Privacy Policy

troimarket ("we", "our", or "us") operates the troimarket digital product marketplace platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

We collect information you provide directly when creating an account and using our platform:

• Account Information: Your name, email address, and password (hashed). If you sign in with Google, we receive your name and email from Google. For sellers we also record the country they are based in; it decides whether the seller emails in Section 2 are on by default, and is used for nothing else.
• Profile Information: Your display name, avatar image, storefront name, bio, and social media links.
• Content: Products, bundles, images, and other content you create and publish on the platform.
• Transaction Data: Purchase history, sales records, and pricing information related to products you buy or sell.
• Payment Details: Payment card and banking details are collected and processed entirely by Whop, our payment partner. troimarket never receives or stores your card number or banking information.
• Usage Data: We collect first-party usage analytics, stored on our own infrastructure. This includes pages viewed, features used and actions taken, the site that referred you and any campaign parameters in the link you followed, basic device information (your browser's user-agent string, language setting, and window size), and interaction detail such as clicks, scroll depth, time spent on a page, which form fields you interact with (we record the name of the field, never what you type into it), and search terms you enter on the site. To group the events from a single visit together, we use a randomly generated identifier that is held only in the page's memory. It is never written to your device, it is gone as soon as you reload or leave the page, and it is a random value that is not derived from, or linked to, any information about you from outside troimarket. We deliberately do not store anything that would let us recognise you as a returning visitor, and we do not attempt to measure repeat visits. This data is never shared with third parties and is never used for advertising. If your browser sends a Do Not Track or Global Privacy Control signal, we collect no usage analytics at all and create no identifier. If you are signed in, usage events may also be associated with your account; that association is removed if you delete your account.
• Seller page counts: We count visits to a seller's store, Links page and Creator notes page, opens of their products, presses on their links and the seller's own presses of the Share button, as daily and weekly totals that only that seller sees. These counts hold nothing about who visited: no account, device, cookie, IP address or referrer is recorded with them, and a seller's own visits are not counted.
• Things you send us: if you report a listing, page or video, we keep the reason you picked, what you wrote, the email address you gave (if any), your browser's user-agent string, and your account identifier if you were signed in. If you request a file type, we keep the file type, your email address if you gave one, and whether you asked for a reply. If you send feedback from inside the app, we keep the text, any rating, which part of the app you were on, and your account identifier if you were signed in. If you email support, we keep the email.
• AI assistants: if you connect an assistant (for example Claude or ChatGPT) to your account, what it does for you reaches us through that connection: the listing details it drafts, the store changes and notes you approve, and searches it runs. We keep which assistant is connected and when it was last used; you can disconnect it at troimarket.com/assistant. Your conversation with the assistant stays with its provider, under that provider’s own privacy policy; we receive only the requests it sends us.
• IP addresses: when you submit a report or a file type request, we combine your IP address with the date and keep only a one-way hash of it, to limit how many submissions one address can make in a day; the address itself is not stored. Separately, our hosting provider and Google Cloud (which runs Firebase and our server functions) record IP addresses in standard server logs as part of running the service.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the troimarket platform
• Process transactions between buyers and sellers
• Stamp the files you buy with your email address: when you download a purchased PDF (or, for an ebook, its page images or archive), the copy made for you carries your email on its pages, so a copy that is shared without permission can be traced to the purchase. The stamped file is delivered only to you; the seller does not receive your email address through it.
• Send you transactional emails (purchase confirmations, sale notifications, welcome emails)
• Send you notification emails based on your preferences
• Send sellers a weekly email with their own store counts (visits, link clicks, sales), and one reminder while a new store is still empty. For sellers in the United States these are on by default; elsewhere they are off until the seller asks for them and confirms from the email that follows. Each one has an unsubscribe link that works without signing in, and they can be turned off in Settings > Notifications. To decide whether to send one we look only at the seller's own counts and the time of their last sign-in. These emails contain no tracking: no open pixels and no click tracking.
• Enforce our Terms of Service and protect against fraud
• Respond to your requests and provide customer support

3. Legal Bases for Processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Performance of a contract: creating and maintaining your account, listing and delivering the products you publish, processing purchases between buyers and sellers, and sending transactional emails such as purchase confirmations and sale notifications. Without this processing we cannot provide the service.
• Legitimate interests: first-party usage analytics to understand how the service is used and improve it, securing the platform, preventing fraud and abuse, and enforcing our Terms of Service. We balance these interests against your rights, keep the data on our own infrastructure, do not share it with third parties, and never use it for advertising. You may object to this processing at any time — see Section 8.
• Consent: optional notification emails, which you choose in Settings and can withdraw at any time without affecting the service.
• Legal obligation: retaining transaction records for tax and accounting purposes, and responding to valid legal process.

4. Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• Public Profile: Your storefront name, bio, and published products are visible to all users.
• Transactions: When you purchase a product, the seller receives a notification with your display name. When you sell, buyers see your author name.
• Service Providers: We use third-party services including Firebase (hosting, authentication, database, file storage and the server functions that process uploads such as intro videos), Whop (payment processing — Whop collects your email address and card details on its own checkout, and we keep your account email with the purchase record so your payment can be matched to your library), Resend (email delivery), and Google's Gemini API (only if you use the import option when creating a recipe: the file or text you choose is sent to Google to extract the recipe fields, and nothing is sent unless you choose to import). These providers access your data only to perform services on our behalf. Fonts are served from our own domain.
• Embedded content: when a store shows a YouTube intro video, the player is embedded from youtube-nocookie.com and its thumbnail is loaded from Google's image servers, so Google receives your browser's request, including your IP address, when that page loads, under Google's privacy policy. When you import a Word document, the document reader is loaded from Cloudflare's cdnjs, which receives your browser's request.
• Legal Requirements: We may disclose your information if required by law or in response to valid legal process.

International transfers. troimarket is operated from the United States, and the service providers named above store and process data in the United States. If you are in the EEA or the UK, this means your personal data is transferred outside your home country. Where that transfer is not covered by an adequacy decision, we rely on the safeguards our providers make available, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can request more detail about these safeguards using the contact address in Section 12.

5. Data Storage and Security

Your data is stored using Google Firebase (Firestore and Firebase Storage) with industry-standard security measures. We use Firebase Authentication to securely manage your account credentials. While we implement reasonable security measures, no method of transmission over the Internet is 100% secure.

6. Data Retention

We keep personal data only for as long as we have a reason to:

• Account and profile data: kept while your account is open, and deleted when you delete your account.
• Content you publish: kept until you take it down or delete your account.
• Seller page counts: kept while the seller's account is open, and deleted when they delete their account.
• Purchase and sales records: kept after account deletion. We need them so that buyers keep access to products they paid for, and to meet tax and accounting obligations.
• Email records: a log of the emails we have sent you (which kind, to which address, when, and whether it was delivered), kept so we can investigate delivery problems and disputes.
• Email choices: your country, your email preferences and a record of when you set or changed them (including when you confirmed or unsubscribed) are kept while your account is open, and deleted when you delete your account. If an address bounces or marks our email as spam, we keep a one-way hash of that address so that we stop sending to it.
• Reports, requests and feedback: kept while we handle them and afterwards as our record of what was reported and what we did about it.
• Usage analytics: kept for as long as it remains useful for the purposes described in Section 2. When you delete your account, your account identifier is removed from these records, so what remains is no longer linked to you.

7. Your Rights and Choices

• Access and Update: You can access and update your profile information through the Settings page at any time.
• Email Preferences: You can control which notification emails you receive through Settings > Notifications. You can disable all emails with the master toggle. Every weekly store email, reminder and sale notification also has an unsubscribe link at the bottom, which works without signing in and takes effect at once.
• Delete Account: You can delete your account through Settings > Account > Delete Account. This marks your account as deleted, and your account identifier is removed from our analytics and session records. Buyers who purchased your products retain access, and your products will show "from deleted user."
• Content Removal: You can take down any product or bundle you've published through the Seller Hub.

8. Additional Rights for EEA and UK Users

If you are in the European Economic Area or the United Kingdom, you have the following rights over your personal data. They apply in addition to the controls in Section 7, and exercising them is free.

• Access: ask for a copy of the personal data we hold about you, and information about how we use it.
• Rectification: ask us to correct data that is inaccurate or incomplete.
• Erasure: ask us to delete your personal data. You can do this yourself through Settings > Account > Delete Account. Some records, such as purchase history, are kept as described in Section 6.
• Restriction: ask us to pause processing of your data while a dispute about its accuracy or our use of it is resolved.
• Portability: ask for the data you provided to us in a structured, commonly used, machine-readable format, or ask us to send it to another provider.
• Objection: object to processing we carry out on the basis of legitimate interests, including our usage analytics. If you object to analytics, we will stop associating usage data with you.
• Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect processing carried out before you withdrew it.

To exercise any of these rights, email support@troimarket.com. We will respond within one month, and will tell you if we need longer because the request is complex. We may ask you to confirm your identity before we act on a request.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

If you believe we have handled your data improperly, you have the right to complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EEA it is the supervisory authority in the country where you live or work.

9. Cookies and Local Storage

We do not use advertising cookies or third-party tracking cookies, and we do not load third-party analytics or advertising scripts on troimarket. We do use your browser's storage for our own purposes:

• Signing you in: Firebase Authentication stores session tokens so you stay signed in between visits.
• Your work and preferences: we save drafts of products you are still building, and one-time flags such as whether you have dismissed a notice.
• Getting around: while a tab is open we remember how you reached a storefront, so its Back button returns you to the right place. This is cleared when you close the tab.

Our own analytics store nothing on your device. The random identifier that groups one visit's events, and the page-variation label that goes with it, exist only in the page's memory and disappear when you reload or leave the page.

Seller page counts (Section 1) are kept whether or not your browser sends Do Not Track or Global Privacy Control, because they record nothing about you: only that a page was opened or a link pressed.

None of this is shared with third parties, and you can clear all of it at any time through your browser's site-data settings. During checkout, our payment partner Whop may use cookies or similar storage strictly necessary to process your payment securely. If you play a YouTube video embedded on a store, YouTube may store data in your browser once playback starts, under Google's privacy policy; we use YouTube's privacy-enhanced embed, which stores nothing until you press play.

10. Children's Privacy

troimarket is for adults only. You must be at least 18 to use it, and we do not knowingly collect personal information from anyone under 18. If we learn that we hold personal information about someone under 18, we close the account and delete the information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

12. Contact Us

If you have any questions about this Privacy Policy, or want to exercise any of the rights described above, please contact us at support@troimarket.com.

By post: troimarket, PO Box 811282, Los Angeles, CA 90081, United States.