Single purpose: Audits a single Etsy listing the user is currently viewing against Etsy's published listing requirements and reports a score plus a fix list.
In one line: the free website detector processes images only in your browser and never uploads them. Local image uploads are processed in your browser. Public listing lookups send a listing ID and authentication information to our API; licensing and optional operation counters have separate data flows described below.
In one line: the free website detector processes images only in your browser and never uploads them. Local image uploads are processed in your browser. Public listing lookups send a listing ID and authentication information to our API; licensing and optional operation counters have separate data flows described below.
Public listing lookup: Our API uses the public listing ID to retrieve available title, price, currency, description, tags and image information from Etsy. These public responses may be cached for up to 24 hours. This is separate from images you upload to the local detector, which are not uploaded to our API.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
1. Website image detector (this site)
- Images you drop into the free detector are read with HTML Canvas in your browser.
- We do not upload, store, or transmit detector images to any server.
- Language preference may be saved in
localStorageon your device only.
2. What the extension collects
- Etsy listing ID (a public number). When you click the extension on an Etsy listing page, we send this ID to our server to retrieve the listing’s public tag data via the official Etsy Open API. Requests also use authentication tokens; API rate limits use token fingerprints. See device tokens and licensing below.
- For the free audit feature, we do not collect your name, email, Etsy account, shop name, order data, browsing history, cookies for ads, IP-based profiling, or analytics identifiers. One exception: information you voluntarily submit on the withdrawal form — see Withdrawal requests below.
2b. Withdrawal requests
- What we collect: the name and order number or payment email you type into the withdrawal form on withdraw.
- Why: to fulfil the EU/UK statutory right of withdrawal and to send you an acknowledgement email.
- Where stored: with our processor Upstash (and emailed to our support inbox via Resend when configured).
- Retention: 400 days (aligned with subscription lifetime for reconciliation and legal record-keeping).
- Legal bases: legal obligation and contract performance (not consent).
- How to delete: email [email protected] and we will erase the stored request where the law allows.
3. What stays on your device
- Audit history, scores, benchmark snapshots, language choice, and text you type are stored locally with
chrome.storage.local. They are never uploaded as a bulk export. - You can delete all of it with the built-in “Clear history” control, or by removing the extension.
4. What we do not do
- We do not sell, rent, or share your data with third parties for advertising.
- We do not run advertising SDKs or tracking pixels on this site for ads.
- We do not read pages other than Etsy listing pages you explicitly open and audit.
- We do not access, modify, or post anything to your Etsy account or listings.
- We do not use your data to train machine-learning models.
5. Device identifier (device token)
- When you use paid features or our API, the extension generates a 32-character hexadecimal device token locally (16 random bytes). It is stored only in
chrome.storage.localon your device. - Purpose: licence validation, subscription binding, and abuse prevention (rate limits). The token is sent to our API (hosted on Vercel) so we can issue or refresh a short-lived licence JWT. Legal bases: contract performance and legitimate interest in protecting the service.
- Retention: until you clear extension data, uninstall the extension, or we revoke access after a refund or chargeback. We store only a hash of this device token server-side (Upstash) when needed for licensing — never your Etsy credentials, and never the raw token in analytics.
- How to delete: use “Clear history” in the extension, or remove the extension (this deletes local storage including the device token). You may also email [email protected] — see Deletion process.
6. Analytics (this website)
- Our own event endpoint stores daily aggregate operation counts by fixed category when enabled, without listing text, photos, email, full URLs, referrers, user IDs or IP addresses in those counter records. Counters expire after 90 days. Cloudflare Web Analytics is also enabled for website traffic measurement. Hosting and analytics providers process request metadata separately from our operation counters. Browser storage includes preferences, licensing settings and session-only campaign and internal-test settings.
7. Extension permissions
activeTab— read the Etsy listing page you are viewing, only after you click the extension.scripting— run the on-page reader that measures image resolution and page structure.storage— save settings and audit history locally viachrome.storage.sidePanel— show the audit report beside the listing you are fixing.alarms— periodically refresh a paid licence while it is still valid.- We do not request broad host permissions at install. Optional auto-show may request etsy.com listing access only after you turn it on.
8. Sub-processors
| Provider | Role | Data |
|---|---|---|
| Cloudflare Pages | Website hosting & delivery | Website delivery and API transport; edge security logs are managed by the provider |
| Vercel | Serverless API host (/api/*: tags lookup, licence tokens, webhooks, cron mail) | Request metadata required to run the function; hashed device tokens / email hashes for licensing & mail; no detector images |
| Creem (Armitage Labs OÜ) | Merchant of record — payments & subscriptions | Payment email, billing status (we do not store card numbers) |
| Upstash | Server-side cache, rate limits, licence state, withdrawal & fee-alert records (US region) | Listing ID cache (≤24h), hashed device/email identifiers, subscription metadata, withdrawal form fields (≤400 days), fee-alert confirmations |
| Resend | Transactional email (support notices, withdrawal acknowledgements, renewal / re-audit reminders, fee-alert double opt-in) | Email address and message content for the send |
8b. Cross-border data transfers
- Our API and datastore run primarily in the United States (Vercel functions + Upstash Redis). The marketing site is served via Cloudflare edge.
- If you are in the EEA/UK/Switzerland, transferring personal data (for example hashed device tokens, payment-related email hashes, withdrawal form fields, or fee-alert emails) to the US is based on Standard Contractual Clauses (SCCs) / equivalent transfer tools used by those processors, plus our legitimate interest / contract need to provide the service you requested.
- We do not sell personal data. Detector images never leave your browser.
8c. Deletion process
- How to request: email [email protected] from the address you used (payment email, withdrawal form, or fee-alert subscription). Say you want deletion.
- What we do: remove or anonymise Upstash records we control (subscription / licence hashes tied to you, withdrawal request rows, fee-alert confirmation, related mail log pointers) and confirm by email.
- Timeline: we complete erasure requests within 30 days (usually sooner). Local browser / extension data you can delete immediately with “Clear history” or by uninstalling.
- Legal holds: where law requires keeping a record (for example a completed withdrawal), we may retain the minimum necessary for the stated retention period, then delete.
9. Third parties (summary)
- Etsy Open API — public listing tag data. Your use of Etsy remains subject to Etsy’s policies.
- Payment processor (Creem) — if you buy a paid plan, Creem handles payment. We never see or store card details.
10. Data retention
- Listing IDs sent to our server may be cached up to 24 hours to reduce API calls, are not linked to you, and are not kept beyond that.
- Local storage remains until you delete it.
11. Your rights
If you are in the EEA/UK, you may have rights under GDPR Articles 15–21 (access, rectification, erasure, restriction, portability, and objection). California residents may have rights under the CCPA/CPRA (know, delete, correct, opt out of sale — we do not sell personal data).
To exercise any right, email [email protected]. We respond within 1 business day.
12. Children
This is a business tool for adults 18+. It is not directed to children.
13. Changes
If this policy changes, we update the date at the top. Continued use after a change means you accept the updated policy.
14. Contact
Questions or data requests: [email protected]
15. Trademark notice
“Etsy” is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.