Privacy Policy

Effective: May 19, 2026

TroyStack is a precious metals portfolio tracking service operated by Mancini Tech Solutions LLC. We track what you tell us about your holdings, we use AI to help you understand markets and process receipts, and we use third-party services to deliver that experience. This document tells you what data we collect, who we share it with, and what your rights are. We've tried to write it in plain English.

1. Information we collect

Account information

Email address (required for account creation)
Hashed password (managed by Supabase Auth, never visible to us)
Display name (optional)
Subscription tier and purchase history (managed by Apple In-App Purchase, RevenueCat, and Stripe)

Portfolio data

Precious metals holdings you record (metal type, weight, cost basis, purchase date)
Receipt images you upload for scanning
Notes and tags you add to holdings

Chat and voice data (when you use Troy, our AI assistant)

Chat messages you send to Troy
Voice recordings when you use voice input
Voice playback requests when you use voice output

Device and technical data

Device push notification token (only for alerts you've subscribed to)
IP address (logged briefly by hosting infrastructure for standard operational purposes; not retained or used to identify you)
App version and operating system version

2. How we use the information

Provide the core service: track your portfolio, calculate value against live spot prices, generate intelligence summaries, send alerts you've opted into
Operate the Troy AI assistant: route your messages through third-party AI providers to generate responses
Process subscription payments through Apple, Stripe, and RevenueCat
Improve the product through aggregated, non-identifying usage patterns
Communicate with you about your account or the service

Receipt images you upload are processed in memory and are not written to our servers' disk storage. They are forwarded to Google Gemini for OCR processing and are not retained by us afterward.

3. Third-party services we use

TroyStack uses the following third-party services to operate. Each service has its own privacy policy governing how they handle data they receive. We do not control those policies.

Vendor	What they receive	Purpose	Reference
Supabase	Account credentials, portfolio data, chat history, push tokens	Primary data storage and authentication	Retained for the life of your account per Supabase's privacy policy
Apple	Apple ID for Sign in with Apple, subscription status, in-app purchases	Account authentication and payment processing	Per Apple's privacy policy
Google (Sign in with Google)	Google account identifier and email	Optional alternative authentication	Per Google's privacy policy
RevenueCat	Subscription tier, anonymous user identifier	Subscription management for iOS	Per RevenueCat's privacy policy
Stripe	Payment information for web subscriptions	Payment processing; Stripe is PCI-compliant and we never see card numbers	Per Stripe's privacy policy
Anthropic (Claude `claude-sonnet-4-6`)	Stack Signal editorial long-form inputs (public news article content), not your portfolio or chat data	Editorial synthesis for Stack Signal articles	Per Anthropic's privacy policy and API data-usage terms (Anthropic states API submissions are not used for training by default)
Google (Gemini `gemini-2.5-flash`)	Troy chat messages, portfolio contents when used as context, daily brief generation (initial and regenerate), portfolio intelligence summaries, Stack Signal article scoring, receipt images for OCR	Most user-data-touching AI work	Per Google's API terms and privacy policy
OpenAI (Whisper)	Voice recordings when you use voice input	Speech-to-text transcription	Per OpenAI's privacy policy and API data-usage terms (OpenAI's default API retention is 30 days at the time of this writing)
ElevenLabs	Text content of Troy's responses when voice output is enabled and ElevenLabs is the active voice provider	Text-to-speech synthesis	Per ElevenLabs' privacy policy
xAI (Grok)	Text content of Troy's responses when voice output is enabled and xAI is the active voice provider	Text-to-speech synthesis	Per xAI's privacy policy
Expo Push Service	Push notification routing	Transient delivery only, not retained for analysis	Per Expo's privacy policy
Railway, Vercel	Application hosting infrastructure	Hosting and request handling	Per their respective privacy policies
Vercel Analytics	Anonymous page view statistics on our marketing pages (not in the app itself)	Understand site traffic	Per Vercel's privacy policy

4. What we don't do

We do not sell your personal information to third parties.
We do not show advertising in the app.
We do not provide your portfolio data or chat content to any AI provider for the purpose of training their models. Anthropic, Google, OpenAI, ElevenLabs, and xAI each have their own published terms on training data usage. As of this writing, none of our AI providers' API terms permit training on API-submitted data by default.
We do not share your portfolio holdings with any party not listed in Section 3.
We do not access your portfolio data for marketing or sales targeting. Production data access is logged and limited to debugging and support purposes.

5. Your rights

Access your data: export available in app settings.
Delete your account: available in app settings; deletion is immediate and removes your data from our primary systems within 30 days. Some third-party providers may retain data according to their own policies (listed in Section 3).
Update your information: editable in app settings.
Contact us: support@troystack.com

6. Children's privacy

TroyStack is not directed at children under 13 and we do not knowingly collect data from children under 13.

7. International users

We are based in the United States. By using TroyStack you consent to processing in the United States.

8. Changes to this policy

We will update the effective date when we make material changes. Significant changes will be communicated in the app.

9. Contact

Mancini Tech Solutions LLC
Connecticut, United States
support@troystack.com