Privacy Policy

troimarket ("we", "our", or "us") operates the troimarket digital product marketplace platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

We collect information you provide directly when creating an account and using our platform:

• Account Information: Your name, email address, and password (hashed). If you sign in with Google, we receive your name and email from Google.
• Profile Information: Your display name, avatar image, storefront name, bio, and social media links.
• Content: Products, bundles, images, and other content you create and publish on the platform.
• Transaction Data: Purchase history, sales records, and pricing information related to products you buy or sell.
• Payment Details: Payment card and banking details are collected and processed entirely by Whop, our payment partner. troimarket never receives or stores your card number or banking information.
• Usage Data: We collect first-party usage analytics, stored on our own infrastructure. This includes pages viewed, features used and actions taken, the site that referred you and any campaign parameters in the link you followed, basic device information (your browser's user-agent string, language setting, and window size), and interaction detail such as clicks, scroll depth, time spent on a page, which form fields you interact with (we record the name of the field, never what you type into it), and search terms you enter on the site. To group the events from a single visit together, we use a randomly generated identifier that is held only in the page's memory. It is never written to your device, it is gone as soon as you reload or leave the page, and it is a random value that is not derived from, or linked to, any information about you from outside troimarket. We deliberately do not store anything that would let us recognise you as a returning visitor, and we do not attempt to measure repeat visits. This data is never shared with third parties and is never used for advertising. If your browser sends a Do Not Track or Global Privacy Control signal, we collect no usage analytics at all and create no identifier. If you are signed in, usage events may also be associated with your account; that association is removed if you delete your account.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the troimarket platform
• Process transactions between buyers and sellers
• Send you transactional emails (purchase confirmations, sale notifications, welcome emails)
• Send you notification emails based on your preferences
• Enforce our Terms of Service and protect against fraud
• Respond to your requests and provide customer support

3. Legal Bases for Processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Performance of a contract: creating and maintaining your account, listing and delivering the products you publish, processing purchases between buyers and sellers, and sending transactional emails such as purchase confirmations and sale notifications. Without this processing we cannot provide the service.
• Legitimate interests: first-party usage analytics to understand how the service is used and improve it, securing the platform, preventing fraud and abuse, and enforcing our Terms of Service. We balance these interests against your rights, keep the data on our own infrastructure, do not share it with third parties, and never use it for advertising. You may object to this processing at any time — see Section 8.
• Consent: optional notification emails, which you choose in Settings and can withdraw at any time without affecting the service.
• Legal obligation: retaining transaction records for tax and accounting purposes, and responding to valid legal process.

4. Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• Public Profile: Your storefront name, bio, and published products are visible to all users.
• Transactions: When you purchase a product, the seller receives a notification with your display name. When you sell, buyers see your author name.
• Service Providers: We use third-party services including Firebase (hosting, authentication, and database), Whop (payment processing), Resend (email delivery), and Google Fonts (font delivery — your browser requests font files from Google's servers). These providers access your data only to perform services on our behalf.
• Legal Requirements: We may disclose your information if required by law or in response to valid legal process.

International transfers. troimarket is operated from the United States, and the service providers named above store and process data in the United States. If you are in the EEA or the UK, this means your personal data is transferred outside your home country. Where that transfer is not covered by an adequacy decision, we rely on the safeguards our providers make available, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can request more detail about these safeguards using the contact address in Section 12.

5. Data Storage and Security

Your data is stored using Google Firebase (Firestore and Firebase Storage) with industry-standard security measures. We use Firebase Authentication to securely manage your account credentials. While we implement reasonable security measures, no method of transmission over the Internet is 100% secure.

6. Data Retention

We keep personal data only for as long as we have a reason to:

• Account and profile data: kept while your account is open, and deleted when you delete your account.
• Content you publish: kept until you take it down or delete your account.
• Purchase and sales records: kept after account deletion. We need them so that buyers keep access to products they paid for, and to meet tax and accounting obligations.
• Email records: a log of transactional emails we have sent you, kept so we can investigate delivery problems and disputes.
• Usage analytics: kept for as long as it remains useful for the purposes described in Section 2. When you delete your account, your account identifier is removed from these records, so what remains is no longer linked to you.

7. Your Rights and Choices

• Access and Update: You can access and update your profile information through the Settings page at any time.
• Email Preferences: You can control which notification emails you receive through Settings > Notifications. You can disable all emails with the master toggle.
• Delete Account: You can delete your account through Settings > Account > Delete Account. This marks your account as deleted, and your account identifier is removed from our analytics and session records. Buyers who purchased your products retain access, and your products will show "from deleted user."
• Content Removal: You can take down any product or bundle you've published through the Seller Hub.

8. Additional Rights for EEA and UK Users

If you are in the European Economic Area or the United Kingdom, you have the following rights over your personal data. They apply in addition to the controls in Section 7, and exercising them is free.

• Access: ask for a copy of the personal data we hold about you, and information about how we use it.
• Rectification: ask us to correct data that is inaccurate or incomplete.
• Erasure: ask us to delete your personal data. You can do this yourself through Settings > Account > Delete Account. Some records, such as purchase history, are kept as described in Section 6.
• Restriction: ask us to pause processing of your data while a dispute about its accuracy or our use of it is resolved.
• Portability: ask for the data you provided to us in a structured, commonly used, machine-readable format, or ask us to send it to another provider.
• Objection: object to processing we carry out on the basis of legitimate interests, including our usage analytics. If you object to analytics, we will stop associating usage data with you.
• Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect processing carried out before you withdrew it.

To exercise any of these rights, email support@troimarket.com. We will respond within one month, and will tell you if we need longer because the request is complex. We may ask you to confirm your identity before we act on a request.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

If you believe we have handled your data improperly, you have the right to complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EEA it is the supervisory authority in the country where you live or work.

9. Cookies and Local Storage

We do not use advertising cookies or third-party tracking cookies, and we do not load third-party analytics or advertising scripts on troimarket. We do use your browser's storage for our own purposes:

• Signing you in: Firebase Authentication stores session tokens so you stay signed in between visits.
• Your work and preferences: we save drafts of products you are still building, and one-time flags such as whether you have dismissed a notice.
• Getting around: while a tab is open we remember how you reached a storefront, so its Back button returns you to the right place. This is cleared when you close the tab.

Our own analytics store nothing on your device. The random identifier that groups one visit's events, and the page-variation label that goes with it, exist only in the page's memory and disappear when you reload or leave the page.

None of this is shared with third parties, and you can clear all of it at any time through your browser's site-data settings. During checkout, our payment partner Whop may use cookies or similar storage strictly necessary to process your payment securely.

10. Children's Privacy

troimarket accounts are for adults (18+); minors who are at least 13 may use the platform only with a parent or guardian's permission and supervision, as described in our Terms of Service. troimarket is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will take steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at support@troimarket.com.