Trove app privacy policy

Trove is a local music player. Your music library stays on your device. You do not create a Trove account. We do not use analytics, advertising, or tracking. Online connections, including feedback you choose to submit, are described below.

What we collect

Trove does not automatically collect your library or listening activity. If you submit feedback, we receive the message, an optional reply address, app, platform and system version details, and diagnostics only if you choose to attach them.

Where your data lives

Entirely on your own device:

• Music files stay wherever you keep them (local folders, iCloud Drive, and so on). Trove only reads them in order to play them.
• Library data (tracks, playlists, favorites, ratings, play counts, lyrics) is stored in the app's private database on your device.
• Passwords for network sources (WebDAV / SMB) are stored in the system Keychain, encrypted by iOS and macOS, and used only to reach the servers you specify.

Listening history stays on your device. It can be viewed by date and cleared in the app.

Use the app's connection and cache controls to remove saved credentials and downloaded audio. Uninstalling an app does not itself revoke access granted through a third-party account, and system Keychain items or files outside the app container may remain.

Network connections

Trove connects directly to the network when you use features such as WebDAV, SMB, Google Drive or MEGA. These optional connections use the server or provider you choose.

• WebDAV / SMB — connects to the server address you enter, to browse and download your own music.
• Wi-Fi Transfer — temporarily runs a local web server on your device so a computer on the same network can upload files from its browser. It runs only while that screen is open and stops when you leave it. Nothing passes through an external server.
• Apple Watch transfer — sends songs to your own watch over Apple's device-to-device connection, not over the internet.

Trove never uploads your audio files to us. Its other connections are the lookups, optional AI features, user-submitted feedback, and Apple's services described below.

Google Drive connection

Connecting Google Drive is optional and uses your Google Account, not a Trove account. Google handles sign-in and consent in the system browser. Trove does not receive your Google password.

Trove requests only drive.file access. You explicitly select downloadable audio in the Google file picker; Trove reads the selected file names, IDs, versions, sizes and audio to keep your song list and play music. It does not browse your entire Drive or create, modify or delete Drive files.

Authorization tokens are stored in the system Keychain on this device. Your selected song list and account identifier stay on this device. Audio is buffered locally; complete songs may be cached for reuse with a default 1 GiB limit and automatic eviction. Cache data is excluded from cloud backup and may also be removed by the operating system.

Google API requests go directly from your device to Google. No Trove server receives your Drive tokens, file list or audio, and this connection does not send them to AI services. Google data is not sold, used for advertising or used to train general-purpose AI models.

Removing a song from Trove only removes it from the saved list; its Drive original remains. Clear Google Drive Cache stops Drive playback and removes cached audio while keeping the connection. Disconnect removes the local connection, selected list and cache, and attempts to revoke Google access. If online revocation fails, retry or explicitly choose local-only removal. You can also revoke access in your Google Account connections settings.

Trove's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google processes authorization and API requests under its own privacy policy and receives your IP address as part of those connections.

MEGA connection

MEGA is optional and uses your own MEGA account. The official MEGA SDK connects directly from this device to MEGA to sign in, browse folders and read audio for playback. Trove does not upload, modify or delete your MEGA files, and no Trove server receives your MEGA credentials, session or audio.

Your password and two-factor code are used for sign-in and are not saved by Trove. The resulting session is stored in this device Keychain. The SDK keeps a private local database cache excluded from backups.

Audio may be buffered and cached on this device, including the next song in the queue. Complete songs use a separate 1 GiB cache with automatic removal of older files. Clearing the cache keeps your connection. Disconnecting stops MEGA playback, clears cached audio and attempts to close the remote session. If remote logout fails, you can explicitly remove the connection locally and close the session in your MEGA account.

Lyrics, artwork and song info lookups

To find lyrics, album artwork, or correct song details, Trove queries public music databases directly from your device:

• LRCLIB (lrclib.net) — lyrics. Sends the song's title, artist, album, and duration.
• MusicBrainz (musicbrainz.org) — artwork search and Fix Song Info. Sends the song or album title and the artist.
• Cover Art Archive (coverartarchive.org) — downloads the artwork for a match MusicBrainz found, sending only that release's database ID. The images themselves are served by the Internet Archive (archive.org).

These lookups run when you search yourself or use Fix Song Info. Automatic lookup — fetching missing lyrics or artwork as songs play — is off by default and runs only if you turn it on.

• Requests identify the app (its name, version, and a link to its project), as these services ask. They carry no account, device identifier, or anything else about you.
• Like any internet request, they reveal your IP address to the service.
• We do not operate these services and receive nothing. Each handles requests under its own privacy policy.

AI features

Text features — AI Playlist, AI Tag Cleanup, and the AI suggestion in Fix Song Info — prefer the on-device model built into recent versions of iOS and macOS. That path runs entirely offline and sends nothing anywhere.

If the on-device model isn't available, these features stay off unless you turn on a third-party AI service in AI Settings and enter your own API key. Only then, and only when you actively use one of those features, Trove sends text metadata about your tracks (titles, artists, albums, and similar fields; for Fix Song Info, also the file name — at most a couple of hundred entries at a time) to the endpoint you configured.

Cover generation, for albums with no artwork, uses Image Playground on devices that support it, which runs on your device. Elsewhere it works only if you set up a cloud image service in AI Settings with its own API key. Then, each time you ask for a cover, Trove sends a short description built from the album's title, artist, and genre to that endpoint. Generated images are saved to your library only.

• These text and cover features do not send your audio files.
• The destination is the endpoint you enter. We do not operate it, and we receive nothing.
• Your API keys are stored in the system Keychain.
• All of this is off by default, no key is preconfigured, and nothing is sent unless you ask.

Whatever endpoint you choose handles that data under its own privacy policy, not ours.

Practice recording and generated audio

In Trove 2.2, microphone access is requested only when you choose to start a practice recording. Your recording, generated accompaniment and mixed audio remain on this device. You choose whether to save separate copies, add results to your library or share them. Trove does not send these recordings to a Trove server.

The audio tools are experimental bonuses for Supporter members. They are still being improved; their results and reliability are not guaranteed.

Local and optional remote transcription

In Trove 2.2, audio processing is local by default. The local lyric transcription model is downloaded only after you request it. Once downloaded, local transcription does not upload audio.

If you choose a compatible remote transcription service, you provide its endpoint, audio model and API key. Trove prepares only the selected clip, shows the destination, clip range, file size and possible provider charges, and sends it only after a separate confirmation. No audio is sent automatically and there is no automatic remote fallback. Your API key stays in the system Keychain.

The provider receives the confirmed clip and handles it under its own privacy policy. Trove does not operate that service or receive the clip. Like any internet connection, this request reveals your IP address to the provider.

Purchases

Trove's core features are free. Pro is a one-time purchase, never a subscription, and it is handled entirely by Apple's In-App Purchase system. Apple processes the payment and tells the app whether your purchase is active — we never see or store your payment details, your Apple Account, or your name. Restoring a purchase on another device goes through Apple in the same way. From Apple we receive only aggregate, anonymous sales reports.

Diagnostics

Trove contains no crash-reporting or analytics SDK. If you have enabled Share With App Developers in your system settings, Apple may pass us crash logs and aggregate usage statistics through App Store Connect. That is an Apple system-level feature, entirely under your control in Settings → Privacy & Security → Analytics & Improvements, and what reaches us does not identify you.

In Trove 1.6, Privacy & Diagnostics offers troubleshooting recording that is off by default. When enabled, its structured events stay on this device in a fixed-size store: new events replace the oldest, with no expiry by date. Turning recording off keeps existing records. The records exclude passwords, server addresses, file paths and music titles.

You can explicitly create a diagnostic package, then choose to save, share or attach it to Feedback. Creating a package sends nothing, and the troubleshooting-package attachment is off by default. These local records are not uploaded automatically. Clearing Diagnostic Data removes Trove-managed records, packages, the separate playback log and temporary playback attachments, but cannot remove copies you have already saved or shared outside the app. Recording keeps its chosen setting after clearing.

The separate playback log continues independently of the new troubleshooting switch. It may contain titles, paths, server addresses and error details; troubleshooting packages do not include it. The playback log and package have separate attachment choices in Feedback. The playback log is selected by default; turn off Attach playback log before sending if you do not want to include it.

Feedback

In Trove 1.5 and later, Feedback submits your message over HTTPS when you press Send. A reply email address is optional. In 1.6 you can turn off the selected-by-default playback-log attachment and choose any user-created troubleshooting package separately. Earlier versions open a mail draft instead.

The separate playback log is a plain-text record of playback and network events. It can include track titles, file paths, source addresses and error details. If you do not want to share this information, turn off Attach playback log before submitting. Audio files, your full library database, and saved passwords are not attached.

Cloudflare processes the HTTPS request and forwards the report to our support inbox. It receives your IP address to deliver and protect the service. We do not store reports in a separate application database or use them for advertising or analytics. We use the report and optional address only to investigate and respond, and keep them in our support inbox while needed for that purpose. You can request access or deletion by emailing us. Diagnostics are never uploaded automatically.

Permissions

• Local Network — required for Wi-Fi Transfer and SMB to reach your computer or NAS.
• Microphone — in Trove 2.2, used only for practice recording that you start. Trove requests access when you choose to start recording. On macOS, the audio-input entitlement enables practice recording inside the App Sandbox.
• Camera — not used or requested. A camera purpose string remains because the bundled audio decoding library (FFmpeg) references system capture APIs.

Children's privacy

Trove does not knowingly collect personal information from children. If a submitted report contains a child's personal information, contact us to request its deletion.

Changes

If this policy changes materially, we will update the date at the top of this page and describe the relevant behavior here.

Contact

Questions? Email hello@troveplayer.com.

This page covers the Trove app. For this website and its free browser tools, see the website privacy policy.