Everything TRVUE stores about you

This notice covers the TRVUE website and the TRVUE API. It describes what the platform stores about account holders, campaign supporters, company members and API consumers.

It does not cover what a company does with information you give it directly, and it does not cover a public blockchain, which nobody operates and nobody can edit.

Each row is a table in TRVUE's database. Column names are given verbatim, because these are the fields a request for a copy of your data would be answered from.

Trust Scores are not in this list because they are never stored. They are recomputed from evidence records every time they are shown, which is what makes them impossible to edit by hand.

Campaign content, comments and updates you publish are stored as you wrote them and are visible to anyone who can see the campaign.

TRVUE never sees your card. Payment happens on Stripe's own checkout page; card numbers, expiry dates and security codes are entered there and never reach TRVUE's servers or database.

TRVUE sends Stripe only what is needed to create the charge: pledgeId, launchSlug, amount, product name. This code sends Stripe neither your name nor your email address — Stripe collects what it needs on its own page, under its own privacy terms.

What comes back is a payment reference and a checkout session id, stored on the contribution so that a refund can be issued against exactly that payment.

If you give a payout address it is stored on your account and, once a campaign's allocation is frozen, written into a published snapshot alongside the token amount you are owed.

Token allocations match on the address, not on your account. That is what lets you claim from a wallet TRVUE knows nothing else about — and it is also why the address, once published, is the thing that identifies the allocation.

These are the only third parties the code sends data to. Nothing is listed here aspirationally.

There is no advertising network, no data broker, and no third party that receives your data for its own purposes. TRVUE does not sell personal data.

These are the timeouts the code enforces, not policy aspirations:

• 7da signed-in session, from creation
• 24han email verification link
• 1ha password reset link
• 5ma two-step sign-in challenge, held only in memory
• 15mthe sign-in rate-limit window, in memory and lost on restart
• 60san API rate-limit counter, which expires on its own

Everything else — your account, your contributions, your company memberships — is kept until you or the operator removes it. You can delete your own account at any time, and the erasure section says exactly what that reaches. The code implements no automatic deletion of an inactive account.

There is no defined retention period for what a deleted account leaves behind — its contributions, its payout entries, and any allocation already published — and no scheduled purge of anything. This page states that gap rather than papering over it.

TRVUE sets four cookies. All four are strictly functional, none of them follows you across sites, and there is no advertising or analytics cookie to consent to.

The Secure flag is set in production. Every cookie is SameSite=Lax and scoped to the whole site.

Because none of these is used for advertising, measurement or profiling, no consent banner is shown. Whether that analysis holds in every jurisdiction is a question for counsel.

Stated as absences, because an absence is what a reader cannot verify for themselves:

• No analytics product, tag manager, session recorder or advertising pixel — the site loads no third-party script at all.
• No IP address or user agent is written to a log, a database or a metrics label.
• No tracking cookie, no fingerprinting, no cross-site identifier.
• No profiling and no automated decision-making about you.
• No sale or sharing of personal data, and no enrichment from outside sources.

IP addresses are read for one purpose only: bucketing sign-in attempts and API requests for rate limiting. Those buckets hold a number, not a request, and expire within a minute for API traffic and fifteen minutes for sign-in traffic. Campaign view and share counts are aggregate integers with nothing about the viewer attached.

Passwords are hashed with scrypt N=16384 r=8 p=1 and a random per-account salt, then compared in constant time. Session cookies are stored as hashes, so a database read alone cannot produce a usable session, and API keys are stored the same way.

The database connection verifies TLS. The site sends a content security policy that forbids third-party connections, strict transport security, and a referrer policy that withholds paths from other origins. Camera, microphone and location are switched off at the browser level.

You can change your display name, add or remove an authenticator app or a passkey, set or clear a payout address, and change notification settings from your account at any time.

Depending on where you live you may have rights to access, correct, delete, restrict, port or object to the processing of your data. Deletion is self-service, and the next section sets out precisely what it removes and what it cannot. The rest are still handled by hand, because no export or correction flow exists yet.

The only published contact is sales@trvue.com. A dedicated privacy contact has not been established, and establishing one is a precondition for answering rights requests on any defined timescale.

A signed-in account holder can delete their own account. It is a real deletion of the data TRVUE controls: the account row, its credentials, its passkeys, its authenticator secret, its one-time link digests, its payout address, its notification settings, its follows and its company memberships all go, in one transaction.

The flow, with the figures for your own account, is at Delete your account.

Contributions are kept. A contribution record carries the Stripe reference a refund is issued against, and it is the evidence that a refund is owed at all — deleting it would break settlement for a campaign that has not resolved, and in most jurisdictions it would destroy a record of a transaction that has to be retained. Payout records are kept for the same reason.

Deletion is refused, rather than improvised, while an account is the only member of a company. Removing the last member would leave that company's campaigns, payout account and review correspondence with nobody able to act on them, and there is no ownership-transfer flow to offer instead. The refusal names the company.

The other rights are not self-service. Access, portability, correction, restriction and objection are still handled by hand, and there is no defined retention period for what deletion leaves behind — see the section below.

This notice is not complete as a legal document. These are the gaps:

• The identity and establishment of the controller, and any required representative or data protection officer.
• A lawful basis for each purpose above, and how consent, contract and legitimate interests are allocated between them.
• A transfer mechanism for holding UK and EU data in the United States, with the processor agreements behind it.
• Retention periods for the records a deleted account leaves behind, and a purge that enforces them.
• Whether unlinking an address from an account satisfies a right to erasure, where the allocation itself sits on a public blockchain and cannot be removed by anyone.

The campaign mechanics this notice refers to are described under Terms, and what a contribution costs under Fees.