Skip to main content
Troopy

Last updated 24 September 2026

Privacy Policy

Troopy is a hosted service. This page describes what it stores about you and your organization, where that data goes, and what you can do about it. It covers the Troopy web app, its API and MCP server, and the troopy command-line tool.

What Troopy stores

  • Your account: name, email address, and either a Google account identifier or a salted password hash. Never the password itself.
  • Your organization: its name, its workspaces, the people in it and their roles, and which workspace you last opened.
  • The waitlist: the email address you leave on troopy.ai, and when. Troopy uses it only to tell you when you can start.
  • Invites: the email address you invite, the role and workspace offered, who sent it and when. The invite link is stored only as a hash and expires after 7 days.
  • API keys: each key’s name, scopes, creator and when it was last used. Troopy keeps only a hash of the key and a few of its characters, so it can never show the whole key again. Revoked keys stay on record.
  • API activity: a daily count of calls per workspace, key and operation, and for 24 hours the response to a request sent with an Idempotency-Key, so a retry gets the same answer.
  • Server logs: requests and errors, which can include your IP address, kept for security and debugging and rotated away automatically.

Cookies and browser storage

One sign-in cookie keeps you logged in for up to 14 days, alongside the short-lived cookies the sign-in flow itself needs. Your choice of light or dark theme is kept in your browser’s local storage. Nothing else.

Where data goes

  • DigitalOcean, which hosts the Troopy app, and MongoDB Atlas, which hosts its database. Each workspace is kept apart from every other.
  • Google, when you sign in with Google. Troopy keeps only your name, email address and Google account identifier from it.
  • Amazon Web Services, whose email service (Amazon SES) delivers invites: the invitee’s email address, the inviter’s name, and the organization and workspace names.

What Troopy does not do

  • No analytics, advertising or tracking scripts on the app or this site.
  • No selling of data, and no sharing with anyone other than the services above.
  • No training of models on your data.

Changes

Troopy is growing. Before a feature stores something new or sends data somewhere new, such as AI teammates, connections to other services or billing, this page says so and its date changes.

Your choices

Revoke API keys in Settings; owners and admins also remove people and cancel invites there. Revoke Troopy’s access to your Google account at any time from your Google account settings. To delete your account or your organization, write to us from the email address on your account and we remove it.