Trove app privacy policy

Trove is a local music player. Your music library stays on your device. Trove has no accounts, analytics, advertising, or tracking. Online connections, including feedback you choose to submit, are described below.

What we collect

Trove does not automatically collect your library or listening activity. If you submit feedback, we receive the message, an optional reply address, app, platform and system version details, and diagnostics only if you choose to attach them.

Where your data lives

Entirely on your own device:

• Music files stay wherever you keep them (local folders, iCloud Drive, and so on). Trove only reads them in order to play them.
• Library data (tracks, playlists, favorites, ratings, play counts, lyrics) is stored in the app's private database on your device.
• Passwords for network sources (WebDAV / SMB) are stored in the system Keychain, encrypted by iOS and macOS, and used only to reach the servers you specify.

Listening history stays on your device. It can be viewed by date and cleared in the app.

Deleting the app deletes all of the above.

Network connections

Trove connects to the network only when you use a feature that needs it. These connect only to addresses you supply:

• WebDAV / SMB — connects to the server address you enter, to browse and download your own music.
• Wi-Fi Transfer — temporarily runs a local web server on your device so a computer on the same network can upload files from its browser. It runs only while that screen is open and stops when you leave it. Nothing passes through an external server.
• Apple Watch transfer — sends songs to your own watch over Apple's device-to-device connection, not over the internet.

Trove never uploads your audio files to us. Its other connections are the lookups, optional AI features, user-submitted feedback, and Apple's services described below.

Lyrics, artwork and song info lookups

To find lyrics, album artwork, or correct song details, Trove queries public music databases directly from your device:

• LRCLIB (lrclib.net) — lyrics. Sends the song's title, artist, album, and duration.
• MusicBrainz (musicbrainz.org) — artwork search and Fix Song Info. Sends the song or album title and the artist.
• Cover Art Archive (coverartarchive.org) — downloads the artwork for a match MusicBrainz found, sending only that release's database ID. The images themselves are served by the Internet Archive (archive.org).

These lookups run when you search yourself or use Fix Song Info. Automatic lookup — fetching missing lyrics or artwork as songs play — is off by default and runs only if you turn it on.

• Requests identify the app (its name, version, and a link to its project), as these services ask. They carry no account, device identifier, or anything else about you.
• Like any internet request, they reveal your IP address to the service.
• We do not operate these services and receive nothing. Each handles requests under its own privacy policy.

AI features

Text features — AI Playlist, AI Tag Cleanup, and the AI suggestion in Fix Song Info — prefer the on-device model built into recent versions of iOS and macOS. That path runs entirely offline and sends nothing anywhere.

If the on-device model isn't available, these features stay off unless you turn on a third-party AI service in AI Settings and enter your own API key. Only then, and only when you actively use one of those features, Trove sends text metadata about your tracks (titles, artists, albums, and similar fields; for Fix Song Info, also the file name — at most a couple of hundred entries at a time) to the endpoint you configured.

Cover generation, for albums with no artwork, uses Image Playground on devices that support it, which runs on your device. Elsewhere it works only if you set up a cloud image service in AI Settings with its own API key. Then, each time you ask for a cover, Trove sends a short description built from the album's title, artist, and genre to that endpoint. Generated images are saved to your library only.

• Your audio files are never sent anywhere.
• The destination is the endpoint you enter. We do not operate it, and we receive nothing.
• Your API keys are stored in the system Keychain.
• All of this is off by default, no key is preconfigured, and nothing is sent unless you ask.

Whatever endpoint you choose handles that data under its own privacy policy, not ours.

Purchases

Trove's core features are free. Pro is a one-time purchase, never a subscription, and it is handled entirely by Apple's In-App Purchase system. Apple processes the payment and tells the app whether your purchase is active — we never see or store your payment details, your Apple Account, or your name. Restoring a purchase on another device goes through Apple in the same way. From Apple we receive only aggregate, anonymous sales reports.

Diagnostics

Trove contains no crash-reporting or analytics SDK. If you have enabled Share With App Developers in your system settings, Apple may pass us crash logs and aggregate usage statistics through App Store Connect. That is an Apple system-level feature, entirely under your control in Settings → Privacy & Security → Analytics & Improvements, and what reaches us does not identify you.

In Trove 1.6, Privacy & Diagnostics offers troubleshooting recording that is off by default. When enabled, its structured events stay on this device in a fixed-size store: new events replace the oldest, with no expiry by date. Turning recording off keeps existing records. The records exclude passwords, server addresses, file paths and music titles.

You can explicitly create a diagnostic package, then choose to save, share or attach it to Feedback. Creating a package sends nothing, and the troubleshooting-package attachment is off by default. These local records are not uploaded automatically. Clearing Diagnostic Data removes Trove-managed records, packages, the separate playback log and temporary playback attachments, but cannot remove copies you have already saved or shared outside the app. Recording keeps its chosen setting after clearing.

The separate playback log continues independently of the new troubleshooting switch. It may contain titles, paths, server addresses and error details; troubleshooting packages do not include it. The playback log and package have separate attachment choices in Feedback. The playback log is selected by default; turn off Attach playback log before sending if you do not want to include it.

Feedback

In Trove 1.5 and later, Feedback submits your message over HTTPS when you press Send. A reply email address is optional. In 1.6 you can turn off the selected-by-default playback-log attachment and choose any user-created troubleshooting package separately. Earlier versions open a mail draft instead.

The separate playback log is a plain-text record of playback and network events. It can include track titles, file paths, source addresses and error details. If you do not want to share this information, turn off Attach playback log before submitting. Audio files, your full library database, and saved passwords are not attached.

Cloudflare processes the HTTPS request and forwards the report to our support inbox. It receives your IP address to deliver and protect the service. We do not store reports in a separate application database or use them for advertising or analytics. We use the report and optional address only to investigate and respond, and keep them in our support inbox while needed for that purpose. You can request access or deletion by emailing us. Diagnostics are never uploaded automatically.

Permissions

• Local Network — required for Wi-Fi Transfer and SMB to reach your computer or NAS.
• Camera / Microphone — Trove does not use either. These descriptions appear only because the bundled audio decoding library (FFmpeg) references the system capture APIs at the code level, and Apple requires a purpose string whenever a binary references them. Trove never requests these permissions and you will never see a prompt for them.

Children's privacy

Trove does not knowingly collect personal information from children. If a submitted report contains a child's personal information, contact us to request its deletion.

Changes

If this policy changes materially, we will update the date at the top of this page and describe the relevant behavior here.

Contact

Questions? Email [email protected].

This page covers the Trove app. For this website and its free browser tools, see the website privacy policy.