PRIVACY
POLICY

This version has been superseded and is published only so that anyone who accepted it can still read what they agreed to. It is not the version in force.

If this document and the software ever disagree, the software is wrong: privacy@trlly.co.uk.

The short version

You can read Trlly's price history without an account, and we hold nothing about you.

With an account and contribution switched on, we hold your email, your settings, what you watch, the product prices your browser saw, the items in your basket, and — new in this version — your Ocado purchase history: what you bought, when, and what you paid. Your purchase history is used only to show you your own shopping and is never sold. We do intend to sell aggregate insights built from basket data; that is switched off today and turning it on requires your fresh agreement.

Everything is deletable, and deleting takes one click.

1. Who we are

Trlly is the data controller for everything described here. Contact: privacy@trlly.co.uk.

2. Without an account

Nothing. No account, no profile, no contribution, no tracking of you across the web. The extension runs only on www.ocado.com.

3. With an account

4. Contributions

Covered in full by the contribution terms. In summary: publicly displayed Ocado product and price information, page-type and parser provenance, timestamps, a pseudonymous contributor identifier, the contents of your basket, and the lines of your own past orders.

No credentials, no personal details held by Ocado, no delivery address, no delivery slot or instructions, no payment data, no raw order number, and no browsing outside www.ocado.com.

Price observations are kept as product facts for as long as the price history is useful. Your link to them is severed when you delete your account.

5. Which Ocado pages the extension reads

Purchase-history collection reads exactly two addresses:

• ocado.com/orders
• ocado.com/orders/<order number>/details

Every other page is excluded by address and is never opened by the collector at all — in particular ocado.com/orders/<order number>/delivery, which is where your delivery address and delivery instructions are rendered, along with /checkout, /checkout/summary, /failed-payment/..., /addresses and /settings/....

This is an allowlist rather than a filter, deliberately. A filter that removes address fields stops working the moment a field is renamed, and does so quietly. An allowlist that does not name a page cannot read it, whatever changes.

Trlly's own interface (badges, graphs, savings) may still be displayed on other Ocado pages. Displaying something in your browser and transmitting it are different acts, and only the second one is what this section is about.

6. Your shopping, specifically

Basket and order lines are stored against your account, not pseudonymised, because the features only work if we can show you your own shopping. Database row-level security restricts every row to the account that owns it, and the write path derives your identity from your signed-in session rather than accepting it as an input.

A food shop can reveal medication, allergies, religious dietary choices, pregnancy and alcohol use. Repeat purchases across three months of orders reveal it more reliably than a single basket does. We do not try to infer any of that, and we will not build products that do. We describe it here so the decision to share it is an informed one.

7. Commercial use of aggregate data

Your purchase history is not part of this and never will be. It is not sold, transferred, shared, or aggregated into anything we sell. There is no view in the database that reads it, and the migration that creates it fails if one is ever added. This is not a promise we chose to make generously: the Chrome Web Store Limited Use policy prohibits transferring or selling user data to third parties, its exceptions do not cover this, and it explicitly does not treat your consent as one. We could not sell it even if you told us to, so we do not ask.

Separately, we intend to sell aggregate reports built from price observations and basket contents — price and promotion patterns, availability, and which products are bought together — to brands and manufacturers.

That is switched off. While it is off, the commercial views return no rows.

When it is switched on it will be constrained by properties of the database, not by this paragraph:

• no account id, contributor id or hash of either in any commercial view
• baskets grouped by a scrambled, non-reversible key, so "bought together" is countable without anyone being identifiable
• dates rather than timestamps
• any product appearing in fewer than five distinct baskets excluded entirely

Turning it on requires a new version of the contribution terms and your fresh acceptance. We do not sell contributor-level records.

Once an aggregate figure has been published, deleting your data removes you from future reports but cannot retract one already issued.

8. Rate-limit and audit records

Every ingestion request is recorded: the source, a pseudonymous contributor hash, how many items were sent, how many were accepted, duplicated or rejected, and the time. These exist to enforce rate limits, investigate abuse, and prove that accepted contributions had consent. They hold no product, basket or order content.

9. Who else sees your data

• Supabase hosts our database, authentication and functions (EU, London region).
• Stripe would handle billing, but billing is disabled and no payment data exists.
• Nobody else. We do not use advertising or analytics SDKs in the extension, and we do not sell or share data that identifies you.

10. Your rights

Access, correction, erasure, restriction, objection, portability, and the right to withdraw consent at any time. Most are self-service in the extension:

• See what you've agreed to: the consent screen.
• Stop contributing: the contribution switch. Immediate.
• Delete your baskets: one action, deletes every stored basket line.
• Delete your order history: one action, deletes every stored order and line.
• Delete everything: delete your account.

For anything else, email privacy@trlly.co.uk. If you're unhappy with how we've handled it, you can complain to the Information Commissioner's Office (ico.org.uk).

11. Security

Row-level security on every table, so a member's rows are reachable only by that member. Anonymous clients hold no write permission anywhere. Extension clients never write to tables directly — everything goes through validated functions that take your identity from your session, never from the request body. Authentication tokens never pass through Ocado or any third-party site.

12. Changes

Every version is stored with its full text and a checksum. Material changes get a new version and, where consent is the basis, a fresh request for your agreement. Versions 1.0.0 and 1.1.0 stay on record for anyone who accepted them.

13. Contact

• Privacy and data requests: privacy@trlly.co.uk
• Anything else: support@trlly.co.uk