Privacy Statement

1. Who looks after your data

The person who invited you runs TrolleyList and is responsible for what it keeps. Ask them about any question on your data.

2. What is kept

Your account. Your username, and your password in a scrambled form that nobody can read back.

Your shopping. The trips you save: shop, date, items and prices. Your shopping list.

Your money entries. Regular payments, energy bills, car costs and anything else you add. Only names, amounts and dates.

Split bills (groups). The expenses of a group, how they were split, and payments that were written down. The shopping list of a group: what is on it, who gets each thing, and what is done. Expenses that are set to repeat, and when a reminder was sent.

Your email, if you give one. It is used to log in, to send you a link when you forget your password, to tell you when somebody adds you to a group, and for a reminder when somebody in a group you owe money to taps Remind (at most one a day from the same person). Nothing else is sent to it. You can take it off your account at any time, under Your email in the menu.

Invitations. The name you typed for an invite, the email address it was sent to, who made it, and which account used it.

Your area. If you say where you shop from: the town or the first half of the postcode, and how far you go. Never a whole postcode or an address.

Reports and suggestions. What you report or suggest to the person who runs the site, with the note you write, your username and the date. A closed one is deleted after six months.

Your budget. If you set a budget for the month: that one number.

Chat settings. What the chat needs to work for you. If you connect your own Claude key, that key is kept too.

3. Photos of receipts

A photo is read on the TrolleyList server itself. It is not sent to any other service to be read. From the photo the shop, the town or postcode area of the shop, the date and the items are kept.

If you connect your own Claude key to your account, your photos are sent to Anthropic (the Claude service) to be read, with your key.

How long the photo is kept. The photo stays on the TrolleyList server for 7 days and is then deleted. It is kept that long for one reason: so that a receipt that was read wrong can be checked. You see your own photo next to the form of that trip. Other members never see it.

What is counted. How the reading of each photo ended (read safely, to check, or sent back) is counted, so that the person who runs the site can see how well the reader works. The count does not say whose photo it was.

A name you put right. When you change the name of a line that was read from a receipt, the right name is remembered for that shop, so that the same line is read right the next time, for every member. Only the two names and the shop are kept: not who changed it, and not what was bought.

When you report a receipt. If you say that a receipt was read wrong, the person who runs the site looks at the photo and puts your trip right. To read it again they may give the photo to an AI service (Claude, by Anthropic), without your username. A photo you reported is kept until the report is closed, and then deleted when it is older than 7 days.

4. Who can see what

You see everything you saved.

Other members see shop names, where a shop is, and prices from everybody's receipts, to find the cheapest shop. They never see who paid them, your trips, or the area you shop from.

People in a group with you see your username, the expenses of that group, who owes whom, and the shopping list of that group with who takes what. When you split a receipt item by item, they see the name and the total of that receipt.

Notifications. When you do something in a group (add a thing to its list, take one, split a bill, write down a payment, join or leave), the other people of that group get a line about it under their bell, with your username. When a price you saved is lower than the last one in that shop, members who have that product on their list get a line that it is cheaper there: it never says who paid it. The lines are deleted after 30 days.

The person who runs the site can see every account and what it saved, to keep the site working. They see the photo of a receipt when you report it.

Your email is seen by you and by the person who runs the site, not by other members. One thing to know: when you add somebody to a group by their email and they have no account yet, the people in that group see that address until the person has signed up.

5. Where it is kept, and for how long

Emails are sent through a mail service (smtp.resend.com). It gets the address and the words of each email, and nothing else. For 60 days TrolleyList keeps a note of every email it sent: the address, what kind of email it was and when.

Everything else is kept on the private server of the person who runs the site, in the United Kingdom. It stays until you delete it or ask for your account to be deleted. A copy of everything is made once a day on the same server and kept for 14 days, so what you delete is gone from the copies two weeks later. One cookie keeps you signed in, for up to 90 days. The fonts and all other parts of the pages come from this server, not from another company. Distances are worked out on this server from a list of places that is part of the site: your area is not sent anywhere.

6. Your rights

You can ask to see what is kept about you, to have it corrected, to get a copy, or to have it deleted. Ask the person who runs the site. If you are not happy with the answer, you can complain to the Information Commissioner's Office at ico.org.uk.