, sibling timeline, year-end PDF photobook export — without ever setting up co-parent sharing or a family digest. Both surfaces are opt-in.

5. Push Notifications (APNs)

Trovii sends push notifications via Apple Push Notification service (APNs) for two purposes:

• Monthly digest reminder: if you've set up family digest sharing, a single push at your chosen send-day reminds you that this month's digest is ready to review and send.
• New shared digest received (recipient-side): family members who have accepted a CKShare invitation receive a push when you send a new digest. This uses Apple's standard CloudKit subscription mechanism — Trovii doesn't operate the push-delivery server; Apple does.

Push notifications are entirely opt-in via the standard iOS prompt at first launch. Apple operates APNs; Kynoss does not receive notification-delivery telemetry beyond Apple's standard error response (e.g., "device token invalid"). No notification content is logged.

6. In-App Purchases (StoreKit 2)

Trovii Pro is sold three ways:

• Monthly subscription (trovii_pro_monthly) with a 3-day free trial
• Yearly subscription (trovii_pro_yearly) with a 3-day free trial — paywall default
• Lifetime non-consumable (trovii_lifetime) — one-time purchase, no trial

All three unlock the same Pro feature set — unlimited captures, sibling timelines, monthly family digest sharing, and year-end photobook PDF export. There is no tier asymmetry.

All transaction processing is handled by Apple. Kynoss Studios does not receive, store, or have access to payment information. Purchase status is verified locally using Apple's on-device Transaction.currentEntitlements API. Subscription management (cancellation, refunds) is handled through Apple's standard Subscription Settings in the App Store.

7. Data Retention & Deletion

Retention Policy

• Local data on your device (artwork photos, sibling groups, app preferences) is retained until you delete the app or remove the data via in-app controls.
• CKShare digest records persist as long as the share is active. Removing a digest from your in-app history removes it from all participants' views.
• StoreKit purchase records are retained by Apple per Apple's data retention policies.

Deletion

• Delete an artwork: in-app long-press or the artwork detail menu. The photo and metadata are removed locally. If the artwork was part of an already-sent CKShare digest, that digest record retains the included photo unless you also remove the digest.
• Delete a digest: Settings → "Share with Family" → digest history. Removing a digest removes the share record from your account and all participants' views.
• Stop sharing with a co-parent: Settings → "Share with another parent" → "Stop sharing with the other parent." The co-parent loses access immediately; your own archive is preserved.
• Stop sharing with a family member (digest): Settings → "Share with Family" → Participants → remove. The participant loses access immediately.
• Delete the app: removes all local data on your device (artwork photos, sibling groups, preferences). CKShare records remain in your iCloud account until you separately remove them or sign out of iCloud.
• Sign out of iCloud: disconnects your CKShare records. You can re-sign-in later and CKShare records are restored to the same participants if Apple's iCloud sync resumes.
• Apple's Privacy & Data settings: Apple provides system-level data export and deletion for iCloud data via iOS Settings → [your name] → iCloud → Apps Using iCloud.

8. Data Sharing & Third Parties

• We do not sell your data.
• We do not share your data with marketing, advertising, or analytics third parties.
• We do not bundle third-party SDKs, frameworks, or libraries that could collect data. (Trovii uses only Apple's first-party frameworks: SwiftUI, SwiftData, Vision, Core Image, PDFKit, AVFoundation, StoreKit 2, CloudKit, CKShare, OSLog, MetricKit.)
• We do not bundle third-party analytics SDKs (no RevenueCat, no Adapty, no Superwall, no Mixpanel, no Amplitude, no Firebase). Apple-native paywall instrumentation via OSLog + MetricKit stays on-device unless you have opted into Apple's system-wide diagnostics sharing.
• We do not serve advertisements.
• We do not engage in cross-app tracking, fingerprinting, or user profiling.
• We have no parent companies, subsidiaries, or related entities (Kynoss Studios is an independent sole developer).

9. Data Security

Trovii relies on Apple's built-in security infrastructure to protect your data:

• Encryption at rest: Local artwork data is protected by iOS Data Protection (encryption tied to your device passcode). CKShare data is encrypted under your iCloud account.
• Encryption in transit: All CloudKit, CKShare, and APNs traffic uses Apple's TLS-encrypted transport.
• App sandboxing: iOS prevents other apps from accessing Trovii's local data store.
• CKShare access controls: CKShare records are only readable by participants you explicitly designate — Apple enforces this access model.
• No Kynoss-operated infrastructure: Because Kynoss does not operate servers, databases, or backend services, there are no Kynoss credentials to breach and no Kynoss systems to compromise.

10. Children's Privacy (COPPA)

Trovii is rated 4+ and is suitable for all ages. Trovii is operated by parents, on behalf of their kids — children are not direct users of the app. The COPPA-relevant analysis follows.

Trovii's user is the parent

Trovii has no kid-facing sign-in surface, no kid-targeted ads, no kid-targeted content, and no in-app messaging or social features. The app is operated entirely by an adult parent or guardian, who chooses to capture photos of their kids' artwork and may choose to share them via CKShare with family members.

What kid data Trovii touches

• Kid display names: a first name or nickname the parent enters during onboarding (e.g., "Maya," "Buddy"). Stored on-device by default. Included in shared digests only when a digest is sent.
• Kid artwork photos: photos taken by the parent of artwork the kids have made. Stored on-device by default. Included in shared digests only when a digest is sent.

What kid data Trovii does NOT collect

• No kid email addresses, postal addresses, phone numbers, real names beyond the parent-entered display name, birthdates, schools, classmates, friends, or any other personal information.
• No kid-facing ads.
• No kid-targeted in-app content or messaging.
• No kid contact information shared with third parties.

Parent control

Parents have complete control over their kids' artwork data in Trovii. The parent can:

• Edit or delete a kid's display name at any time
• Delete individual artworks
• Stop sharing or remove participants from a CKShare digest
• Delete the app to remove all local kid data

If you are a parent or guardian and have questions about Trovii's handling of your kids' artwork data, please contact us at kynossstudios@gmail.com.

11. Your Rights Under GDPR (European Economic Area)

If you are located in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) provides specific rights regarding your personal data. Trovii's architecture means most data subject to GDPR is held on your device or under your iCloud account by Apple — not by Kynoss Studios.

Legal Basis for Processing

• Legitimate interest: Processing on-device artwork photos to deliver the app's core functionality.
• Consent: Camera access, photo library access, CKShare family digest enrollment, and push notifications are all opt-in. You may decline any of them and continue using on-device features.

Your Rights

• Right of access: Your local data is accessible to you in the app; your iCloud data is accessible via Apple's Privacy & Data settings.
• Right to erasure: See Section 7 (Data Retention & Deletion) for the deletion paths.
• Right to restrict processing: Decline Camera access and CKShare to keep all processing on-device.
• Right to data portability: Photos can be exported via the share sheet to any iOS-supported destination (Mail, AirDrop, system Photos library, etc.).
• Right to object: Stop using Trovii and request deletion via the contact below.

Data Transfers

Apple operates CloudKit and CKShare globally; Apple is GDPR-compliant. Kynoss Studios does not directly transfer personal data outside your device or your iCloud account.

Data Protection Officer

Due to the small scale of Kynoss Studios (sole-developer, no PII collection), we are not required to appoint a Data Protection Officer. For privacy inquiries, contact kynossstudios@gmail.com.

12. Your Rights Under CCPA/CPRA (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights.

Information We Collect

Under CCPA/CPRA definitions, Trovii processes the following categories of information:

• Photos of artwork (User Content) and parent-entered kid display names, stored on-device by default and shared via CKShare only with the participants you explicitly designate.
• No name, email, postal address, phone number, IP address, or other directly identifying information about the parent is collected by Kynoss Studios. Apple manages StoreKit purchase identifiers; Kynoss does not receive them.

Your Rights

• Right to know: This Privacy Policy describes all data Trovii processes.
• Right to delete: See Section 7.
• Right to opt out of sale: We do not sell personal information. We never have and never will.
• Right to opt out of sharing: We do not share personal information with third parties for cross-context behavioral advertising or any other purpose.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

"Do Not Sell or Share My Personal Information"

Trovii does not sell or share personal information. There is no sale or sharing to opt out of.

13. Apple Platform Disclosures

In compliance with Apple's App Store Review Guidelines and platform requirements:

Camera + Photos

• Trovii requests Camera access (NSCameraUsageDescription) for capturing artwork photos.
• Trovii uses PHPickerViewController for importing existing photos — Apple sandboxes this so Trovii receives only the specific photos you pick.

Vision (on-device document segmentation)

• Trovii uses Apple's Vision framework (VNDetectDocumentSegmentationRequest) to detect artwork paper edges in captured photos. This runs entirely on-device — no photo data is transmitted to Apple or to any third party for this processing.

CloudKit + CKShare

• Trovii uses CloudKit for the optional family digest feature only. If you do not enable digest sharing, Trovii does not write anything to CloudKit.
• CKShare records are scoped to participants you designate; Kynoss has no access.
• CloudKit is operated by Apple; Apple's Privacy Policy and CloudKit security model apply.

StoreKit 2 (In-App Purchases)

• Trovii uses StoreKit 2 to offer monthly + yearly subscriptions and a one-time lifetime non-consumable.
• All transaction processing is handled by Apple. Kynoss Studios does not receive, store, or have access to payment information.
• Purchase status is verified locally using Apple's on-device Transaction.currentEntitlements API.

Push Notifications (APNs)

• Trovii uses Apple Push Notification service for digest reminders and (recipient-side) new-digest-received notifications.
• Push notifications are opt-in; you can disable them at any time in iOS Settings.

Required Reason APIs

Trovii uses only Apple's first-party frameworks. Any Required Reason API usage is declared in the app's privacy manifest (PrivacyInfo.xcprivacy) and reflected in the App Store privacy nutrition label.

App Tracking Transparency

Trovii does not track users across apps or websites owned by other companies. The App Tracking Transparency framework is not used because no tracking occurs.

App Privacy Nutrition Label

Trovii's App Store privacy nutrition label declares: User Content (artwork photos + parent-entered kid display names) used for app functionality only; Purchases (Apple-managed entitlement) used for app functionality only — neither linked to user identity, neither used for tracking, analytics, or advertising. Usage Data is declared "Not Collected" — Trovii's OSLog and MetricKit signposts stay on-device unless you have separately opted into Apple's system-wide diagnostics sharing.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in the app's functionality or legal requirements. When we make changes:

• The "Last Updated" date at the top of this page will be revised.
• Material changes will be communicated through the app or its App Store listing.
• Continued use of Trovii after changes constitutes acceptance of the updated policy.

We encourage you to review this policy periodically.

15. Contact Us

If you have questions about this Privacy Policy, your privacy rights, or Trovii's data practices, please contact us:

• Email: kynossstudios@gmail.com
• Developer: Kynoss Studios
• Support Page: Trovii Support

We respond to privacy inquiries within 30 days.