At Trolley, we are committed to protecting your privacy and being clear about how your information is handled. This Privacy Policy explains what we collect, how we use it, who we share it with, and how you can delete it when you use the Trolley shopping list app.
Information We Collect
We may collect the following types of information:
- Account information: When you sign up, we collect your phone number (used to sign you in via a one-time password) and, optionally, a display name and profile photo you choose to add.
- Shopping list data: The lists, items, groups, and related content you create and share within the app.
- Selected contact information: When you use list sharing, we collect the names and phone numbers of only the contacts you select as list members.
- Images: Any photos you upload, for example a profile picture or item image.
- Usage, device, and diagnostics information: Firebase Analytics collects app lifecycle and interaction events, a pseudonymous app-instance identifier, general device and app information, and approximate location derived from a masked IP address. Firebase Crashlytics and Performance Monitoring collect crash diagnostics and performance data to help us keep the app reliable. Trolley does not send phone numbers, names, one-time passwords, shopping-list text, AI chat content, notification content, or full request URLs to Analytics. Advertising-identifier collection, ad personalization, Google Signals, and Google Ads links are disabled.
Contacts and List Sharing
When you grant Contacts permission and use list sharing, Trolley reads contact names and phone numbers on your device so you can select list members. Only contacts you select are transmitted over HTTPS and stored on Trolley's servers as list-member records. Unselected contacts are not uploaded. Selected contact data is used only for list sharing and is retained until the member, list, or account is deleted. Contacts permission is optional.
A selected member's name and phone number may be visible to other participants of the shared list so they can identify and collaborate with that member.
How We Use Your Information
We use the information we collect to:
- Create and secure your account and sign you in
- Provide, sync, and improve the shopping list features
- Power the in-app AI assistant that helps you build and organize lists
- Communicate with you about the service
- Analyze usage patterns to improve reliability and performance
Sharing Your Information
We do not sell or rent your personal information. We share information only with trusted third-party service providers who help us operate the app, and only to the extent needed to provide the service:
- AI assistant (OpenAI): When you use the AI assistant, the text of your request, such as item names and list context, is sent to OpenAI to generate suggestions. It is not used to identify you.
- Image hosting (Cloudinary): Photos you upload are stored and served via Cloudinary.
- SMS delivery: Your phone number is shared with our SMS provider solely to deliver one-time login codes.
- Analytics and diagnostics (Google Firebase): Google processes pseudonymous usage events, app and device information, approximate location, crash diagnostics, performance traces, and installation identifiers on our behalf to provide Analytics, Crashlytics, Performance Monitoring, Cloud Messaging, and Remote Config. We do not use Firebase data for advertising or ad personalization.
We may also disclose information if required by law.
Data Retention and Deletion
You can request deletion of your account and associated data at any time:
- In the app: Go to Settings → Account → Delete Account to open the deletion request form.
- By email: Contact us at contact@thankyoubhaiya.com and request deletion of your account and data.
Submitting the public form does not itself delete the account. We verify account ownership using the registered account; an authenticated deletion request enters the same manual processing queue. Verified requests are processed within 30 days. We review shared-list ownership and provider-hosted profile images before removing account data so another member's data is not deleted by cascade. Backup and provider copies follow their configured retention schedules, and limited records may be retained where required for legal or security reasons.
Google Analytics event-level data is configured for 2 months of retention and user-level data for 14 months. Crashlytics reports are retained for 90 days. Firebase Performance Monitoring retains IP-associated data for 30 days and installation-associated and de-identified performance data for 60 days. Access-controlled BigQuery exports remain until removed through our operational deletion process. Analytics is not linked to your Trolley account, so account deletion does not identify or immediately remove historical pseudonymous analytics data; it expires or is deleted under these retention controls.
Your Choices and Rights
Depending on applicable law, you may ask to access, correct, or delete your personal information, withdraw consent where processing relies on consent, or raise a privacy concern. Contact us using the email below. Withdrawing consent does not affect processing that was lawful before withdrawal.
Security
We take reasonable technical and organizational measures to protect your information from unauthorized access, use, or disclosure. However, no method of transmission or storage is 100% secure.
Children's Privacy
Trolley is not directed to children under 13, and we do not knowingly collect personal information from them.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post any changes on this page and update the "Last updated" date above.
Contact Us
If you have any questions or concerns about this Privacy Policy, please contact us at contact@thankyoubhaiya.com.