# Trlly privacy policy

**Version:** `v1.2.0`
**Published at:** https://trlly.co.uk/legal/privacy-policy/v1.2.0
**Supersedes:** `v1.1.0` (2026-08-11) and `v1.0.0` (2026-08-11), which stay on record

If this document and the software ever disagree, the software is wrong:
privacy@trlly.co.uk.

---

## The short version

You can read Trlly's price history without an account, and we hold nothing about
you.

With an account and contribution switched on, we hold your email, your settings,
what you watch, the product prices your browser saw, the items in your basket,
and — new in this version — **your Ocado purchase history: what you bought, when,
and what you paid**. Your purchase history is used only to show you your own
shopping and is never sold. We do intend to sell aggregate insights built from
basket data; that is switched off today and turning it on requires your fresh
agreement.

Everything is deletable, and deleting takes one click.

---

## 1. Who we are

Trlly is the data controller for everything described here.
Contact: privacy@trlly.co.uk.

## 2. Without an account

Nothing. No account, no profile, no contribution, no tracking of you across the
web. The extension runs only on `www.ocado.com`.

## 3. With an account

| What we hold | Why | How long |
|---|---|---|
| Email address | Sign you in, send alerts if you turn them on | Until you delete your account |
| Password hash | Only if you chose a password. Handled by Supabase Auth; we never see the password | Until you delete your account |
| Display name, locale | Optional, shown in the interface | Until you change or delete it |
| Notification settings, alert threshold, contribution on/off | To behave as you asked | Until you delete your account |
| Consent records: which version you accepted, when, whether you withdrew | To evidence consent and to stop when you withdraw | Until you delete your account |
| Watched products and thresholds | To run price alerts | Until you remove the watch or delete your account |
| Price alerts generated for you | To show them and not repeat them | Until you delete your account |
| Basket contents: each product, quantity, unit price and line total, with the date | Your basket savings, and — in aggregate only — the commercial insights in section 7 | Until you delete your baskets or your account |
| **Purchase history: for each order, the date, and each line — product, quantity, price paid, line total, pre-offer price, and whether it arrived** | Showing you your own shopping: compare-at-price and your own price history. Nothing else — it is not sold and feeds no report | Until you delete your order history or your account |
| **A scrambled value standing in for your Ocado order number** | To recognise a re-capture of the same order. The order number itself never leaves your browser | Until you delete your order history or your account |
| Basket totals and item counts (no item identities) | The older, aggregate-only basket savings | Until you delete your account |
| Pseudonymous contributor identifier | To credit contributions without naming you | Cleared when you delete your account |
| Subscription state and Stripe identifiers | Billing. **Billing is disabled; no payment has been taken and no card data reaches Trlly** | Until you delete your account |

## 4. Contributions

Covered in full by the contribution terms. In summary: publicly displayed Ocado
product and price information, page-type and parser provenance, timestamps, a
pseudonymous contributor identifier, the contents of your basket, and the lines
of your own past orders.

No credentials, no personal details held by Ocado, no delivery address, no
delivery slot or instructions, no payment data, no raw order number, and no
browsing outside `www.ocado.com`.

Price observations are kept as product facts for as long as the price history is
useful. Your link to them is severed when you delete your account.

## 5. Which Ocado pages the extension reads

Purchase-history collection reads exactly two addresses:

- `ocado.com/orders`
- `ocado.com/orders/<order number>/details`

Every other page is excluded **by address** and is never opened by the collector
at all — in particular `ocado.com/orders/<order number>/delivery`, which is where
your delivery address and delivery instructions are rendered, along with
`/checkout`, `/checkout/summary`, `/failed-payment/...`, `/addresses` and
`/settings/...`.

This is an allowlist rather than a filter, deliberately. A filter that removes
address fields stops working the moment a field is renamed, and does so quietly.
An allowlist that does not name a page cannot read it, whatever changes.

Trlly's own interface (badges, graphs, savings) may still be displayed on other
Ocado pages. Displaying something in your browser and transmitting it are
different acts, and only the second one is what this section is about.

## 6. Your shopping, specifically

Basket and order lines are stored **against your account**, not pseudonymised,
because the features only work if we can show you your own shopping. Database
row-level security restricts every row to the account that owns it, and the write
path derives your identity from your signed-in session rather than accepting it
as an input.

A food shop can reveal medication, allergies, religious dietary choices,
pregnancy and alcohol use. Repeat purchases across three months of orders reveal
it more reliably than a single basket does. We do not try to infer any of that,
and we will not build products that do. We describe it here so the decision to
share it is an informed one.

## 7. Commercial use of aggregate data

**Your purchase history is not part of this and never will be.** It is not sold,
transferred, shared, or aggregated into anything we sell. There is no view in the
database that reads it, and the migration that creates it fails if one is ever
added. This is not a promise we chose to make generously: the Chrome Web Store
**Limited Use** policy prohibits transferring or selling user data to third
parties, its exceptions do not cover this, and it explicitly does not treat your
consent as one. We could not sell it even if you told us to, so we do not ask.

Separately, we intend to sell aggregate reports built from **price observations
and basket contents** — price and promotion patterns, availability, and which
products are bought together — to brands and manufacturers.

That is **switched off**. While it is off, the commercial views return no rows.

When it is switched on it will be constrained by properties of the database, not
by this paragraph:

- no account id, contributor id or hash of either in any commercial view
- baskets grouped by a scrambled, non-reversible key, so "bought together" is
  countable without anyone being identifiable
- dates rather than timestamps
- any product appearing in fewer than five distinct baskets excluded entirely

Turning it on requires a new version of the contribution terms and your fresh
acceptance. We do not sell contributor-level records.

Once an aggregate figure has been published, deleting your data removes you from
future reports but cannot retract one already issued.

## 8. Rate-limit and audit records

Every ingestion request is recorded: the source, a pseudonymous contributor hash,
how many items were sent, how many were accepted, duplicated or rejected, and the
time. These exist to enforce rate limits, investigate abuse, and prove that
accepted contributions had consent. They hold no product, basket or order
content.

## 9. Who else sees your data

- **Supabase** hosts our database, authentication and functions (EU, London
  region).
- **Stripe** would handle billing, but billing is disabled and no payment data
  exists.
- Nobody else. We do not use advertising or analytics SDKs in the extension, and
  we do not sell or share data that identifies you.

## 10. Your rights

Access, correction, erasure, restriction, objection, portability, and the right
to withdraw consent at any time. Most are self-service in the extension:

- **See what you've agreed to:** the consent screen.
- **Stop contributing:** the contribution switch. Immediate.
- **Delete your baskets:** one action, deletes every stored basket line.
- **Delete your order history:** one action, deletes every stored order and line.
- **Delete everything:** delete your account.

For anything else, email privacy@trlly.co.uk. If you're unhappy with how we've
handled it, you can complain to the Information Commissioner's Office
(ico.org.uk).

## 11. Security

Row-level security on every table, so a member's rows are reachable only by that
member. Anonymous clients hold no write permission anywhere. Extension clients
never write to tables directly — everything goes through validated functions that
take your identity from your session, never from the request body. Authentication
tokens never pass through Ocado or any third-party site.

## 12. Changes

Every version is stored with its full text and a checksum. Material changes get a
new version and, where consent is the basis, a fresh request for your agreement.
Versions 1.0.0 and 1.1.0 stay on record for anyone who accepted them.

## 13. Contact

- Privacy and data requests: privacy@trlly.co.uk
- Anything else: support@trlly.co.uk