Browser extension privacy policy
In short: The extension does not collect, sell or share your personal data. It does not read your cookies or browsing history. It contains no ads or trackers.
1. What data we process and why
| Feature | What is sent | Where | When |
|---|---|---|---|
| Store card (click the icon) | Only the domain of the active tab (e.g. examplestore.com) and the extension link token | ShopTrend server | Only when you click the icon |
| Track | The store domain and the link token | ShopTrend server | Only when you click the button |
| Toolbar badge (optional, off by default) | Only a daily store-list request and the link token. The site you open is not sent; matching happens in your browser. | ShopTrend server | Once a day |
| Store discovery (on by default while signed in; turn off in Settings) | If the site you open is an online store (Shopify, WooCommerce or another recognized platform), or when an advertiser's platform is resolved in Meta Ad Library: the store's domain and platform. For Shopify stores also the public store summary: store name, country, currency, language, theme name and version, app traces visible on the page (e.g. "klaviyo"), published product and collection counts, number of shipping countries, newest product's publish/update date, lowest price and product type | ShopTrend server | Same store at most once every 7 days, in batches |
| One-click sign-in | "Continue with ShopTrend" opens the ShopTrend sign-in page (OAuth 2.0 with PKCE via chrome.identity); if you are signed in to the dashboard it connects without a window. Only a short-lived extension token is returned; your Google account, email or profile is not read. | ShopTrend server | At install, when you press the sign-in button, or when a dashboard tab loads (only if you are not connected) |
| Meta Ad Library platform label (on by default; works without sign-in) | A cookie-free request to the site behind each ad link shown on the Ad Library page: its public /meta.json, /products.json?limit=1 and home page (5 s, at most 64 KB read). If you are signed in, the domain is first looked up in the ShopTrend list (domain + link token). | The advertiser's site; ShopTrend server if signed in | When you open an Ad Library page; the result is kept in your browser for 7 days (1 day for "other") |
| Codeless connection | The dashboard hands the pairing code to the extension; the extension asks you to confirm before it connects. Only shoptrend.io and rivalova.com pages can send it. | ShopTrend server (after you confirm) | Only when you press "Confirm and link" |
| Floating icon (optional, off by default) | Whether the page is Shopify is checked only in your browser; nothing is sent at that stage. If you click the icon: the page's domain and the link token | ShopTrend server | Only when you click the icon |
| Supplier search links | The extension sends nothing; if you click a link your browser opens the search site (AliExpress, Alibaba, Amazon) with the product title. | The site you click | Only when you click |
| Product details | Title, vendor, dates, tags and variant names from the same store's official public Ajax product endpoint; no cookies, token or referrer header. Cart/account endpoints are not read; description HTML is never rendered or executed. | Memory of the open drawer only; neither sent to ShopTrend nor saved | Only when you press "Product details" or "Inspect the product on this page" |
| Font and color tools | CSS font families, sizes and weights in the visible area, or the HEX code of your chosen color; no form fields, hidden text or text content are collected. No screenshot is taken. | Memory of the open side panel only; neither sent nor saved | Only when you press the relevant button |
| Product images (off by default) | Public Shopify images for the first five best sellers; no cookies, link token or referrer header. The provider can see your IP address. | Shopify image server or the store's Shopify CDN path | Only after you press "Load product images"; resets when changing stores |
Never sent by discovery: page paths and query strings, cookies, browsing history, form contents, login details, your account/identity, your IP address (not stored on the server), sites that are not online stores (nothing is sent, no message is even created). To read the store summary, two public store addresses (/meta.json, /products.json?limit=1) are requested without cookies. Discovery records are anonymous: no credentials are attached even if your account is linked, and a record cannot be tied to you.
Purpose: the store card and tracking are the service itself. Discovery adds new online stores to ShopTrend's public store list, and the Ad Library platform label lets you filter ads by platform; everything sent is already public store information.
2. Stored in your browser
In chrome.storage.local: a 30-day link token (renewed, revocable from the dashboard), your settings (badge, discovery), the daily store list if the badge is on, the Ad Library platform cache (domain → platform; 7 days, 1 day for "other"), and, if discovery is on, the queue of unsent records and domains sent in the last 7 days (so the same store isn't sent twice). Not synced. Removed when you uninstall. The short survey page that opens on uninstall receives only the extension version number (no account, token or visited domain). Also only what you save yourself: store folders you create (up to 20 folders, 200 store domains), ads you save in the Ad Library overlay (ad ID, store domain, date; up to 200), the position of the floating icon, your appearance choice (system/dark/light), the 8-digit code of a connection request coming from the dashboard (up to 10 minutes; it expires on its own if you do not confirm) and, if you turn it on in Settings, the domains and dates of the last 30 stores you looked at. Folders and history stay in this browser only and are never sent to the server; turning the history off in Settings or pressing "Clear list" deletes it.
3. Stored on the server, and for how long
- Only a one-way hash (SHA-256) of the link token; the token is valid for 30 days.
- Domains and public store summaries from discovery: as part of the store list, while the store is online. These records contain no personal information.
- For rate limiting, the IP address is held only in server memory, hashed with a secret salt that changes daily; it is never written to disk or logs and becomes meaningless at the end of the day.
- Data is not sold, not used for advertising and not shared with third parties.
4. Turning it off and your rights
- Discovery is on by default only while you are signed in; the badge is off by default. Turn either off in Settings; turning discovery off deletes the unsent queue. The Ad Library overlay can also be turned off in Settings.
- If you revoke site access in the browser's extension settings, discovery and the Ad Library overlay stop automatically.
- "Disconnect" (sign out) deletes the token in the extension and revokes it on the server.
- Store owners can request removal through the removal form on shoptrend.io.
- For KVKK/GDPR requests use the Support form in the ShopTrend dashboard.
5. Permissions
At install: activeTab (address of the tab where you click the icon), storage (local records above), contextMenus (right-click supplier search), sidePanel (side panel), identity (one-click sign-in window; your Google account or email is not read), scripting and https:/// site access (ShopTrend API, Ad Library platform labels, store discovery; requested once at install so no permission prompt interrupts you later). Optional: tabs (badge), alarms (badge or optional change checks), notifications (explicitly enabled change alerts).
6. Changes
If this policy changes, it is noted on the extension's "what's new" page and here. If the types of data collected expand, we ask for your consent again.
Store changes
Off by default. Explicitly enabling browser alerts reads only account-followed source events from ShopTrend, without cookies, using a short-lived paired token in the authorization header. Up to 200 source records from seven days are checked every 30 minutes; sleeping browsers may delay checks. A measured price-drop threshold and new-product activity type can be selected. Initial history, newly followed store history and settings changes do not notify. Notifications contain only a summary count and open the extension’s private feed. Raw records remain in trusted session memory. Only preferences, bounded SHA-256 deduplication/account/scope hashes and source time persist locally. Disabling or losing permission clears this feature’s alarm, raw feed and hashes; shared API/alarm permissions are retained. Manual checks while off are explicit user actions. There is no third-party analytics or source-site script injection for this feature.
Video research list
Explicit inspection reads only the selected TikTok/Creative Center detail tab’s loaded video source, title and explicit country/industry labels. Saving requires a separate click and stores at most200 canonical public links with title, optional labels, selected local board and local save time. Temporary media URLs/signatures and video bytes are not stored in the list. Selection context expires in trusted session memory after10minutes (at most20). Downloads request permission only for the observed media origin, omit credentials/referrer, reject redirects and validate a bounded MP4/WebM response. Downloaded files remain in the browser’s chosen location; removing a saved link does not remove a downloaded file. No account token, store API or analytics service is used by this feature.
Additional disclosures (Turkish)
The following sections are published in Turkish.
İsteğe bağlı süreli paylaşım
Paylaşım sayfasında tek tek seçtiğin mağaza alan adları ve reklam kimlikleri, yazdığın başlık ve seçtiğin süre, önizleme ve ayrı onaydan sonra sunucuda paylaşım kaydı olur. Özel klasör adı, notlar, sayaçlar veya hesap belirteci bu kayda konmaz. Bağlantı 1 saat, 24 saat veya 7 gün geçerlidir; sahibi uzantıdaki aktif paylaşımlardan her zaman iptal edebilir. Bağlantıya sahip herkes seçili özeti görebilir. İptal yeni erişimi hemen kapatır ve kaydı siler; süre dolumu erişimi hemen kapatır, kayıt en geç sonraki saatlik temizlikte kaldırılır. Eski bir alıcının aldığı kopyalar geri alınamaz.
Sunucu tam bağlantı yetkisini değil özetini tutar. Tam bağlantı oluşturulurken gösterilir. Paylaşımın hesap/kullanıcı bağlantısı, oluşturma ve sona erme zamanı yönetim ve silme için saklanır; genel görüntüleyicide bu hesap bilgileri veya bağlantı belirteci gösterilmez. Paylaşım içerikleri Verilerim dışa aktarımına girer ve hesap silmede, fatura için hesap kaydı saklansa bile, kaldırılır. Yerel kaydın silinmesi oluşturulmuş paylaşımı silmez; bağlantıyı ayrıca iptal edebilirsin. Genel görüntüleyici okuma dışında işlem yapmaz, reklam veya harici görsel yüklemez, çerezle kimlik eşleştirmez.
Paylaşım içerikleri sunucuda şifrelenmiş saklanır. Şifreleme ayarı hazır değilse özellik veri kabul etmez. Süreli bağlantı için seçili kamuya açık içerik dışında yeni veri toplanmaz.
Instagram, Pinterest ve TikTok araştırması
Instagram/Pinterest araştırması yalnız kullanıcı inceleme düğmesine bastığında çalışır. Sayfaya yüklenmiş gönderi sayaçları ve ücretli ortaklık işareti, ya da sponsorlu olduğu doğrulanan pinin kamuya açık reklam bilgileri yerelde gösterilir. Çerez, hesap kimliği ve özel mesaj alanları sonuca alınmaz. Kaydetme isteği önce on dakikalık geçici seçim oluşturur; kalıcı kayıt için uzantının kendi sayfasında klasör seçip Kaydet'e basmak gerekir. Klasör isimleri kaynak web sayfasına verilmez. Seçilen en fazla 200 öğe yalnız tarayıcıda saklanır; sunucuya gönderilmez veya senkronize edilmez. Klasörler ekranından kayıtlar tek tek kaldırılabilir. Bilinmeyen sayaçlar veya sponsorlu olup olmadığı doğrulanamayan pinler için veri uydurulmaz.
TikTok video içgörüleri yalnız kullanıcı TikTok profil veya video sayfasında eklentideki inceleme düğmesine bastığında açılır. Sayfada zaten yüklü video sayaçları ve yayın tarihi yalnız o sekmede incelenir; mesajlar, hesap kimliği ve çerezler okunmaz. Sonuçlar gönderilmez ve kaydedilmez. İsteğe bağlı CSV indirme, sonucu yalnız kullanıcının bilgisayarına yazar. Kullanıcının başlattığı kaydırma durdurulabilir; sekme gizlenince, sayfa değişince veya kaplama kapatılınca durur. Bu işlev kalıcı TikTok site izni istemez.