Privacy Policy

Last updated: 15 October 2026

1. Who is responsible

Troll Softworks is the name under which Šimon Svoboda, a private individual from the Czech Republic, publishes his software. It is not (yet) a registered company; if that changes, this policy will be updated to name the new operator. For the purposes of the EU General Data Protection Regulation (GDPR), the controller is:

Šimon Svoboda, Czech Republic
Email: simon.svoboda@trollsoftworks.com

Questions about privacy go to the same address and reach me directly.

2. Your data in TrollFit

All calculations in TrollFit — fitting, uncertainties, plots, exports, digitizing images — happen locally in your web browser. The numbers you type or paste, the files you open, the images you digitize and the figures you export are not sent to us or to anyone else. We have no access to them.

To keep your work safe between visits, TrollFit saves it, together with your preferences (for example the light or dark theme), in your browser’s local storage, which lives only on your device. You can remove it at any time with “Start over” in the app or by clearing your browser’s site data.

3. TrollFit accounts

TrollFit is used with a free account. An account is a random 16-digit account number that we generate for you. The account itself contains no email address, name or any other detail about you. During the beta by invitation, you ask for a number by email and we send it to you in our reply (see section 5).

• What we keep for each account: a one-way cryptographic fingerprint of the account number (a keyed hash — the number itself is never stored and cannot be calculated back from it), its last four digits (so that you can recognise your account), the date it was created, the version of the Terms of Use you accepted and its status (for example active or blocked). We do not record when or how often you sign in.
• Signing in: when you sign in, your browser receives a signed session cookie that keeps you signed in for up to 120 days. It contains only the fingerprint of your account and an expiry date.
• Protection against abuse: to limit repeated sign-in attempts and mass creation of accounts, we count attempts per network for one hour. The counter is stored under a keyed hash of your IP address, never the address itself, and is deleted automatically after about an hour. Creating an account may be protected by Cloudflare Turnstile, a privacy-friendly check that tells people from bots without puzzles and without tracking you across websites.
• Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in protecting it from abuse (Art. 6(1)(f) GDPR).
• Where: account records are stored in Cloudflare Workers KV, operated by Cloudflare, Inc.
• How long: until you delete your account. You can do that yourself at any time on the account page, with immediate effect.

The account database does not know who you are, so an account can be found only by its number. If you lose the number, nobody — including us — can recover it; during the beta you can ask us for a new one.

4. Visiting this website

This website and TrollFit are delivered by Cloudflare, Inc. To deliver the pages and protect them against attacks and abuse, Cloudflare processes technical data that every browser sends, such as your IP address, the time of the request, the requested page and your browser type. This data is kept in short-lived server logs and is not used to identify you.

Legal basis: our legitimate interest in running a secure and working website (Art. 6(1)(f) GDPR).

Fonts and images are served from this website itself — your browser does not contact Google Fonts or other third parties. Only the account page may load Cloudflare Turnstile (see section 3). Our Instagram link is an ordinary link; if you follow it, Instagram’s own privacy policy applies.

5. Writing to us

If you email us, we use your email address and the content of your message to reply and to handle your request. Our mailbox is provided by Apple (iCloud Mail). We keep the correspondence as long as needed to deal with it and delete it at the latest two years after our last contact, unless it is needed to protect legal claims. Requests for beta access are treated the same way. Because we send your account number in our reply, the number is part of that correspondence; we do not keep any other record of who received which number, and the account database contains no email addresses. You can ask us at any time to delete the correspondence — the account keeps working.

Legal basis: our legitimate interest in answering your message (Art. 6(1)(f) GDPR).

6. Who else processes data

We do not sell or pass on personal data. We use two service providers:

• Cloudflare, Inc. (USA) — hosting of the website and the app, account records and protection against attacks (including Turnstile). Cloudflare acts as our processor under its Data Processing Addendum, which is part of its customer agreement.
• Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., USA) — our email inbox (iCloud Mail), under Apple’s iCloud terms and privacy policy. Only emails you send us are stored there.

Where data may be transferred to the United States, the transfer relies on the EU–US Data Privacy Framework (under which Cloudflare, Inc. is certified) or on the European Commission’s Standard Contractual Clauses used by these providers.

7. Cookies and local storage

We use one cookie: the strictly necessary session cookie that keeps you signed in (section 3). Cloudflare may additionally set a strictly necessary security cookie to tell people from bots. TrollFit stores your work and preferences in your browser’s local storage (section 2).

We use no analytics, advertising or tracking cookies, which is why there is no cookie banner. If we ever add privacy-friendly visitor statistics, this page will say so first.

8. Your rights

Under the GDPR you have the right to access, correct and erase your personal data, to restrict or object to its processing, and to data portability. In practice, the only data linked to your account is described in section 3, and you can delete the account yourself on the account page. For anything else, write to simon.svoboda@trollsoftworks.com; to let us find a specific account, you would need to give us its number. We reply within one month.

You also have the right to lodge a complaint with a supervisory authority — in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

9. Security

The website and the app are served only over encrypted connections (HTTPS). Account numbers are never stored, only keyed fingerprints that are useless without a secret key kept separately; session cookies are signed and cannot be read by scripts. Only the operator has access to the systems. If a security incident ever affected personal data, we would act as the law requires, including informing the supervisory authority.

10. Changes to this policy

When this policy changes, we update the date at the top. Because we have no way to email you, significant changes are announced on this website and in TrollFit before they take effect. If TrollFit is taken over by a company set up to run Troll Softworks, account records would pass to it under this policy, and we would announce this in advance.