The boring part · read it anyway

Privacy Policy

Last updated 1 September 2026 · TrumpIt.lol

Parody notice

TrumpIt is an independent parody and entertainment brand. It is not affiliated with, sponsored by or endorsed by Donald J. Trump, The Trump Organization, or any government entity. Every name on the map is a joke somebody paid for. Nothing on this site transfers real-world property, authority or naming rights over any actual place.

Short version. We keep an email address, a username and a record of what you claimed. Payments go straight to Stripe - we never see your card. Analytics are cookieless. If you press “find me”, your location is used once to work out roughly where you are and is never stored as precise coordinates.

Who we are

TrumpIt.lol operates this service and is the controller of the personal data described below. Contact: privacy@trumpit.lol.

What we collect

If you just look around

A session cookie so the site works, and a CSRF token.
Aggregate, cookieless page analytics (see Cloudflare below).
First-party product events - that a map was viewed, a place was selected, a button was pressed. These are tied to a rotating session identifier, not to you.
Server logs, including IP address, for security, abuse prevention and debugging.

If you make a claim or sign in

Email address. Required - it is how you log in and how we tell you that you have been outbid.
Username, display name, avatar, territory colour and any optional link you add. These are public.
The names you submit and the claims you make. These are public, and are the point of the site.
Payment records - amount, currency, time, status and Stripe's identifiers. Not card numbers.
Abuse signals - IP address, rate-limit counters and risk flags, kept to stop fraud and free-claim farming.

We never collect a password, because there is no password. Authentication is a single-use email link.

Payments - Stripe

Card payments are processed by Stripe, which acts as our payment processor and as an independent controller for fraud prevention. Card details are entered directly into Stripe's hosted fields and never touch our servers. We receive a token, the amount, the outcome and Stripe's risk assessment. Stripe's own privacy policy governs their handling of that data.

Cloudflare - Turnstile and Analytics

Cloudflare Turnstile protects the login and claim forms from bots. When a form loads, Turnstile runs a challenge in your browser and sends a token to Cloudflare for verification, along with your IP address. It is a privacy-preserving alternative to a CAPTCHA and does not ask you to label photographs of traffic lights.

Cloudflare Web Analytics gives us page-level traffic numbers. It is cookieless, does not fingerprint visitors and does not build cross-site profiles. It is off entirely unless we have configured a token.

Location - explicit action only, and always coarse

The map never asks for your location on load. Location is requested only when you deliberately press a control such as “Trump Nearby”, and your browser will ask you separately before anything happens.

When you do: your coordinates are used in the moment to find nearby public places, and then discarded. We do not store precise GPS coordinates. Anything we retain for analytics is rounded to roughly a ten-kilometre grid, which is enough to know a country and useless for finding a person.

Residential addresses are excluded from the service entirely. They are not claimable, not searchable and not shown on the map.

Email

We send email for these reasons and no others:

Login links you asked for.
Claim confirmations and receipts.
Outbid notifications and activity on places you chose to watch.
Rare service notices - a security issue, a material change to these policies.

Notification emails carry an unsubscribe link and you can turn them off in your account. Transactional mail - login links and payment receipts - cannot be switched off while your account is open, because they are the account.

We do not sell personal data, and we do not share it with advertisers or data brokers.

Cookies

Session cookie - keeps you signed in. Strictly necessary.
CSRF cookie - stops cross-site form abuse. Strictly necessary.
Turnstile may set a short-lived token while a challenge runs.

No advertising cookies. No third-party trackers. No cross-site profiling.

How long we keep things

Account and claims - for as long as your account exists. Claims are part of the public record of the game and remain visible in history after they are displaced.
Payment records - seven years, because tax and accounting law says so.
Server and security logs - up to 90 days.
Product analytics events - up to 25 months, in aggregate form.
Login links - 15 minutes, then destroyed. Only a hash is ever stored.

Delete your account and we remove your email address, display name, avatar and optional link. Names you paid to place stay on the historical record, detached from your identity, because they are part of the public history of the map.

Your rights

Depending on where you live you may have the right to access, correct, delete, export or restrict processing of your personal data, to object to processing, and to complain to your data protection authority. Email privacy@trumpit.lol and we will respond within 30 days.

Our lawful bases are: contract (running your account and your claims), legitimate interests (security, fraud prevention, aggregate analytics), consent (location, when you press the button) and legal obligation (financial records).

Children

TrumpIt is not for children. We do not knowingly collect data from anyone under 13 (16 in the UK and EEA). Tell us and we will delete it.

International transfers

Our infrastructure and processors - including Stripe and Cloudflare - may process data outside your country. Where that happens we rely on the safeguards those providers maintain, including standard contractual clauses.

Changes

We will post updates here with a new “last updated” date, and will tell you directly if a change materially affects you.

Contact: privacy@trumpit.lol. This policy is a plain-English description of current practice and has not yet been reviewed by counsel.

Questions, complaints, takedowns and legal notices: legal@trumpit.lol. Privacy requests: privacy@trumpit.lol.