Draft · not in forceVersion 0.3Last changed 2026-09-20

Cookie Policy

Troy sets no cookies on this site and runs no analytics. It saves the appearance settings you choose in your own browser, where they stay. This page lists exactly what is stored, what is not, where the site is served from — Vercel's Washington, D.C. region, in the United States — the one question about the host that is still open, and what has to happen before anything else, including the analytics chosen for launch and not yet installed, is added.

Who this applies to
  • Anyone who opens a page on troy-agency.com
  • Anyone who wants to know what this site puts on their device
  • The public website only — there is no Troy platform to sign in to yet
  • Every reader, wherever they are. Troy offers its services in Canada and the United States only, but this page describes the site the same way for anyone who opens it

In plain EnglishThis page is about what the Troy website puts on the device you are reading it on. Today that is one setting you chose yourself.

This policy covers troy-agency.com — the public website published by Troy Agency Inc., trading as Troy — and every page served from that address. It explains everything this site stores on your device, how long it stays, what reads it, and what it is for.

It also says where the site is served from. Troy is a Canadian business, and this site is hosted by Vercel Inc. in Vercel's Washington, D.C. region (iad1), in the United States, so the pages you read here are sent from servers in the United States rather than in Canada. clause 3.2 says what those servers see, and the Privacy Policy covers what happens to it.

It does not cover the Troy platform, because there is nothing to sign in to yet. When there is, this page will be updated before it opens, and clause 6.1 sets out what that update has to contain.

It does not cover what happens to information you deliberately send to Troy — an email, a brief, a request for a Troy Score. The Privacy Policy covers that, and the Sub-processors list names anyone who receives it.

In plain EnglishA cookie is sent back to a website with every request you make to it. Browser storage sits on your device and is only read when that site’s own code asks for it. This site uses the second kind, once, for the way the site looks.

Cookie
A small piece of text a website asks your browser to keep and send back with every later request to that website. Because it travels with the request, the site can tell one browser from another. A cookie set by the site you are visiting is first-party; one set by another company whose code runs on the page is third-party.
Local storage
A store your browser keeps for each website, filed under that website’s own address. It is not attached to requests, so it is not sent anywhere on its own. Only code running on that website’s pages can read it, and code on another website cannot.
Session storage
The same as local storage, except the browser empties it when you close the tab.
Strictly necessary
Storage without which something you actually asked for cannot work — staying signed in, a security check, or a setting you chose yourself using a control on the page. In the EU and the UK this is the only category of storage that may be set without asking first, and what falls inside it is judged case by case rather than settled by what a website calls it.
Non-essential
Everything else: analytics, advertising, measurement, personalisation you did not ask for, and anything that recognises you across visits or across sites. This needs consent in the EU and the UK, and an opt-out in several US states.

The distinction matters in law as well as in engineering. The EU and UK rules on this — Article 5(3) of the ePrivacy Directive, and regulation 6 of the UK’s Privacy and Electronic Communications Regulations — cover any information stored on or read from your device, not only cookies. Local storage is caught by them. So the question is never “is it technically a cookie”. It is “did the reader ask for this”.

Canadian law comes at it from the other end. Troy Agency Inc. is being incorporated federally, under the Canada Business Corporations Act, with its registered office in Ontario. A business operating in Canada that way comes within the Personal Information Protection and Electronic Documents Act — PIPEDA, the federal private-sector privacy law. PIPEDA regulates the collection, use and disclosure of personal information in the course of commercial activity, and generally requires that a person knows about it and consents to it; it does not legislate about storage on a device as such. Where storage on your device would collect personal information about you, the two sets of rules meet in the same question anyway. Whether a given rule applies to a given reader depends on facts this page cannot know, no lawyer has reviewed this, and nothing here claims that Troy complies with any of it.

One more Canadian statute is worth naming here, and only here. Canada’s Anti-Spam Legislation — CASL — is usually thought of as the law about commercial email, and that part of it is not about this page: it governs commercial electronic messages, and it is dealt with in the Acceptable Use Policy and the services agreement. But CASL also carries provisions about installing a computer program on another person’s device in the course of commercial activity, and guidance published by the CRTC discusses cookies and similar scripts as something a person may be taken to have consented to through their own conduct. How those provisions apply to an ordinary website page is a question for a lawyer rather than for this paragraph. CASL is named because this page is about storage on a device, no lawyer has reviewed it, and Troy claims compliance with CASL no more than with anything else here.

In plain EnglishOne setting, saved because you changed it: how the site looks. No cookies at all, first-party or third-party.

The table below is the complete list of what this site’s own code puts on your device. It was written by reading that code, and you can check it yourself in about ten seconds — see clause 8.

Everything this site puts on your device
Name or purposeWhat it holdsWhere it is storedHow long it staysDoes it identify you?
CookiesNothing. Troy sets no cookie of any kind, and no third party’s code runs on these pages to set one. Whether Vercel Inc., which serves this site from Vercel's Washington, D.C. region (iad1), in the United States, sets a strictly necessary cookie of its own once the site is deployed is the single question still open — see clause 3.2.NowhereNot applicableNo
Appearance preference, stored under the key “troy:appearance”Three settings you chose: theme (dark or light), density (how tight the spacing is) and accent colour. It is written only when you change one of them, never on arrival.Local storage in your browser, filed under this site’s own addressUntil you clear it. It has no expiry date, and Troy does not refresh or re-write it behind your back.No. It holds three short words, no identifier, and nothing about you.
Motion overrideNothing. The reduced-motion switch is deliberately never written to your device.In the open page onlyUntil you reload the page or close the tabNo
Your browser’s own cacheCopies of the pages, images, fonts and two short videos this site sent you, so a second visit is faster.Your browser’s cache, which your browser managesYour browser decides. Clearing your cache removes it.No. Troy cannot read it or see what is in it.

Nothing in that table is sent to Troy. The appearance preference is read by the page you are on, so it can draw itself the way you left it, and by nothing else.

Because nothing in that table reaches Troy, nothing in it reaches the rest of the group either — and that is worth spelling out, because the group is not held apart. Troy, Louin and Lunari Group share systems and data. Client data is held on systems Lunari Group runs, and the companies in the group can see each other's data. That applies to information you deliberately send — an email, a brief, a request for a Troy Score — and the Privacy Policy describes it, with Lunari Group named on the Sub-processors list as a processor of client personal data. Under PIPEDA, using someone’s personal information for a purpose they were not told about needs meaningful consent, and what makes this sharing lawful is not settled: To be completed: What makes the sharing lawful, and how is it disclosed? Under PIPEDA, using someone's personal information for a purpose they were not told about needs meaningful consent, and a Louin customer has not agreed to their data being used for Troy's marketing. This needs, at minimum: a written agreement inside Lunari Group, notice to the customers whose data moves, a way for them to say no, and a record of consent. This is the most serious open item on this page — the site now discloses the sharing, but disclosure alone is not a lawful basis.. None of it touches the appearance preference in the table above, which never leaves your browser.

In plain EnglishIt remembers dark or light, how tight the spacing is, and which accent colour you picked. That is the whole of it.

This site lets you change how it looks: a dark or a light theme, three spacing densities, and one of four accent colours. When you change any of them, the choice is written to your browser’s local storage under the key “troy:appearance” as a short piece of text naming those three settings. On your next visit the site reads it before the first frame is drawn, so the page does not appear in one theme and then snap to another.

It contains no identifier, no visit count, no date, no history and nothing about you. It never leaves your device: no code on this site sends it anywhere, and no request carries it. The only thing that reads it is the page in front of you, drawing itself the way you left it — Troy’s servers never receive it, so there is no copy for Troy, or for anyone else in Lunari Group, to look at.

Troy treats this as storage you asked for, because the only way it gets written is you operating a control that says what it does. Troy’s reading of the EU and UK rules is that a setting chosen that way does not need a consent banner. That is a reading, not a ruling: no lawyer has reviewed this page, and clause 4.1 sets out the reasoning at greater length so that you can disagree with it.

One setting is deliberately not stored. The site carries a motion switch that turns animation down, so the reduced-motion version can be seen without changing a system setting. That choice lasts for the visit only. Storing it once left the whole site standing still on later visits, with no visible reason and no obvious way back, so it is not written to your device at all. If you want reduced motion permanently, set it in your operating system: this site follows that setting, and it needs to store nothing to do so.

In plain EnglishYour browser caches files, as it does for every site. The server that sends you the page sees your request. Neither is a cookie, and neither is something Troy can read off your device.

Your browser keeps its own copies of what this site sends — pages, images, fonts, the two short videos — so a second visit is faster. That cache belongs to your browser. Troy does not control what is kept, cannot read it, and clearing it is entirely yours to do.

Serving you a page also means a server receives a request: your IP address, the page you asked for, the time, and what your browser says it is. That is true of every website. It is a consequence of asking for a page rather than something stored on your device, so it sits outside this policy. Those records are made by Vercel Inc., which serves this site from Vercel's Washington, D.C. region (iad1), in the United States, and they are kept for 90 days (a proposed default, not yet approved). What is done with them belongs in the Privacy Policy.

Where that server sits is worth stating outright. Troy is a Canadian business, and this site is served from the United States, so a request made from Canada to troy-agency.com leaves the country — and an IP address is generally treated as personal information in Canada. None of that is hidden from a reader who asks for it, and none of it should have to be worked out from a hostname. PIPEDA is generally understood not to forbid sending personal information out of Canada for processing: the Privacy Commissioner’s published guidance treats a transfer to a supplier as a use rather than a disclosure, and leaves the company that transferred it accountable for it. That is a description of published guidance, not a ruling, and no lawyer has reviewed how it applies here. The contractual route Troy expects to rely on is the Standard Contractual Clauses, with the UK Addendum where the United Kingdom is involved, entered into through each supplier's own data processing agreement (a proposed default, not yet approved); the Privacy Policy and the Sub-processors list are where it is set out, and nothing here claims the arrangement is compliant.

In plain EnglishNo analytics, no advertising pixels, no third-party cookies, no tracking between sites, and no consent banner, because there is nothing here to consent to.

  • No analytics. Nothing counts your visit, your scrolling, your clicks or how long you stayed. No analytics product is installed, and there is no code on this site capable of reporting a page view.
  • No advertising or tracking pixels. No advertising platform’s tag, no conversion tag, no remarketing tag, no tracking beacon of any kind.
  • No third-party cookies, because no third party’s code runs on these pages. A hosting provider can still set one of its own without any code on the page: this site is served by Vercel Inc. from Vercel's Washington, D.C. region (iad1), in the United States, and whether it does that on this project is answered at deploy — clause 3.2 holds that one question open rather than answering it early.
  • No cross-site tracking, no profiling, no audience building, no fingerprinting. The site does read two things your browser offers — whether you have asked for reduced motion, and whether you are using a mouse or a touchscreen — to decide how to animate. Neither is stored, combined with anything, or sent anywhere.
  • No selling or sharing of personal information, in the sense US state privacy laws use those words. Nothing this site stores on your device is sold, shared or handed to anyone, and nothing here is collected in order to be. That is a statement about device storage, not a claim that information stays inside one company: Troy is part of a group that shares systems and data, and clause 3 and the Privacy Policy describe it.
  • No session recording, no heatmaps, no A/B testing tool, no chat widget, no embedded social feeds, no comment system.
  • No consent banner, for the reason set out in clause 4.1.
  • No paywall, no sign-in and no account, so no session cookie, because there is no session.

Every one of those is a statement about this site as it stands today, and every one of them is checkable: open your browser’s developer tools, watch the requests the page makes, and look at what it has stored. If any of them stops being true, this page changes first — see clause 6.

In plain EnglishA banner asks permission for things you did not ask for. This site does none of them, so a banner would be theatre.

Under the EU and UK rules, consent is needed before storing or reading anything on your device unless the storage is strictly necessary for something you asked for. This site stores one thing, and only because you used a control that exists to set it. There is no analytics, advertising or measurement storage here to ask you about.

Troy will not show a banner asking for permission it does not need, and will not use a banner as cover for storage this page does not list. If non-essential storage is ever added, consent will be asked for properly: before anything is set, with refusing exactly as easy as accepting, with no pre-ticked boxes, and with the site working normally if you refuse.

That question arrives for real with analytics. The product chosen for launch is Vercel Analytics, which is cookieless and does not track anyone across sites (a proposed default, not yet approved) — that is the vendor’s own description of it, and it is the reason the product was chosen rather than a detail in its favour. It is not installed — see clause 6 — so nothing in this paragraph describes something running today. Troy’s reading is that measurement which stores and reads nothing on your device, and identifies nobody, does not need a consent banner in the EU or the UK, and that PIPEDA’s consent requirement is not engaged where no personal information is collected. That is a reading rather than a ruling, it depends on what the product actually does once it is switched on, and if it turns out to store or read anything on your device it goes in the table in clause 3 and consent is asked for wherever consent is required.

In plain EnglishCanada, where Troy is being incorporated, asks for consent to collecting information about you at all. Several US states give you a right to opt out. The EU and the UK want consent before non-essential storage, and are described here as context — Troy does not offer its services there. This page is written to the strictest of them, wherever you are.

Troy Agency Inc. is being incorporated federally, under the Canada Business Corporations Act, with its registered office in Ontario, so the privacy law it expects to answer to for personal information handled in commercial activity is PIPEDA, and the authority that supervises it is the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority. Troy offers its services in Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. Being Canadian does not settle everything that follows: several US states reach a business that handles their residents’ information wherever it sits, and the United States is one of the two places Troy sells into. So what follows describes rules that attach to you as a reader. The registered details are in the Imprint, and the fuller account of personal information is in the Privacy Policy.

Where two sets of rules differ, the intention is to write one page and follow the stricter one rather than the weakest one that applies. That is why this page describes a single behaviour for every reader instead of a different site depending on your address. It is a statement of how Troy intends to work, not a claim that any particular law has been complied with.

In plain EnglishTroy does not offer its services in the EU or the UK yet, so the rules there are described as context. You can read this site from anywhere, and the one thing it stores is not personal data and never reaches Troy.

The starting point in the EU and the UK is that consent is required before anything non-essential is stored on or read from your device, and it has to be freely given, specific, informed and as easy to withdraw as it was to give. Strictly necessary storage does not need it, and neither does a preference you set yourself using a control on the page. That standard is the one this page is written to for every reader, which is why the same behaviour is described wherever you are.

Troy sells in Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. This page is readable from anywhere, and no part of it is switched on or off by where you are, but a reader in the EU or the UK should not take the paragraph above as a claim that Troy has assessed whether the GDPR or the UK GDPR reaches it. It has not, no lawyer has looked at the question, and the honest answer today is that Troy is not selling into those markets.

That also answers the representative question. Where a company outside the EU or the UK offers goods or services to people inside them, or monitors their behaviour there, the GDPR and the UK GDPR each require it to appoint a representative there and to publish who that is. Troy does neither, so the obligation is not engaged today. For the EU: none appointed. Troy does not offer its services to people in the European Union, and will appoint a representative there before it does. For the UK: none appointed. Troy does not offer its services to people in the United Kingdom, and will appoint a representative there before it does. The Privacy Policy is where each would be named.

On the site itself there is little to ask about in any event. The appearance preference is not personal data: it identifies nobody, and Troy never receives it. There is nothing in it to request a copy of, object to, or ask to have erased. Clearing your browser storage removes it, and no copy exists anywhere else to chase. Anything you deliberately send Troy is different, and the Privacy Policy covers it.

In plain EnglishOne of the two places Troy sells in, and where this site is served from. You can tell a business to stop selling or sharing your information; here there is nothing to sell, and nothing is offered to you or withheld from you for asking.

Troy offers its services in Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. The United States is one of those two, and it is also where this site is served from, by Vercel Inc. in Vercel's Washington, D.C. region (iad1), in the United States.

California’s privacy law, and the laws of a growing number of other states, work by opt-out rather than by consent. You may tell a business to stop selling your personal information, or sharing it for cross-context behavioural advertising, and in California a business that does either has to honour an opt-out preference signal such as Global Privacy Control.

Today this site neither sells nor shares personal information in the sense those laws use the words, and sets nothing that could be used for advertising anywhere. There is nothing to opt out of. clause 9 says what Troy will do with those signals if that ever changes. What Troy does with information you send it, including inside the group it belongs to, is the Privacy Policy’s subject rather than this page’s.

Nothing on this page is a notice of financial incentive, and there is no discount, reward or worse service for anyone who refuses storage, blocks it, or sends a privacy signal.

In plain EnglishThe answer is the same wherever you are reading from. If your own country gives you more than this page describes, your country wins.

Canada, Australia and most other countries regulate the personal information a site collects rather than the act of storage itself. In Canada that is PIPEDA, which turns on knowledge and consent for collecting, using or disclosing personal information in commercial activity, and it is also the law Troy expects to be subject to. Quebec’s Law 25 sets its own rules, including rules about technology used to identify, locate or profile a person, and it may apply to you if you are in Quebec; whether it does depends on facts, Troy has not assessed the question, and Troy does not claim to comply with it. Since this site collects nothing through storage, the practical answer is the same everywhere: nothing on this page depends on where you are reading from.

Troy offers its services in Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. A reader anywhere else is reading rather than buying, and the site behaves the same either way, as does this page.

Where a rule in your country gives you more than this page describes, that rule wins. Troy will not argue that a policy page overrides a law.

In plain EnglishAnalytics and a working form are both coming. Neither is installed. Before either is switched on, this page is updated, and where consent is needed it is asked for.

Two things are missing from this site. One has been chosen and not installed; the other has not been chosen at all. Both will touch this page when they arrive, and both are named here rather than left as a surprise.

Nothing measures traffic to this site today. No analytics product is installed, and there is no code on these pages capable of reporting a page view — you can confirm that yourself by watching the requests the site makes. For launch Troy has chosen Vercel Analytics, which is cookieless and does not track anyone across sites (a proposed default, not yet approved), which is why this page names it rather than leaving you to find out later. It is a product of Vercel Inc., the company that already serves this site from Vercel's Washington, D.C. region (iad1), in the United States, and it would be added to the Sub-processors list before it was switched on. Choosing is not installing: it is not on this site, the table in clause 3 describes the site as it is, and the day it is switched on is the day this section and that table have to change. If it stores or reads anything on your device, it is listed there before it is switched on, and consent is asked for wherever consent is required.

Whatever gets chosen, four things hold.

  1. This page is updated before the change is live, not afterwards, and the version history records what changed and when.
  2. Anything non-essential stays off until you say yes, in every place where consent is required, and refusing leaves the site completely usable.
  3. Any provider that receives data about you is named in the Sub-processors list, with what it receives and why, before it receives anything.
  4. Where a cookieless, non-identifying option and a more revealing one would both do the job, Troy takes the first one. That is the test the analytics product named above was chosen against. If it ever does not hold, this page will say which was chosen instead and why.

In plain EnglishA signed-in product needs a session cookie. That is essential storage, and it will be described here before anyone can sign in.

The Troy platform is not open. When it opens, signing in will require at least a session cookie and a protection against cross-site request forgery. Both are strictly necessary: without them nobody can stay signed in, and asking consent for them would be meaningless, because refusing would mean no product.

Those cookies will be described on this page — their names, what they hold, how long they last, and whether they survive closing the browser — before anyone can sign in. They will be confined to the signed-in product, and the public pages described here will stay as they are.

Whether the product uses analytics inside a signed-in session is a separate decision, and it has not been made. Nothing on this page should be read as permission for it.

In plain EnglishEverything this site shows you comes from this site. Links to other companies take you to those companies, and what happens there is theirs.

Anything loaded from another company’s address can see the request that loads it — your IP address, the page you are on, and what your browser says it is — whether or not it sets a cookie. That is worth naming, because it is the most common way a site leaks its readers without meaning to.

In plain EnglishAll of it is served from this site. Your browser does not ask another company for anything while you read.

The three typefaces on this site are downloaded when the site is built and then served from this site itself. Your browser makes no request to a font service, and no font provider learns that you opened a page here.

The two short videos and every image are files on this site’s own server, played by your browser’s built-in video element. There is no embedded player, no third-party media host, no map, no social embed, and no iframe anywhere on these pages.

This is stated because the usual alternative is not neutral. A font, a video player, a map or a share button served from another company’s address hands that company your IP address and the page you are reading, simply by being on the page. Troy has avoided that here rather than disclosing it and carrying on.

In plain EnglishA link goes where it says it goes, with nothing added to it. Once you arrive, that site’s rules apply, not this page.

Several pages cite their sources — the advertising platforms’ own documentation, published research, competitors’ public price pages — and link to them. Following one takes you to a site Troy does not run. That site’s own cookie policy applies from the moment you arrive, Troy has no control over it, and Troy receives nothing back.

Troy adds no click tracking, no redirect through a counting service, and no identifier to those links. The address you see in the link is the address you go to.

Louin (https://www.louin.io) is part of Lunari Group and is linked from these pages. It is a different company with its own website and its own policies, and following that link is leaving this site, exactly like any other.

Different websites do not mean separate systems, and this page will not let the link imply otherwise. Troy, Louin and Lunari Group share systems and data. Client data is held on systems Lunari Group runs, and the companies in the group can see each other's data. That is about the information people send these companies, not about anything on your device: nothing this site stores reaches Troy, so nothing it stores reaches Lunari Group either. What makes the sharing lawful is not settled — To be completed: What makes the sharing lawful, and how is it disclosed? Under PIPEDA, using someone's personal information for a purpose they were not told about needs meaningful consent, and a Louin customer has not agreed to their data being used for Troy's marketing. This needs, at minimum: a written agreement inside Lunari Group, notice to the customers whose data moves, a way for them to say no, and a record of consent. This is the most serious open item on this page — the site now discloses the sharing, but disclosure alone is not a lawful basis. — and the Privacy Policy and the Sub-processors list are where it is described.

In plain EnglishYour browser can show you all of this, delete it, and block it in future. If you clear it, the site forgets how you like it to look. Nothing else is lost.

Browsers in common use let you see what a site has stored, delete it, and refuse it in future — for all sites, and usually for one site alone. The setting normally sits under Privacy, Site settings, or Cookies and site data. Troy does not print menu paths here: they change with every browser release, and a stale instruction is worse than none. Your browser’s own help pages are accurate, and this page would not stay so.

You can also simply look. Open your browser’s developer tools, find the storage or application panel, and read the entry for this site. If you have changed how the site looks, it should hold exactly one item, the one named in clause 3. If you have not, it should hold nothing at all, because the preference is written when you change a setting and never on arrival. If you find anything else, this page is wrong and Troy wants to be told — see clause 10.

In plain EnglishYou lose the way you had the site looking, and nothing else. Set it again and it is saved again.

  • The appearance preference is forgotten. The site goes back to its default look — dark theme, comfortable density, the standard accent. Set it again and it is saved again.
  • Nothing else changes. There is no signed-in state to lose, no basket, no saved draft and no reading history, because none of those exist.
  • No copy survives anywhere. The preference was never sent to Troy, so there is nothing on Troy’s side — or on the systems Lunari Group runs — to clear, and nothing for you to ask Troy to delete.

In plain EnglishBlock everything and the site still works. Your choice simply lasts for the visit instead of being remembered.

The site works. Private windows, blocked site data and strict browser modes are handled: the code that writes the preference is written to fail quietly, so the controls still work for the visit and your choice is simply forgotten when you leave.

No feature is withheld from a reader who blocks storage, nothing is degraded, and nothing will nag you to allow it.

In plain EnglishTroy commits to honouring Global Privacy Control everywhere, not only where the law requires it. Do Not Track has no agreed meaning, but Troy will never read it as a yes. Today neither signal has anything here to act on.

Global Privacy Control (GPC) is a signal your browser or an extension can send that says you do not want your personal information sold or shared. Several US state laws treat it as a valid opt-out that a business must honour. Do Not Track (DNT) is an older header with no agreed meaning and no law behind it, and most websites ignore it.

Troy’s position on both:

  • GPC will be honoured as an opt-out of any sale or sharing of personal information, in the sense the US state laws use those words, and of any non-essential storage, wherever you are — not only in the states that require it. That is a commitment about what Troy will build, and it is worth being exact about today: there is no code on this site that reads the signal, because there is nothing here for it to switch off.
  • DNT will never be treated as consent to anything. Troy undertakes to read it as a request not to set non-essential storage and to follow it, while being clear that it carries no legal weight. As with GPC, there is nothing on this site yet for it to apply to.
  • Neither signal is counted, profiled, or used to tell your browser apart from any other. A privacy signal that becomes a tracking signal is worse than no signal. Troy runs nothing here that could count them; what Vercel Inc. records in its own request log is a separate question, and clause 3.2 covers it.
  • Neither signal is required. Refusing storage in your browser settings works on its own, and no signal is needed to read anything here.

If you think this page is wrong

In plain EnglishTell Troy and it gets fixed. You can also complain to a regulator, and you do not have to come to Troy first.

This page was written by reading the site’s code, and it is meant to be exact. If your browser shows something this page does not list, or a request goes somewhere this page does not mention, write to privacy@louin.io or troy@louin.io and say what you saw. Troy will check it, correct this page, and record the correction in the version history rather than editing it quietly.

You may also complain to a data protection authority, and you do not have to write to Troy first. Which one supervises Troy follows from where Troy operates: it is a Canadian business, with its registered office at Unit 6, 10651 Keele Street, Maple, Ontario L6A 3Y9, Canada, so that authority is the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority. Which one is yours depends on where you live. In California it is the California Privacy Protection Agency or the Attorney General, and the other US states with privacy laws route complaints through their own Attorney General. In the United Kingdom the authority is the Information Commissioner’s Office, and in the EU it is the authority for the country you live in — named here for completeness, since Troy does not offer its services in either place.

In plain EnglishIt changes when the site changes, before the change goes live, and every change is listed at the bottom of this page.

This document is versioned. Every change is recorded in the version history at the end of this page, with the date and what changed. Nothing is edited silently, and the version number moves whenever the meaning does.

Two rules govern the timing. A change that adds storage to your device is published before that storage is ever set. A change that only removes storage, or corrects a description, is published as soon as it is true.

This is a draft. It has not been reviewed by a lawyer, Troy has not launched, and it is not a contract. The site it describes, however, is real: everything this page says about what that site does was true of the site on the date printed at the top of this page, and the commitments in clause 6 and clause 9 are meant to be kept rather than to decorate a draft.

In plain EnglishEmail Troy. A person reads it.

No individual is named on this site. Privacy questions reach the person accountable for privacy at Troy through the address below: privacy@louin.io. Questions about this page, or about anything stored on your device by this site, go there. General enquiries go to troy@louin.io. Both reach a person, and neither is a ticketing system.

This site is published by Troy Agency Inc., trading as Troy, part of Lunari Group. The incorporation has not completed and there is no corporation number yet (To be completed: There is no corporation number yet, which means the federal incorporation has not completed. Until it has, Troy Agency Inc. is an intended name rather than a company: it cannot sign a contract, and calling itself “Inc.” in one would be wrong. This is the first thing to finish.); the registered office is Unit 6, 10651 Keele Street, Maple, Ontario L6A 3Y9, Canada, and the rest of the registered details are in the Imprint. The fuller account of what Troy does with personal information is in the Privacy Policy, and the list of everyone who processes it — Lunari Group included — is in the Sub-processors list.

Changes to this document
VersionDateWhat changed
0.320 Sep 2026The incorporation is recorded as not yet completed — there is no corporation number, and no sentence now says a company already exists. Markets recorded as Canada and the United States only: the EU and UK material is kept as context rather than as a claim to serve those readers, and the two representatives are recorded as not appointed because the obligation has not been triggered. The hosting region is fixed — Vercel's Washington, D.C. region — so this page now says plainly that a Canadian company's site is served from the United States. CASL's provisions on installing software on a device are named in clause 2. The sharing of systems and data across Lunari Group is disclosed in clauses 3 and 7.2, with the basis for it still open. Still not reviewed by a lawyer.
0.220 Sep 2026Incorporation in Ontario recorded: PIPEDA and the Office of the Privacy Commissioner of Canada named, Quebec's Law 25 flagged as something that may apply, and the EU and UK material kept with the two representatives still to appoint. Vercel named as the host, leaving one open question — whether it sets a strictly necessary cookie of its own. Analytics recorded as chosen for launch and not installed. Contact addresses are now real. Still not reviewed by a lawyer.
0.119 Sep 2026First draft, written alongside the site. Not reviewed by a lawyer.