Privacy Policy

Trocaly (Make the World Better), operated by Floyd Xiao as a sole proprietor in Ontario, Canada. Written to follow Canada's PIPEDA principles.

Effective November 6, 2026.

What we collect

• Account basics: your name, email address, and the city/neighbourhood you exchange in.
• Postal code: when you join, we ask for your postal code (in the United States, your ZIP code) — giving it is optional. We use it to show your general area and to run Trocaly where you live. Other members see only the first three characters of it (for example, "M4E" — or "750" from a US ZIP code) as your area — your full postal code is never shown to other members.
• Service fees and payments: when an exchange completes, the member who claimed pays a small service fee. You never need a card on file with us: you pay the fee on Stripe's own secure page when the exchange completes, and Trocaly never sees or stores your full card number. If the credits are released on their own after 24 hours and the fee is still unpaid, it stays as a balance you can pay any time from your Profile, and claims of 50 credits or more pause until it's paid. If you choose to save a card, Stripe holds it and future fees are charged to it automatically; we store only the card's brand and last 4 digits so you can recognize it. We keep records of the fees paid and the exchanges they belong to. Service fees are not collected yet.
• Exchange activity: your listings, claims, credit balance and history, show-up record, and feedback — this is what makes the credit system and community trust work.
• Messages and reports: messages you send in the app and any problem reports, so we can support exchanges and keep the community safe.
• Basic technical data: device and log information needed to run and secure the service.
• Notifications: If you turn on notifications, your browser shares a delivery address and security keys for your device with us so we can send them. We keep them only while notifications are on for that device, and turning notifications off removes them.

How we use it

To run your account and the credit system; to show your listings and profile (first name, city & neighbourhood, area, listings, show-up record, feedback) to other members; to prevent fraud and no-show abuse; to send service emails (receipts, exchange updates, account notices); and to improve Trocaly. We do not sell your personal information. We do not use it for third-party advertising.

What other members see

Your first name, city & neighbourhood, area (the first 3 characters of your postal code or ZIP), listings, show-up record, and feedback. Your email address, payment details, and exact address are never shown to other members. Arrange meeting points — not home addresses — for pickups whenever practical.

Reports and evidence

When you report a member, a listing, or an exchange, we receive what you write, any messages you choose to share from a conversation, and any photos you attach as evidence. We use them only to review that report. Evidence is visible only to the person reviewing it, is never shown to the member you reported, and is deleted about 90 days after the report is closed, unless we must keep it for an appeal or a legal reason. We do not read your private chats — the only chat messages we can see are the ones you send us in a report, and the messages in an exchange chat when that exchange is reported.

Trocaly Support chats

The in-app Trocaly Support chat is different from chats between members. When you use it, you are writing to Trocaly itself: the Trocaly team can read the whole support conversation — that is how they help you — and this section, not the "we do not read your private chats" promise above, is the one that covers it. That promise still stands in full for chats between members: those are never opened by us, except for messages a member chooses to share in a report.

Support chats are answered first by an automated assistant. To produce an answer, the text of your support conversation is sent to Cloudflare Workers AI, the AI service of Cloudflare — the company that already hosts Trocaly — which processes it on Cloudflare's network to generate the reply. Cloudflare states that for standard requests like these it does not keep the text sent or the reply after the request is finished (with limited exceptions, such as for security), and that it does not use content processed by Workers AI to train AI models. We do not attach your email address, your postal code or your payment details to these requests, and the assistant cannot see your account — it receives only what you write in the chat, so please never type a password, sign-in code or card number — it answers from Trocaly's Help and rules, and it cannot move credits or change anything. If you attach a photo or screenshot to a support chat, you are choosing to share it with the Trocaly team for review; please check it does not show anything you do not mean to share. Anything the assistant cannot decide is passed to the Trocaly team with a summary, and a person replies in the same chat.

We keep support photos for 90 days after the conversation closes, then delete them (the message stays, marked as a photo that was deleted). We keep the written support conversation for 12 months after it closes, then delete it. Support records that become part of a report follow the report rules above.

Who else receives data

Only the service providers needed to run Trocaly (such as Stripe for payments and our hosting provider), under their own privacy and security obligations, and authorities when the law requires it.

Email and our email provider

Trocaly's emails are sent by Resend, our email delivery provider. To deliver an email, Resend receives your email address, your first name, and the message itself (for example, a verification or password-reset link). Resend processes that data only to send Trocaly's email, under its own privacy and security obligations.

Most Trocaly email is transactional — verifying your address, resetting your password, and keeping your exchanges moving. Those messages are part of running your account and do not need separate consent. Every Trocaly email identifies us as the sender (Trocaly — Make the World Better, operated by Floyd Xiao in Ontario, Canada) and gives our contact address, support@trocaly.com.

News emails are optional. We send occasional news emails only if you ticked the consent box when you joined (we record that consent and when you gave it, as Canada's anti-spam law requires). Every news email carries a working unsubscribe link, and unsubscribing never affects your transactional account emails.

When you join, we also record the country you select. It is used to run Trocaly where you live — including charging any service fee in your own currency — and it is shown only to you, never on your public profile.

Keeping and deleting data

We keep account and exchange records while your account is active and for a reasonable period afterward for accounting and dispute purposes. You may ask us to correct your information or delete your account; credit-history records tied to completed exchanges may be anonymized rather than erased where they affect other members' balances.

Your rights and contact

Under PIPEDA you may ask what personal information we hold about you and request corrections. Questions or complaints: email Trocaly support at support@trocaly.com (or use the in-app Help). If we cannot resolve a complaint, you may contact the Privacy Commissioner of Canada (priv.gc.ca).

Changes

We will announce material changes to this policy in the app before they take effect.