Your data belongs to you.

Account Information: When you create an account, we collect your email address and basic profile information via our authentication provider (Supabase).

Horizon Data: The layouts, Elements, Jots (notes), and spatial coordinates you place on your horizon are stored securely in our cloud database so they can sync across your devices in real-time.

Calendar & External Integrations: If you choose to connect third-party accounts (like Google Calendar or Apple iCloud via our Timeline Bridges), we receive an authentication token. We only retrieve the specific calendar events necessary to display them on your Household Horizon or Business Horizon.

Triora utilises the File System Access API to allow you to view and interact with your local hard drive directly on the horizon.

Zero-Upload Guarantee: Files accessed via the Local Drive Core remain entirely on your physical device. We do not upload, copy, or store these files on our servers unless you explicitly choose to convert them into a cloud-hosted Anchor Element.

To power our Spatial AI Sidekicks, Triora integrates with the Google Gemini API.

• When you use AI features (like organising your horizon or parsing a photo of a receipt), the specific text or image is sent securely to the AI provider solely for the purpose of generating your result.
• We do not use your personal family or business horizon data to train our own foundational AI models.

We do not sell your data. Period.

We only share information with trusted infrastructure partners strictly to run the application:

You own your data. You can export your horizon data or delete your account at any time from your settings panel.

• Deleting your account will immediately purge your user data and horizon documents from our active databases.
• You may request a full data export at any time by contacting us at privacy@Triora.app.
• To submit a formal data deletion request, email privacy@Triora.app with the subject line 'Data Deletion Request'.

Triora is designed for families and includes features such as KidsBoards and Caretaker Environments. We comply with the Children’s Online Privacy Protection Act (COPPA) and similar international regulations.

• Children under 13 may only use Triora through a household account managed by a parent or legal guardian.
• We do not knowingly collect personal information directly from children under 13 without verified parental consent.
• KidsBoard content is stored within the parent's horizon and governed by the parent's account settings.
• Parents may review, modify, or delete their child's data at any time through the settings panel or by contacting privacy@Triora.app.
• If we discover that personal information has been collected from a child under 13 without parental consent, we will delete it promptly.

Your data is protected in transit and at rest. We employ industry-standard security measures to safeguard your information.

• All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted within Supabase's managed PostgreSQL infrastructure.
• We enforce Row Level Security (RLS) policies so users can only access data they are authorised to see.
• In the event of a data breach affecting your personal information, we will notify affected users within 72 hours as required by GDPR and applicable law.
• We do not store payment card details — all payment processing is handled by Stripe's PCI-compliant infrastructure.

We retain your data only as long as necessary to provide the service and fulfil our legal obligations.

• Active accounts: data is retained for the duration of your subscription.
• Deleted accounts: all personal data and horizon content is purged from active databases within 30 days of account deletion.
• Encrypted backups may retain residual data for up to 90 days before automatic expiry.
• Consent preference records may be retained for up to 12 months so we can honor your tracking choice across sessions and devices.
• Anonymised, aggregated analytics data that cannot identify you may be retained indefinitely for product improvement.

We do not use advertising or remarketing trackers.

• Triora uses essential session cookies solely for authentication and maintaining your signed-in state.
• Optional product analytics, session replay, and performance telemetry remain disabled until you explicitly opt in through the in-app consent prompt.
• When you opt in, Triora may enable PostHog, Sentry Session Replay, Vercel Analytics, Speed Insights, and Google Analytics where configured for that environment.
• Your consent choice is stored in localStorage and in a first-party consent cookie so we can honor it on future visits.
• Declining non-essential tracking does not block core product functionality.
• The legal basis for essential cookies is contractual necessity or legitimate interests; the legal basis for optional analytics and replay is consent.
• We do not deploy any third-party advertising, remarketing, or behavioural targeting technologies.
• No data is shared with ad networks or social media platforms for targeting purposes.

If you are located in the European Economic Area (EEA), the United Kingdom, or California, you may have additional rights under applicable privacy laws.

• GDPR (EU/UK): You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. To exercise these rights, contact privacy@Triora.app.
• CCPA (California): You have the right to know what personal information is collected, request deletion, and opt out of sale. We do not sell personal information.
• Governing law: Triora is operated from British Columbia, Canada, and is subject to Canadian federal and provincial privacy legislation (PIPEDA).

For any questions, concerns, or requests regarding your privacy, please contact us at: