Your accounts,your data,your say.
Troy works inside accounts you own, with access you grant and can take back. This page sets out how that is designed to work — what is in place today, what is planned, and what Troy will not do at all.
This page describes how Troy works and intends to work. It is not a legal document; the contract you sign governs.
Eight commitments, each one labelled.
Five of these hold today, because they are rules the service already works under. Three describe the approval queue, which is designed and not built. The label on each one says which.
- 01In place
The accounts and the tokens are yours.
Troy is added to accounts you already own. Every connection token belongs to you, and revoking one is a decision you make in your own platform settings, not a request you file with Troy.
- 02In place
Troy never holds your media money.
You pay Meta, Google and every other platform directly, on your own payment method. Handling client media money is deliberately not part of the first version of Troy, and there is no version of this page where it quietly becomes part of it.
- 03In place
A Troy Score needs read-only access, and you can remove it the same day.
Read-only is the lowest access tier on every platform Troy connects to, and it is all a score needs. Nothing in your accounts is changed to produce one. Take the access away and the work stops the same day; the report you were sent is still yours.
- 04In place
Nothing is built on scraping.
Every connection is an official one, applied for and reviewed by the platform that owns it. That is slower than scraping and it is the only version that survives a platform changing its mind.
- 05In place
No number appears in a report unless it came from an API response.
A figure you cannot trace is not evidence. Today a strategist prepares each report by hand against that rule; when the platform does the reading, every figure traces to the response it came from.
- 06Planned
Every agent write lands paused, or as a draft.
That is the floor of the approval queue, not a setting. An agent can build the thing; it arrives switched off, and a person turns it on. Only Meta supplies an approval queue of its own — everywhere else this is Troy's to build, which is why it is planned and not yet real.
- 07Planned
A policy for each tool, and a hard cap on spend.
Each tool an agent can use has one of three policies: auto-approve, always ask, or ask above a threshold you set. Spend caps are hard — over the cap is refused, not queued — and they are set at the ad platform as well as inside Troy.
- 08Planned
A permanent change log, and a way back from every entry.
Every change is written down with who approved it, and every change can be reverted. Reverting deletes nothing: the revert is written above the original as a change of its own. An approval can wait for days without losing its state.
Per connection, per stage, in a table you can argue with.
Four connections, four columns, three stages of access. Move the stage and watch three quarters of the table go dim — that is what read-only actually means.
Read-only. The lowest tier everywhere.
Choose a stage. Cells that do not apply are dimmed, never hidden.
8 of 16 cells apply at Read
| Connection | ReadsWhat Troy can see | DraftsWhat an agent can build, switched off | May change with your approvalOne approval per change, under your cap | Never touchesAt every stage, including the last |
|---|---|---|---|---|
At Read, Troy can look and nothing else. It is all a Troy Score needs, and it is the only access Troy asks for today.
Meta Reads
Applies from Read
Campaigns, ad sets and ads
Structure, spend and results, read-only. This is what the Score's Foundations layer grades — tracking health, account structure, creative variety and wasted spend — and what the weekly report is built from. No number reaches that report unless it came from an API response.
None of these four connections is built yet. Today a strategist is added as a viewer on the accounts you name, and that read-only seat is the only access Troy has.
An access review is a platform's decision, not Troy's. Any row here can arrive later than planned, or not at all, and this page will say so rather than quietly dropping it.
Work made by AI says so, before you approve it.
Every piece of work an agent hands you carries a label, and the label is shown before you approve rather than after it ships. Choose how a piece was made and see what the queue would put on it.
Made by a person
A named person at Troy wrote it and made it. A model was not used to produce what you are looking at.
- Label on the ad
- None. There is no AI to disclose.
- Who made it
- A named strategist or producer at Troy.
- What ships
- Exactly what you approved, under your brand rules.
You confirm the claim in the ad is one you can stand behind, and that the evidence for it is on file.
Troy keeps evidence on file for every marketing claim it puts in an ad, whoever made the ad.
Until the queue exists, the same thing happens in writing: when a strategist sends work for approval, the note says what a model made.
What Troy will never do.
Not a setting, not a plan, and not something a busy week can talk anyone out of.
- Hold your media money. You pay the ad platforms directly, on your own payment method.
- Make a live change without an approval record.
- Spend above the cap you set.
- Report a number that did not come from an API response.
- Claim the Troy Score predicts your results.
- Send a commercial email or text on your behalf. An agent drafts it in your account; the send, the list and the consent behind it stay yours.
One thing that is not on that list, because it would not be true: Troy, Louin and Lunari Group share systems and data. Client data is held on systems Lunari Group runs, and the companies in the group can see each other's data. If you are a Louin customer, that is the arrangement your data is already in. Troy's own site and the data behind it run on Vercel, in its Washington, D.C. region, so they sit in the United States even though Troy is Canadian. Canada's federal privacy law, PIPEDA, generally asks for a person's meaningful consent before their personal information is used for a purpose they were not told about. The written agreement inside the group, the notice to the people whose data moves and the record of their consent are being worked on. None of them is in place today, which is why the sharing is also the first of the open items below.
The four answers Troy does not have.
A trust page that lists only the settled things is not a trust page. These are open, and saying so is cheaper than being caught.
- Open
What makes the sharing across the group lawful
Troy, Louin and Lunari Group share systems and data, and the section above says so rather than talking around it. Canada's federal privacy law generally asks for meaningful consent before someone's personal information is used for a purpose they were not told about. The agreement inside the group, the notice to the people whose data moves and the record of their consent are all outstanding. Until they exist, this page states what happens and claims nothing more.
- Open
How long anything is kept
Periods are written down now, and they differ by kind: an enquiry, a client record, the data from a connected account, a log and the record of what an agent made are five different questions. They are conventional defaults, marked on the legal pages as proposals nobody has approved. They become real when a lawyer confirms or replaces them.
- Open
What the AI vendors may do with what is sent
The agents call OpenAI and Anthropic, and the site is hosted by Vercel. What is not confirmed is which plan each AI provider is used under, and whether that plan lets the provider train on what Troy sends it. Both say their business terms exclude training by default. Troy has not confirmed it for its own accounts, so this page does not claim it.
- Open
Certifications
Troy holds none, and this page will not imply otherwise by talking around it. If Troy ever seeks one, this page will name it and say when it was granted.
All four are answered in public before the platform opens to anyone. The first one is not waiting for that: the sharing happens today, so the answer has to come sooner. No date is attached to any of them, because a date on this would be a guess, and a guess on this page is worse than a gap.