Privacy statement

Controller

Data Trove processes

• Account data: your name, email address, password hash, email-verification status, active sessions and, if you save one, your preferred interface language.
• Catalogue data you provide: find titles, dates, notes, categories, materials, photos, photo metadata and exact or manually entered location information.
• Sharing settings: the individual find you choose to share, the location detail you choose to reveal, the catalogue details you tick for the link and the state of each revocable sharing link.
• Technical data needed to deliver and protect the service, including IP address, request time, requested path, browser or user-agent information and security metadata. The public-share rate limiter stores a process-local salted HMAC pseudonym derived from the client address, rather than the raw address. Counters reset after one minute; identifiers remain until eviction or application restart.
• Language selection: on each page request your browser's Accept-Language header is evaluated to send you to the English site (spadedeep.com) or the German site (spatentief.de). The header itself is not stored.
• Optional AI assistance: when you start an AI run, Trove stores the run status, your explicit selections, candidates, public citations, field proposals, candidate selections, decisions and application/audit history. Provider credentials, raw provider responses and local similarity fingerprints are not part of your AI history.
• Mark identification and mark clippings: when maker's or fineness marks are identified on one of your photos, Trove stores the run, the detected marks with their position on the photo, the cited public sources and your decisions. For confirmed marks it keeps a picture clipping that shows only the mark, the mark's identification and local copies of the cited reference sources.
• Personal API use: Trove stores safe personal access token metadata (name, scopes, fingerprint/last four, creation, last-use, expiry and revocation timestamps), authenticated API safety and audit state, and external proposal and citation content. Optional agent label and version metadata are sanitized before storage. Raw tokens, token digests, authorization headers, provider keys and raw agent reasoning are not included in owner-visible history.

Purposes and legal bases

Account, catalogue, email-verification, recovery and sharing data are processed to provide the service you request (Article 6(1)(b) GDPR). Security, abuse prevention, fault diagnosis and reliable operation are based on the legitimate interest in running a safe private service (Article 6(1)(f) GDPR).

When you add your own category or material in your account settings, Trove also stores it as an account-linked pending taxonomy suggestion. This lets the operator review and improve the available classifications and is based on the legitimate interest in maintaining the catalogue taxonomy (Article 6(1)(f) GDPR). You may object to this processing.

Evaluating your browser language and storing a language you choose serves to show the service in the language you want (Article 6(1)(b) GDPR and, for automatic detection, the legitimate interest in presenting an understandable service, Article 6(1)(f) GDPR).

Optional AI assistance is processed only when you deliberately request an identification or catalogue-improvement run. Its purpose is to return research candidates, public citations and reviewable field proposals; Trove does not apply a proposal until you make the required decisions and explicitly apply it. No data is sent to an AI provider without your explicit approval: each time you submit an AI tool request, you approve sending the data shown for that request, for that request only.

Mark clippings and their identifications are used locally to train and improve Trove's AI tools, in particular as comparison material for future mark identifications, and may be published separately on the site as part of a public catalogue of maker's and fineness marks with real-world pictures of stamps and their variations. This is based on the terms of use (Article 6(1)(b) GDPR) and on the legitimate interest in an accurate mark reference (Article 6(1)(f) GDPR). Clippings show only the mark, contain no metadata or location and are never published with your name, account, find or location. You may object at any time and opt out of the mark collection by contacting support at [email protected]; marks from your photos are then no longer added, and on request existing clippings are removed from the collection and from publication.

The Personal API is processed only when you create a token and an authenticated client uses it. Owner-scoped reads and cited external proposal submission provide the requested service (Article 6(1)(b) GDPR); rate limits, idempotency, quota reservations and sanitized audit events protect the service and support fault investigation (Article 6(1)(f) GDPR). API proposals cannot directly write or apply catalogue changes.

Required and optional information

Name, email address and password are required to create and secure an account. A title, exact find date and at least one photo are required to create a catalogue entry. A known location is required only when the entry is recorded as located; archival entries may mark it unknown. Without the required data, the relevant account or entry cannot be created. Notes, classifications, additional photos and a language preference are optional.

Private content and sharing

Your catalogue is private by default. Trove does not publish or share your content on your behalf. When you deliberately create a link for one find, only the details selected for that link are made available to anyone who has it. You can revoke the link at any time. Public display photos are re-encoded without GPS metadata; original uploads remain private. The only exception is the collection of mark clippings described above and in the terms of use: clippings that show only a maker's or fineness mark may be published in the public mark catalogue.

Service providers and transfers

• All browser traffic to Trove, including authenticated requests and public sharing links, passes through Cloudflare, Inc. Cloudflare processes IP addresses, request metadata, requested URLs and transmitted content for proxying, tunnel delivery and security.
• Amazon Web Services EMEA SARL provides Amazon SES in the Europe (Frankfurt) region. SES processes recipient addresses, message metadata and verification or password-recovery messages and links.
• When a map is displayed, your browser connects directly to MapTiler AG to load the map style, vector or satellite tiles, labels and related resources. MapTiler receives technical request data including your IP address, HTTP referrer, browser information and the map area represented by the requested tiles. Trove markers and private photo URLs are not sent to MapTiler as map data.
• The application, database and photo storage are self-hosted on private infrastructure in Germany. PostgreSQL is not exposed to the public internet.
• Optional external AI processing may use OpenAI or Anthropic, selected internally for each run. Trove sends only the text fields you explicitly select and metadata-stripped display images you explicitly select. It sends no location, GPS or EXIF data, participant or account identities, private links, storage identifiers, originals or other owners' raw records. All-catalogue similarity remains local and discloses only anonymous support bands and facets after privacy thresholds are met. Trove requests storage-limiting controls where the selected service supports them and does not create provider-managed files, conversations or vector stores. These controls do not by themselves guarantee that the selected service keeps no limited operational, abuse-prevention or legally required records; the applicable provider terms govern that processing. For mark identification, Trove sends the one photo you choose, re-encoded without any metadata, and may add clippings from the site's mark collection as comparison images. Nothing is sent to an AI provider without your explicit approval; submitting an AI tool request gives that approval for that request only. Clippings in the shared mark collection show only a mark and may be sent as comparison images in other users' mark identifications.

These providers receive only the data needed for their role. Cloudflare and MapTiler operate international delivery networks, and the providers may involve support or security processing outside the European Economic Area. Their applicable transfer safeguards include the EU-U.S. Data Privacy Framework where available and the European Commission's standard contractual clauses. Further information or a copy of the relevant safeguards can be requested from the controller.

Retention and deletion

• Session records expire 30 days after creation or the most recent eligible refresh. Use of the service may extend the expiry at most once per day. Sessions are bound to the domain where you signed in, so spadedeep.com and spatentief.de keep separate sessions.
• Account and catalogue data remain until you delete the relevant content or ask for the account to be removed. Expired verification and password-recovery records are eligible for routine cleanup after they can no longer be used.
• Account-linked pending taxonomy suggestions remain while the account exists or until they are reviewed or deleted. You may object and ask for their removal.
• Deleted photo files are placed in a durable deletion-retry queue and removed from active storage. Restricted backups may retain deleted data until they rotate out, currently for up to six months.
• Self-service account deletion requires the current password, an explicit confirmation and a verification link sent to the authenticated email address. During account deletion, every original and display file is queued and account-linked verification records are erased in the same database transaction. Physical file removal is retried if storage is unavailable; encrypted backups are not edited in place and may retain the deleted data until the six-month rotation completes.
• Trove does not maintain a separate analytics or marketing request log. Cloudflare edge security and Amazon SES delivery records follow each provider's documented operational, security and legal retention criteria.
• AI run history remains attached to the relevant find while that find and account exist. Deleting the find deletes its AI runs and their candidates, citations, proposals, selections, decisions and audit events; deleting the account deletes all account-linked AI history. Any limited provider-side operational or legally required retention follows the provider's applicable terms rather than Trove's database retention.
• Mark identification runs are deleted together with the find, photo or account they belong to. Mark clippings, their identifications and archived reference sources are site reference data: they remain when the find, photo or account they came from is deleted, and their link to your account is removed. A clipping is deleted on request.
• Personal access token metadata and sanitized Personal API audit events remain while the account exists, subject to token revocation and routine safety cleanup. Rate-limit buckets, idempotency records and quota reservations are transient operational state and are deleted after their applicable windows. External proposals, citations, source versions and optional sanitized agent metadata remain with the related AI history. Account deletion removes the owner's tokens, API audits, transient API state and external proposal history in the same database lifecycle; a rolled-back deletion preserves them and queues no media.

Cookies and analytics

Trove uses only session and security cookies that are strictly necessary to provide the account service you request. No consent is required for this storage under § 25(2)(2) TDDDG. The authentication cookie expires with its session, normally after no more than 30 days, subject to refresh during use. When you explicitly choose a language, Trove sets the strictly necessary trove_locale cookie on that domain for up to one year so the choice is respected on later visits; it contains only en or de. Trove also uses local storage on your device to remember your catalogue grid or map preference and your selected map layer. These preferences are not used for tracking. Trove does not use analytics, advertising or tracking cookies. Map tiles and labels are loaded from MapTiler only when a map is shown.

Your rights

Subject to the GDPR's conditions, you may request access, rectification, erasure, restriction of processing, data portability or object to processing based on legitimate interests. Contact the controller at the email address above. You may also lodge a complaint with a supervisory authority.

The account screen can download a private, explicitly versioned owner export archive containing normalized account and catalogue JSON, your owner-visible AI run history, safe personal access token metadata, sanitized Personal API audit events, and every owned original and display image. External proposal history includes provider-neutral origin, source version, public citations and optional sanitized agent label/version. Provider credentials or configuration, managed provider/model/request identity, raw tokens or token digests, idempotency keys or request hashes, transient rate-limit/idempotency/quota rows, ciphertext, cryptographic key identifiers or MACs, input or snapshot digests, usage data, raw indexes, similarity tokens/features/aggregates and other owners' data are excluded. The archive includes your language preference, session IDs, expiry and creation/update timestamps, IP addresses and user-agent information, but not session tokens. Password hashes, verification values, OAuth credentials, sharing-token hashes and internal storage paths are also excluded.

The supervisory authority responsible for private organisations in Bavaria is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Questions or deletion requests

Email [email protected] for privacy questions, a copy of your data or removal of your account.