Your data should help find deals—not become the deal.

We collect the account identifier, email address, and optional display name supplied through sign-in; the ZIP code, precise coordinates, budget, drive limit, profit and ROI rules you choose; saved deals, verification checklists, scans and uploaded product images; user-captured retailer title, current and regular price, barcode candidate, brand/model/SKU, image URL, availability or selected-store label, source URL and hostname, extraction confidence, evidence and review warnings, capture method, capture time, and human-review time; push-subscription details, one-way device and configuration bindings, and alert acceptance and browser-reported display times; support requests; subscription status, plan and credit-ledger activity; Stripe customer, subscription, checkout, invoice, and event identifiers; Whop checkout, membership, customer, user, product, plan, payment, and signed-event identifiers; referral codes and referral-link click, checkout, qualification, provider-mapping, and commission times; and security or operational logs.

If you connect Discord, we collect the Discord user ID, username and optional global display name, connection status, connection and role-sync times, limited error status, and optional direct-message preference. We do not receive or store complete payment-card numbers; Whop or Stripe processes payment information for the charge it handles. The extension does not monitor the websites you visit. ShelfSignal receives a product capture only when you review it and choose to continue.

Before accessing a page, ShelfSignal Capture identifies the product-page fields it will use. It creates an extracted draft only after you choose “Read page and create draft” and requires your review before opening ShelfSignal. If you choose “Enter this item manually,” it uses only the cleaned current-tab address and the product details you type; it does not run the page-field extractor. “Open calculator only” reads no retailer-page data. If you leave “Remember these decision inputs” enabled, the extension stores only your calculator assumptions—such as fees, reserve, targets and budget—inside that browser so the next capture is faster. Those preferences are included in ShelfSignal only when you deliberately continue with a reviewed capture.

The reviewed HTTPS handoff can include the shown title, prices, sale or clearance label, barcode and item numbers, brand, model, SKU, image, availability or selected-store label, cleaned source address, source notes, warnings, and the calculator assumptions you entered. Selected-store or area labels are limited location data supplied by the retailer page; the extension does not request device GPS. It removes URL fragments and sensitive, personal, sign-in, location, and common advertising parameters before handoff. Sign-in, Amazon authorization, and billing stay on ShelfSignal’s site; the extension does not receive passwords, authorization tokens, or payment details. It does not read your browser-history database, monitor other tabs or websites, or collect cookies, personal communications, bank details, or card details. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only to provide and secure the user-facing capture, matching, calculation, inbox, and deliberately requested community features. It is not sold, used for advertising, or transferred for credit or lending decisions.

A reviewed retailer-page capture is private to the signed-in member by default. It is not automatically published. A product can appear to other members only after a separate evidence-backed in-store submission, explicit consent, and moderation. Other members may see the product, retailer, public store address and location, price, stock count, observation time, and deal estimate; they do not see the contributor’s name, email, private capture history, or device movement history.

When you create a capture mission, its exact product title, barcode, public retailer and store address, optional maximum shelf price, deadline, and status are visible to signed-in contributors. Your name, email, account identifier, and contact information are not shown with the mission. A mission share message includes the product, retailer, branch, city, state, promotional-credit amount, and an opaque mission link, but not the requester’s identity or exact street address. A recipient signs in before seeing the full mission. ShelfSignal uses the requester’s account internally to enforce limits, prevent self-fulfillment, award credits, and deliver an approved result.

Home coordinates are collected only after you choose “Set current location” and are used to estimate whether a store is within your drive limit and select alerts. When you deliberately share a community observation, ShelfSignal also records the submitted store coordinates, reported accuracy, and location-capture time so moderation can compare them with the typed public store address. ShelfSignal reads location only when you ask it to and does not track your movement.

When you enable phone alerts, ShelfSignal stores the browser subscription needed to send them. A push provider accepting a message does not prove that it appeared on your device. For reliability and launch testing, the ShelfSignal service worker sends one confirmation after the browser reports that it displayed an alert. The server receipt stores the account and device binding, configuration version, provider status, and acceptance and display times; it does not store the notification title, message text, or notification taps. Seeing the alert yourself remains an important real-world check, but ShelfSignal does not present that visual check as cryptographic proof.

The one-time display capability travels only inside the encrypted push event and is acknowledged immediately after the browser reports display. It is not placed in the notification data, a URL, or page-accessible browser storage. The capability is signed and bound to the exact receipt and a short expiry, while the server stores only its one-way hash. If your device is offline or confirmation fails, ShelfSignal keeps verification incomplete and asks you to run the test again. You can disable the device from Settings and remove its local ShelfSignal data through your browser controls.

Discord authorization requests only the identity and server-join permissions needed to identify your Discord account and add it to the official ShelfSignal server. The temporary Discord access token is used on the server for that identity and join operation, then revoked; ShelfSignal does not store the token or your Discord password. We retain the minimal identity and connection record needed to prevent one Discord account from being attached to multiple ShelfSignal accounts, synchronize ShelfSignal-managed Member, plan, and approved-affiliate roles, investigate failures, and honor disconnection.

Optional direct-message consent is off by default. An owner-supervised delivery check stores a one-way code record, a one-way Discord delivery receipt, and limited configuration and timing records; it does not store the private-message body or raw Discord response. The code record is removed after successful confirmation, and the resulting readiness proof expires after 30 days. Disconnecting turns direct-message consent off and queues removal of ShelfSignal-managed roles. A limited connection and audit record may remain only as needed for security, fraud prevention, troubleshooting, accounting, or legal obligations. A valid deletion request removes or de-identifies eligible Discord connection data unless retention is required.

A partner applicant connects Whop with the OpenID and profile permissions so ShelfSignal can verify the exact Whop user that will own the affiliate relationship. ShelfSignal receives the verified Whop user ID and limited profile label from Whop and binds that identity to one ShelfSignal account to prevent payout misdirection and duplicate claims.

The server uses a short-lived authorization code and PKCE verifier for this connection. ShelfSignal does not store Whop OAuth access tokens, refresh tokens, passwords, or payment credentials. If Whop returns a refresh token during this identity-only connection, ShelfSignal revokes it before saving the verified identity.

We use information to authenticate accounts, save private capture history, calculate and deliver nearby opportunities, create and moderate capture missions, match optional mission notifications to your saved location and drive limit, apply buy rules, store scans and verification progress, operate subscriptions and promotional credits, prevent abuse, answer support requests, and improve reliability.

When you choose a ShelfSignal referral link, ShelfSignal places an HttpOnly first-party cookie on this site. The cookie contains the referral code and the time you followed the link, protected by a signature that helps detect changes. It does not contain payment details and is not used to follow your browsing across other websites.

The cookie expires no later than 30 days after the referral-link click. If you follow more than one valid ShelfSignal referral link, the last valid link may apply. When you begin subscription checkout, ShelfSignal may record the referral code, provider-specific affiliate mapping, click time, and checkout time with your ShelfSignal account. Whop governs attribution, payout, and clawback for Whop subscription sales. ShelfSignal’s local Stripe commission records apply only to expressly eligible direct Stripe subscriptions. A single sale cannot produce both commissions. We use the records to administer the responsible program and detect self-referrals, tampering, duplicate accounts, refunds, chargebacks, and fraud.

You can avoid setting the referral cookie by visiting ShelfSignal directly instead of following a referral link. Before checkout, you can remove it by clearing ShelfSignal cookies or site data in your browser. Clearing the browser cookie stops it from being presented on a later checkout, but it does not undo an attribution already recorded with an account or checkout, a promotion already applied, a completed commission record, or records that must be retained for billing, fraud prevention, accounting, or legal obligations. You may ask Support about access, correction, or deletion rights that apply to these records.

Information may be processed by hosting and authentication providers; Whop for new subscription checkout, membership and affiliate handling; Stripe for eligible direct or legacy billing and credit packs; Discord for the optional community connection; email and web-push providers for alerts; and approved retail or marketplace data providers. We may disclose information when required by law, to protect users or the service, or as part of a business transaction with appropriate safeguards.

ShelfSignal does not sell personal information or use it for cross-context behavioral advertising.

Amazon seller authorization tokens are encrypted with account-bound authenticated encryption before storage and used only for marketplace operations you request or enable. ShelfSignal does not ask for or store your Amazon password. We record authorization and successful verification times so stale or revoked connections can be disabled. Disconnecting marks the connection revoked and removes the stored usable token; Amazon-side revocation and periodic reauthorization may also be available or required through Seller Central.

Private captures, scans, precise home coordinates, product photos, support records, marketplace and Discord connection records, coverage acknowledgments, and billing records are kept only while needed to provide the service, investigate fraud or disputes, satisfy accounting or legal duties, and document customer consent. Phone-alert confirmation receipts have a verification lifetime of no more than 30 days, do not contain the alert message, and are deleted by scheduled cleanup after expiry. Inactive phone-subscription endpoints and key material are deleted by scheduled cleanup after their receipt audit binding expires. The first-party referral cookie expires after no more than 30 days. Referral attribution, provider mapping, subscription, and commission records may be retained longer while needed to administer the responsible partner program, settle commissions, handle refunds or chargebacks, investigate fraud, and satisfy accounting or legal duties. Public-support verification tokens expire after 30 minutes, and the keyed network abuse identifier is removed after 30 days. ShelfSignal stores a one-way verification-token hash in the support database rather than the link token, and the keyed network identifier does not contain the raw network address. Short-lived store offers expire on their recorded source or moderation schedule; deleting or disconnecting an account removes usable marketplace tokens. A valid deletion request removes or de-identifies eligible account content, while records required for tax, payment, security, or legal claims may be retained for the applicable period.

We use account-scoped access controls, secret-managed credentials, authenticated token encryption, encrypted transport, signed webhooks, and limited data collection, but no system can guarantee absolute security.

You may change location and buy rules in Settings, turn deal or store-check alerts off, disconnect Discord or turn optional Discord direct-message consent off, manage billing through the provider shown on the signed-in pricing page, and submit access, correction, deletion, or inaccurate-data requests through Support. The public Support page remains available if you cannot sign in; ShelfSignal verifies control of the supplied contact email before changing account data. Some records may be retained where legally required or needed for fraud prevention and accounting.

ShelfSignal is operated by Raptor Manga LLC. The service is intended only for people who are at least 18 and able to enter a binding agreement; it is not directed to children. Material changes to this notice will be posted here with a new effective date.