TrolleyFire – Privacy Policy

1. Introduction

This Privacy Policy explains how TrolleyFire (“we”, “our”, “the Service”) collects, uses, stores, and protects your personal data. By using the Service, you agree to the practices described in this Policy.

This Policy is intended to comply with UK GDPR, the Data Protection Act 2018, and the Hong Kong Personal Data (Privacy) Ordinance (PDPO).

2. Data We Collect

2.1 Account Information

We may collect:

• Email address
• Display name / profile name
• Authentication data (via Supabase Auth)

2.2 User‑Generated Content (UGC)

We may collect and store content you upload, including:

• Product information and prices
• Images
• Notes and comments
• Likes / dislikes
• Views and interactions

2.3 Technical Data

We may collect:

• Browser type and version
• Device type
• IP address (processed by Cloudflare for security)
• Cookies (including Cloudflare security cookies such as __cf_bm)
• PWA / Web App usage behaviour

2.4 Usage Data

We may collect:

• Pages visited
• Search queries
• Time spent on pages
• Click actions and interactions

We do not intentionally collect sensitive personal data (e.g. health, financial, biometric data).

3. How We Use Your Data

We use your data to:

• Operate and maintain the Service
• Authenticate users and manage accounts
• Display user‑generated content
• Prevent abuse, spam, and fraud
• Improve search, ranking, and product listings
• Analyse usage patterns and improve features
• Contact you regarding account or security issues

We do not sell your personal data.

4. Legal Basis for Processing

Under UK GDPR, we process your data based on:

• Consent – when you create an account or upload content
• Legitimate interests – to maintain platform security and functionality
• Contractual necessity – to provide the Service you request

5. Cookies and Tracking

TrolleyFire uses minimal cookies and browser storage, including:

• Supabase authentication cookies – to keep you logged in
• Cloudflare security cookies (e.g. __cf_bm) – to detect bots and protect the Service
• Local storage – for Web App / PWA behaviour

Safari and some browsers may block certain third‑party cookies; this does not prevent you from using the Service. We do not use advertising cookies.

6. Data Storage and Security

Your data is stored using:

• Supabase Database
• Supabase Storage
• Cloudflare Pages and CDN

We use encryption in transit (HTTPS), access control, Row Level Security (RLS), and other reasonable measures to protect your data. However, no system is completely secure, and we cannot guarantee absolute security.

7. Data Sharing

We do not sell or rent your personal data.

We may share data only with:

• Supabase – for authentication, database, and storage
• Cloudflare – for hosting, caching, and security
• Legal authorities – if required by law

8. User‑Generated Content

Content you upload (including images, product information, and comments) may be visible to other users. You are responsible for ensuring that your uploads:

• Do not contain personal data of others without consent
• Do not infringe copyright or other rights
• Do not contain illegal or inappropriate material

We may remove content that violates our Terms & Conditions or applicable law.

9. Data Retention

We retain account data for as long as your account is active. User‑generated content is retained until you delete it or request removal. Security logs may be retained for a limited period (typically 30–90 days) for security and diagnostic purposes.

10. Your Rights

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Request a copy of your data
• Withdraw consent (where processing is based on consent)
• Object to certain types of processing
• Lodge a complaint with a data protection authority

To exercise these rights, please contact us.

11. Children’s Privacy

The Service is not intended for users under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Third‑Party Links

The Service may contain links to external websites. We are not responsible for the privacy practices or content of those third‑party sites.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes are posted means you accept the updated Policy.

14. Contact

If you have questions about this Privacy Policy, please contact the operator of TrolleyFire.

← Back to TrolleyFire