Privacy Policy
What we collect, why we collect it, and how to make us delete it.
Last updated October 26, 2026
The short version
We collect your email, your payment details (through Stripe, who handle the card), and a record of which lessons you've watched. We use them to give you the course, email you about it, and honor the refund guarantee. We don't sell your data and we don't run ads.
Who's responsible
Philip Winham (sole proprietor), trading as Troveman, in Texas, USA. Questions or requests: hello@troveman.com.
What we collect, and why
| What | Why |
|---|---|
| Your name and email address | To create your account, send your receipt and sign-in links, and answer you when you write in |
| Your email address, if you join the Troveman list | To send you updates about Troveman. Every email has an unsubscribe link |
| Payment and billing details | To take payment and issue refunds. Handled by Stripe; we never see or store your card number |
| Which lessons you've watched, and how much of each | To show your progress, and to apply the 25% refund threshold fairly. Without this the guarantee can't be honored |
| Which course files you've downloaded | So a refund request can be answered with facts rather than guesswork |
| Sign-in events | Security, and to spot shared accounts |
| Server logs, including IP address | Keeping the site up and fending off abuse. Kept briefly |
| Aggregate page analytics | Knowing which pages get read. Cloudflare Web Analytics, which uses no cookies and does not fingerprint or track you across sites |
| Where you found us | If you arrive from a link like our Instagram or TikTok bio, your browser remembers that for 30 days and it's attached to your order, so we know which posts are working. It stays on this site and is never shared with an ad network |
We don't ask for anything we don't need. There's no tracking pixel, no advertising network, and no third-party cookie on this site.
Cookies
We use cookies only to keep you signed in and to make checkout work. There are no advertising or cross-site tracking cookies, which is why you aren't being asked to click through a consent banner.
Who else handles your data
We use a small number of vendors to run the course. Each one only gets what it needs to do its job, and none of them may use it for their own marketing.
| Vendor | What they do | What they see |
|---|---|---|
| Stripe | Payment processing | Name, email, billing address, card details (Stripe holds the card data; we never see or store a card number) |
| Cloudflare | Hosting, video delivery, accounts, and course-progress storage | Email address, purchase status, IP address, request logs, which lessons you have watched and which files you have downloaded |
| Resend | Transactional email (receipts, sign-in links) | Email address, delivery events |
What we never do
- Sell or rent your personal information. Not to anyone, for any price.
- Share your email with other students, or with sponsors.
- Use your data to train anything.
- Email you marketing you didn't ask for. Course-related email (receipts, access, and occasional notes about new lessons) comes with enrolling, and every one of them has an unsubscribe link.
How long we keep it
Your account and watch history stay while your enrollment is active, since lifetime access means we have to know who you are. Payment records are kept as long as tax and accounting law requires, which in the US is generally seven years. Server logs are kept for a short period, typically 30 days. If you ask us to delete your account, we delete what we're not legally required to keep.
Your rights
Wherever you live, you can ask us to show you what we hold, correct it, delete it, or send you a copy. Email hello@troveman.com and we'll do it within 30 days. We won't charge you and we won't treat you differently for asking.
If you're in California, that includes your rights under the CCPA/CPRA to know, delete, correct, and opt out of sale or sharing. We don't sell or share personal information as those terms are defined, so there's nothing to opt out of, but the right to ask still stands.
If you're in the UK, EU, or somewhere with similar law, our basis for processing is performing our contract with you (giving you the course you bought), complying with law (tax records), and our legitimate interest in keeping the site secure. You can object, restrict processing, or complain to your local data protection authority. Your data is processed in the United States; our vendors above use standard contractual clauses where required.
Children
This course is sold to working and aspiring photographers and isn't intended for anyone under 16. We don't knowingly collect information from children. If you think a child has signed up, tell us and we'll remove the account.
Security
Everything runs over HTTPS. There are no passwords to leak: you sign in with a one-time link sent to your email, and your session is a signed cookie. Payment is handled by Stripe, so your card details never reach us. No system is perfect; if we ever have a breach affecting your data, we'll tell you promptly and tell you what to do.
Changes
If we change this meaningfully we'll update the date above and email enrolled students. Adding a vendor to the table counts as meaningful.
See also our Terms of Service and Refund Policy.