Privacy Policy
Trawly is a personalized morning digest service. This policy explains what personal information we collect, how we use it, and your rights. We've written it in plain English because you deserve to actually understand it.
What we collect
Account information
Your email address, display name, delivery phone number (if you use SMS), and X (Twitter) handle (if you connect it). We collect this so we can deliver your digest and identify you.
Taste profile
The interests, context, and preferences you provide during onboarding and refine over time. This is the most sensitive data we hold — it can include information about your work, projects, health interests, and personal context. We use it exclusively to personalise your digest.
Engagement data
Which digest links you click, when you open the web version of a digest, the replies you send, and which stories and sections you engage with. We also record a coarse device category (for example “mobile” or “desktop”) and operating system, derived from your browser at the moment you click or open — we do not store the raw browser User-Agent string or your IP address for this purpose. We use engagement data to learn your preferences, measure quality, and decide what to keep or cut — not to sell to advertisers.
Delivery preferences
Your preferred delivery time, timezone, and delivery method (email or SMS).
How we use it
- To research, compile, and deliver your personalised daily digest
- To learn your preferences over time and improve future digests
- To send you transactional messages about your account
- To measure product quality and fix bugs
We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described below. We never sell or share your mobile phone number, or your consent to receive text messages, with third parties or affiliates for their own marketing. Phone numbers are used only to deliver the SMS you asked for.
Third-party services we use
Your taste profile and curated content are sent to Anthropic's API to generate your digest. We use API access — prompts are not used to train Anthropic's models. See Anthropic's privacy policy.
All user data is stored in Supabase's hosted Postgres database with row-level security. Data is encrypted at rest and in transit.
Used only to deliver your digest and, if you opted in, your Trawly text messages (a daily brief-ready alert, a one-time welcome text, and support replies). We do not share your email or phone number with these providers beyond what's needed for delivery.
Our application is hosted on Vercel. Standard server logs (IP addresses, request metadata) may be retained for security purposes.
Subscription payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers. We store only a reference to your Stripe customer record and your subscription status. See Stripe's privacy policy.
Cookies and local storage
Trawly does not use advertising or third-party tracking cookies. We use essential cookies and browser local storage only to keep you signed in and to avoid double-counting when you open a digest on the web. Because these are strictly necessary to run the service, they don't require a consent banner. Our digest emails contain no open-tracking pixel.
Data retention
We retain your data for as long as your account is active. Digest history is kept for 12 months. Engagement events — including the coarse device category described above, but never a raw User-Agent or IP address — are kept for 90 days for profile optimisation and product analytics, then aggregated and anonymised.
Legal basis and international users
Trawly is available worldwide. We process your account and delivery data to provide the service you signed up for; engagement and quality data under our legitimate interest in improving Trawly; and we rely on your consent for email and SMS delivery.
Depending on where you live, you may have rights under the GDPR (EU/UK), the California CCPA/CPRA, the Australian Privacy Act, or similar laws — including the access, correction, deletion, portability, and opt-out rights listed above. We honour these regardless of where you're based. Your data may be stored and processed in the United States and other countries by the providers listed above; where required, we rely on appropriate safeguards such as Standard Contractual Clauses. To exercise a right or object to processing, email gm@heytrawly.com.
Your rights
You have the right to:
- Access — request a copy of all data we hold about you
- Correction — update your taste profile at any time from your settings page
- Deletion — request deletion of your account and all associated data
- Portability — receive your taste profile and digest history in a machine-readable format
- Opt-out — unsubscribe from all communications at any time via the unsubscribe link in any email
To exercise any of these rights, email gm@heytrawly.com. We'll respond within 30 days.
Email and SMS consent
Email delivery of your digest is part of the core service. SMS is separate and optional — never a condition of creating an account. You opt in to text messages only by entering your mobile number and ticking a dedicated SMS consent checkbox during signup. If you opt in, we text you a daily alert that your brief is ready (about one per day), a one-time welcome text, and replies when you text us for help. Reply STOP to opt out or HELP for help at any time; message and data rates may apply. We do not send marketing messages, and we never share your number with third parties. See our Messaging Terms.
Security
We use industry-standard security practices: encrypted connections (TLS), encrypted data at rest, row-level database security, and restricted access controls. Trawly is in beta — if you discover a security issue, please report it to gm@heytrawly.com rather than disclosing publicly.
Changes to this policy
If we make material changes to how we handle your data, we'll notify you by email before the change takes effect. The date at the top of this page always reflects the most recent revision.
Contact
Questions about this policy or your data? Email gm@heytrawly.com.
Trawly is a service of Mongrelverse Pty Ltd (ABN 78 658 514 311), the entity responsible for the data described in this policy.