Trevy works your team’s Follow Up Boss database: your contacts, their activity, and the emails Trevy sends them. This page describes how Trevy protects that data. Our Privacy Policy describes what we collect and how long we keep it.

1. Credentials and Passwords

Your Follow Up Boss connection, whether an API key or Follow Up Boss sign-in tokens, is encrypted with AES-256-GCM before it’s stored.
Google and Microsoft are used for sign-in only. Trevy asks for the openid, email, and profile scopes and keeps no Google or Microsoft tokens, so it has no access to your mail or calendar.
Passwords are hashed with bcrypt. We never store or see your password itself, or your Google or Microsoft password.
Password reset links last 1 hour and email confirmation links last 24 hours. Each works once, and only a hash of it is stored.

2. Signing In and Sessions

Your session is a signed token in an HTTP-only cookie, which page scripts can’t read and browsers send only over HTTPS. It expires after 30 days, and signing out clears it.
New password signups must confirm their email address before they can sign in, and the signup form has a Cloudflare Turnstile bot check.
A Google or Microsoft sign-in only completes in the browser that started it, and Trevy accepts only an email address the provider has verified.
The pages and APIs for your account require a signed-in session.

3. Links in Emails and Public Pages

Contacts open Trevy’s links without signing in, so the links themselves carry the protection:

Unsubscribe links, agents’ links to confirm a tour or offer other times, tour calendar files, and the weekly report’s one-tap links are signed with HMAC-SHA256, so they can’t be guessed or altered.
Tracking links, report page links, and tour booking links use random codes. Tour booking links expire, normally 14 days after the email goes out, and stop working if the team turns tour requests off.
A tracked link only ever forwards to the address saved when the email was sent, never to one taken from the link.
Signup, email confirmation, report forms and searches, tour booking, agents’ tour answers, and unsubscribe are rate-limited.

4. Webhooks and Scheduled Jobs

Webhooks from Follow Up Boss are checked against their HMAC-SHA256 signature, and Stripe’s against Stripe’s signature, before Trevy acts on them.
Trevy’s scheduled jobs (sending, alerts, reports, and cleanups) run only when called with a secret token.

5. Data Isolation

Every account’s records are stored and looked up by account, so one customer can’t see another’s data.
Team members work through their team lead’s Follow Up Boss connection; only the team lead’s account stores it.
Trevy’s internal admin pages are limited to an approved list of Trevy staff.

6. Payments

Payments go through Stripe. Card details are entered into Stripe’s payment form and go directly to Stripe, so Trevy never stores card numbers. Trevy keeps your Stripe customer and subscription IDs, and the Billing page shows your card’s brand, last four digits, and expiry date from Stripe.

7. Infrastructure and Service Providers

Hosting: Vercel, for the Trevy app, report pages, and uploaded agent photos and logos
Database: Supabase
AI writing: Anthropic’s Claude API, which writes parts of Trevy’s emails. Trevy doesn’t send it contacts’ email addresses or phone numbers, and doesn’t use customer data to train AI models.
Payments: Stripe
Trevy’s own emails to you: Mailgun. Emails to your contacts go out through your Follow Up Boss account.

The Privacy Policy lists every provider and what each receives.

8. Deletion

An account’s Trevy data is permanently deleted 30 days after its paid plan or free trial ends, and a signup that never connects Follow Up Boss 30 days after it’s created.
When an account is deleted, Trevy also removes the webhooks it added to the team’s Follow Up Boss and the photos and logos the account uploaded.
After deletion, Trevy keeps only keyed hashes, which can’t be turned back into the addresses or IDs they came from, so that unsubscribes and the one-trial rule are still honored. Deleted data can remain in database backups until they roll off on our database host’s schedule.
You can ask us to delete your account sooner by emailing support@trevy.io.

9. How Changes Are Reviewed

Every change to Trevy’s code goes through a pull request that must pass automated tests, type checks, and an automated security review before it can merge. The review checks how credentials are handled, that data stays within its account, authentication on protected routes, input validation, and secrets in logs, and a critical finding blocks the merge. Releases ship only changes that passed.

10. What You Can Do

Cut off Follow Up Boss access: Trevy’s Settings has no disconnect option yet. Remove Trevy’s access in your Follow Up Boss account or, if you connected with an API key, regenerate the key there, and Trevy can no longer use the old one. You can also contact us.
Revoke Google or Microsoft sign-in: remove Trevy from the connected apps in your Google or Microsoft account. To keep using Trevy afterward, set a password with “Forgot password” on the sign-in page.
Cancel and delete: cancel your plan in Settings → Billing, and ask us to delete your account if you don’t want to wait the 30 days.

11. Reporting Security Issues

If you discover a security vulnerability, please report it to support@trevy.io. We look into every report.

Trevy LLC
Florida, United States