This policy explains how Trilly handles personal information. It is written to meet the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), and to give people in the European Union and the UK the rights they have under the GDPR.

1. Who we are

Trilly, ABN 66 670 726 691, Suite 1208/530 Little Collins Street, Melbourne VIC 3000, Australia. For anything about privacy or your data, email privacy@trilly.io.

2. What we collect

What Examples Where it comes from
Account details Name, email, password (stored as a one-way scramble), profile photo, bio, location and country if you add them You
Sign-in and security Two-step login settings, the devices you're signed in on, and sign-in attempts (the email used, IP address and time) You and your browser
Maker details Whether your identity check passed and whether Stripe can pay you. Stripe collects your ID, selfie and bank details; we don't store them You, through Stripe
What you do on Trilly Skills you add, save, buy and review (with the version you reviewed); collections; posts and messages You
Linked AI apps Which AI apps you've linked, when each was last used, and the skills added through it Your AI app
Skill result notes "Used", "finished", thumbs up or down, "given up", the time, the AI app type, a fingerprint of the skill version, and a result's number when you say yes to sending it Skills you use, through your AI app
Copies downloaded without an account A scrambled code made from your rough network (the first part of your IP address), never the address itself Your browser
Feedback you choose to send Your words about a skill, with the version you had and the AI app it came from, or a suggestion for a company You, or your AI with your say-so
Payment records What you bought, when, the amount, your business name if you've added one in Profile and brand, and details Stripe shares with us: the name on the card, card brand, last 4 digits, card country and the results of its fraud checks. We never see your full card number Stripe
Purchase checks When you buy or look at a purchase: your IP address, browser and a random device code (a cookie) Your browser
Searches and requests What you search for on Trilly, and "Tell us what you need" requests, with email addresses and long numbers taken out. Not linked to your account, unless you're signed in and tick "Add my vote to it, and tell me here when there's a skill for it." Then we keep that you asked, so we can add your vote and tell you You
"Tell me when" requests When you ask us to email you once about a skill, an area or payouts (it's on sale, it's sold in your country, it works in your AI app, there's a skill for an area, or payouts open in your country): the skill, country, app or area, the words you agreed to and when You
Technical details IP address, browser type, the time zone your browser reports (kept with your account until you choose one, so times and emails arrive in your own time), pages visited, error logs Your browser
Messages to us Your name, email and message, from the contact form, the company form or email You
Profile and brand Your name, role, country, currency and how you like things written; your brand kit (business names and number, contact details, logos, colours, fonts, wording and templates) and changes you make for one skill. A company's brand kit is set by its owners, admins and brand managers You, or your company
Your apps The names of the apps you use, such as your AI app, email, calendar and accounting app, in My apps and for single skills. Never your sign-ins, and never whether an app is connected You, or your linked AI when you ask it
Your answer about your age That you said you're 18 or over, and when. We ask once before you add or buy a betting skill. Never your date of birth You
Licences for paid skills A licence number made at random, the skill and date, and records of where a paid skill was used: the linked app, a rough network and, sometimes, the country Trilly, when you get or use a paid skill
Trilly for Chrome Your sign-in for the extension, and the chat sites you allow (kept in your browser) You

What we never collect: what you type into your AI app, what your AI writes back, or the files you share with it. Skill result notes are designed so they can't carry that.

3. Why we use it

  • To run your account and the marketplace, and to deliver skills you add or buy (to perform our contract with you).
  • To work out each skill's public numbers, rank skills and spot fake activity (our legitimate interest in an honest marketplace).
  • To process payments, pay makers, prevent card fraud, answer card disputes, and meet tax and record-keeping duties (contract, legitimate interest and legal obligation).
  • To keep Trilly secure and fix problems (legitimate interest).
  • To tell you when a skill you have gets a new version, in the app and by email (turn the email off in your notification settings, or with the link in each one), and to keep giving you a retired skill's last version (to perform our contract with you).
  • To send emails you've asked for, such as skill updates. You can unsubscribe at any time (consent).

We don't sell personal information, and we don't use it for advertising. We don't use advertising trackers or an analytics service.

4. Skill result notes, in more detail

Each copy of a skill carries a private code. After a task, the copy can send a short result note to Trilly. Notes are tied to that copy and, if you're signed in, to your account. We use them to show public numbers such as "7 in 10 still use it a month later". Public numbers are always totals; they never show you on your own.

If a skill measures a result for you (for example, money saved), your AI should show you the number first and send it to Trilly only if you say yes. Trilly keeps that one number with the skill's version, your copy and the time, as it keeps a result note, and deletes it after 400 days. Never the data it came from. A result shows on a skill's page only once 20 people have sent theirs, as the middle value, never yours on its own. Turning reporting off for a skill stops these too.

You can turn reporting off for any skill in privacy settings. Your use then won't count in public numbers.

Some use never counts, so nobody can push a skill's numbers up: the maker's own copies, copies belonging to people at the company that made the skill, and more than 2 copies of a skill downloaded without an account from the same network in 30 days. To tell those copies apart, a copy downloaded without an account keeps a scrambled code made from your rough network, never your IP address. The key that makes the code changes every day and is deleted after 30 days, so after that the code can't be linked to any network.

5. Feedback text is opt-in

Feedback in words, whether you type it on Trilly or your AI drafts it for you, is only sent when you agree to send it. Your AI should show you the words first. Feedback goes to the skill's maker and, if you tick the box, may be shown on the skill's page without your name.

6. Who we share it with

  • Makers see your display name and reviews, and the feedback you choose to send them. They see usage only as totals.
  • Companies whose products a skill works with see only totals, four weeks at a time, and only once at least 50 people took part. Each number about use covers at least 50 people, and each number or theme from the feedback people chose to send them covers at least 10. They never see you on your own unless you choose to send them something, such as a suggestion.
  • Companies that help run Trilly, under contracts that protect your information. They're listed in the next section.
  • Your bank, through Stripe, if you dispute a payment. We send the records of that one purchase, so your bank can decide fairly.
  • AI apps you link to Trilly get your profile and brand kit only if you let that app see them, so the skills you use can write in your name, spelling and style. Your company's brand kit goes only to its own people, for work they do through the company. You can change what each app sees in Linked AI apps.
  • AI apps you link to Trilly also see the names of the apps you use for each skill (My apps), so the skill uses your email or calendar app, or gives you copy-ready text when you use none.
  • Authorities, when the law requires it.

7. Where your information is stored and processed

Some of the companies that help run Trilly store or handle personal information outside Australia:

Who What they do for Trilly Where
Amazon Web Services Our servers, database and file storage United States (N. Virginia)
Amazon CloudFront, part of Amazon Web Services Delivers images and files quickly Copies are kept for a short time in data centres around the world
Amazon SES, part of Amazon Web Services Sends the site's emails, such as email confirmations, password resets and receipts United States
Fastmail Hosts our own mailboxes, so it holds the emails you send us Australia, with servers in the United States
Stripe Payments, payouts and makers' identity checks. Trilly never sees your full card number Australia and the United States
Anthropic Automated safety reviews of the skill files makers upload. Only the skill's own files are reviewed, never anyone's conversations with their AI United States

We take reasonable steps to make sure these companies protect your information to the standard of the APPs. For people in the EU and UK, we rely on standard contractual clauses (and the UK addendum) or another lawful transfer method.

8. How long we keep it

What How long
Account details While your account is open. When you close it, we remove your name, email, photo and profile straight away, and the account becomes an anonymous "Former member"
Saved skills, follows, collections, feedback you sent, sharing choices Until you delete them, or until you close your account
"Tell me when" requests Until you close your account. Unsubscribing from these emails cancels the ones still waiting
Sign-in attempts 180 days, and deleted straight away when you close your account
Signed-in devices Deleted 30 days after you sign out of them or they expire
Links and invites we email you Deleted 30 days after they're used or expire
Accounts never confirmed If you never confirm your email, we remove your details 30 days after you sign up
Reviews and posts Until you delete them. They're hidden when you close your account
Skill result notes 400 days. After that we keep only daily totals for each skill, AI app and version, with nothing about you. If you close your account sooner, they're no longer linked to your name or email
The scrambled network code on copies downloaded without an account 30 days. The key that makes it is deleted then too, so the code can't be linked to a network
Feedback for companies Your words: 1 year. Weekly totals with no names: 2 years
Payment and payout records, and the purchase checks made when you bought At least 7 years (Australian law for company financial records). Receipts stop showing your name and business name when you close your account
The record of what you did with a purchase (views, downloads, refund requests) 2 years
Searches 180 days, not linked to you
"Tell us" requests you asked to be told about Linked to you until Trilly puts the request on a board or declines it, and for no more than 180 days. The request itself stays, not linked to you
How skill maps look for you Until you change it, or until you close your account. The look cookie, if you choose "Always show maps this way": 12 months in your browser
Your apps (the names of the apps you use) Until you change them, or until you close your account
Your answer that you're 18 or over Until you close your account. If you answered while signed out, only in your browser until you close it
Linked AI app sign-ins Access codes are deleted a day after they expire. Longer-lasting codes are deleted 30 days after they expire or you disconnect the app
Messages to us Messages through our contact and company forms: 2 years after you send them. Emails to our mailboxes: as long as we need them to help you. Email privacy@trilly.io to have yours deleted sooner
Company page claims that weren't finished Deleted 90 days after they expire or are turned down
Emails that bounced or were marked as spam The record: 90 days. A note to stop emailing that address stays until it's fixed or you close your account
Emails we're sending you The address and content until the email is sent (usually seconds). One we couldn't send after three days of tries: 30 days
Server logs (pages visited, errors, a shortened IP address) 30 days
Licences for paid skills, and the scrambled marks in your copy While you have the skill, and 7 years after (with your purchase records)
Where a paid skill was used (linked app, rough network, country) 30 days
Shared copies we found, and what we did about them 2 years
Your profile and brand kit Until you change or remove them, or until you close your account. Your files are deleted with them
A company's brand kit While the company keeps it on Trilly. It stays when one person in the company closes their account
New versions we email you about Which skill and version: 7 days after the email, and deleted straight away when you close your account
Retired skills you keep While your account is open, so you can keep using the version you had. Deleted straight away when you close your account

9. Keeping it safe

Your browser and your AI app reach Trilly over HTTPS. Inside Amazon's network, the last step to Trilly's server isn't encrypted yet; that's planned. Stored files and the off-site backup copies are encrypted. The database server's own disk isn't encrypted yet. Encrypting it is planned. We scramble passwords and access codes so they can't be read back, limit who on our team can see personal information, and keep an audit log of sensitive actions. No system is perfect: if a data breach is likely to cause you serious harm, we'll tell you and, where the law requires, the Office of the Australian Information Commissioner. For people in the European Economic Area (the EU plus Iceland, Liechtenstein and Norway) or the UK, if a breach puts them at risk, we'll tell the data protection authority where they live (in the UK, the Information Commissioner's Office), within 72 hours where we can, and we'll tell the people affected.

10. Your rights

You can:

You can also email privacy@trilly.io for any of these. In the EU and UK you also have the right to data portability and to complain to your local data protection authority.

11. Cookies

We only use the cookies Trilly needs to work. See our cookie policy.

12. Children

Trilly isn't for children under 16, and we don't knowingly collect their information.

13. Questions and complaints

Email privacy@trilly.io, or use the contact page and choose "Privacy or my data". We'll reply within 30 days. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

14. Trilly for Chrome

Trilly for Chrome lets you use your Trilly skills in AI chat sites, such as Claude, ChatGPT, Gemini and Microsoft Copilot. You pick a skill in Trilly's side panel. Trilly puts it in the chat site's message box. Nothing is sent to the chat until you press Enter yourself.

What the extension never does

  • It never reads your conversations, your drafts, or anything else on the pages you visit.
  • It never collects your browsing history, and it can't see which sites you visit.
  • It has no ads, no tracking and no analytics, and it shares nothing with other companies.
  • It never buys anything. Purchases only happen on trilly.io.

When it touches a chat site

Trilly can only type into the chat sites you allow, one by one, in the extension's settings or when Chrome asks you. You can remove a site at any time. When you press Use this skill, a small piece of the extension runs on that page once. It finds the message box and puts the skill's text in it. It doesn't read what is already there, and it stops straight away. Trilly also works on the page you were on when you opened it from the toolbar or the right-click menu.

What goes to Trilly, and when

What When Why
Your sign-in (a code Trilly gives the extension when you say yes) Every time the extension asks Trilly for something To show your skills and settings. It works like a linked AI app: it appears in Linked AI apps, and you can disconnect it there
Which skill you used Only when you press Use this skill To give you the skill's approved text. Trilly records that the skill was served, the same as for a linked AI app
Your answer to "Did it help?", and an optional note Only when you press Yes, No or Send note To keep public numbers honest and to help the maker. Notes go to the skill's maker
Settings you save for a skill Only when you press Save settings So your AI can use them
Words you select on a page Only when you right-click them and choose "Search Trilly for a skill" To search Trilly. Only the selected words are sent, nothing else from the page

What stays in your browser

  • Your sign-in codes. The short-lived code is kept in memory and is cleared when Chrome closes. The longer-lived code is encrypted before it is saved on your computer. Anyone using your computer while you are signed in to Chrome can still use the extension, as with any app.
  • Your choices, such as which chat sites are allowed and whether to ask "Did it help?".

Signing out and removing it

Sign out in the extension's settings. Trilly then ends the extension's sign-in, so its codes stop working at once. You can also disconnect it in Linked AI apps. Removing the extension from Chrome deletes everything it kept in your browser.

The same rules as the rest of this policy apply to the information Trilly receives: where it is stored (section 7), how long it is kept (section 8) and your rights (section 10).

15. Licences and protecting paid skills

When you get a paid skill, Trilly gives you a licence for it. Licences help stop paid skills being passed around, which takes money from the people who make them. Honest use is never affected.

What a licence holds

What Why
A licence number, made at random. Never your email To tell which licence a shared copy came from
The skill, its version and the date So you, and anyone you show it to, can check the licence
Your display name, only in the licence file inside your own download So it's clear the copy is yours

Anyone can check a licence number at trilly.io/licence. That page shows only whether the licence is valid, the skill and the date. It never shows your name, email or account.

Marks in your copy. Each paid copy has a few visible marks unique to your licence: a line in the skill's details, a short note at the end, and a sentence in a file the skill doesn't need to read. They don't change what the skill does. We keep only scrambled (hashed) versions of the marks, linked to your licence.

Looking for shared copies. We look for these marks, and for text from paid skills, in public places such as public code on GitHub, and we check text people send us. We only use those sites' official search tools, within their rules. If a copy matches a licence, Trilly checks it before anything happens. We may then tell the skill's maker that a shared copy was found (not who you are) and ask the site to take it down. If we confirm the copy came from your licence, we may stop updates and connector access for that licence, and we'll tell you how to sort it out.

Shared sign-ins. Each time a paid skill is used through your Trilly connection, or downloaded, we note the linked app, the time, a rough network (the first three parts of the IP address, never the full address) and, when our network provider tells us, the country. Never your precise location. If the pattern looks like one licence being used by several people at once, we may ask you to confirm it's you, or limit how many apps can use that skill at the same time. We always tell you why and how to get back in. These records are deleted after 30 days.