Account information
FeedGuard stores your email address, a password hash, a hash of your recovery key, account dates, the accepted Terms version and hashed session tokens with expiry times. Raw passwords and recovery keys are not stored in the account database. This information identifies your account, allows sign-in and recovery, and protects access.
If you add a passkey, we store its public key, credential identifier, chosen name, device transport and backup metadata, verification counter and use dates. Your private key and biometric data are not sent to FeedGuard. Short-lived verification challenges expire after five minutes. Account recovery removes passkeys and signs out sessions; removing a passkey also signs out other sessions.
Account confirmation and recovery emails are available only when the security sender is enabled. The account screen shows availability. When enabled, Resend receives your email address and a security message containing the link. We store one-use token hashes and limited delivery records, not raw links or message bodies. New requests replace previous links; confirmation links expire after 24 hours and reset links after 15 minutes. Email recovery requires a previously confirmed email, replaces the recovery key and invalidates sessions and passkeys. Marketing messages are not enabled.
Account and service records include registration and sign-in dates, confirmation status, connection information, usage records and saved support requests. Operational administrators may access underlying systems when necessary to maintain the service or handle incidents.
Your files: three different flows
Browser-only comparison. The CSV comparison tool reads two files in your browser, using a unique identifier you select. It does not upload file contents, save them in your account or send their values to an external service. Comparison state stays in page memory. Clear or reload discards it; downloads stay on your device until you remove them. Loading the website itself still involves ordinary hosting requests and connection metadata.
File check without an account. Your file is sent to our server to create the preview, including up to five examples from your file, which are shown back to you. The server analyses the file in memory and answers; we do not save the uploaded file or the preview in your account or application database, and no account or free check is created from it; the file check page is outside optional analytics. The application writes no file content to its own logs, and no AI model or advertising service receives it. The answer is for your browser only and is marked not to be cached. We keep limited security counters (see below), and our hosting provider processes request metadata such as your IP address, the time, the address requested and the response status. Before you use it, you agree to the Terms for this file check and confirm that you are authorized to submit the catalog and that you removed customer records, credentials and other sensitive information.
Saved account workspace. Running a check in the account workspace sends the catalog and supplied context to our server. A successful check saves the original catalog, the latest revised catalog and the report in your account. This file workflow does not send the catalog to an AI model, Shopify or Google Merchant Center.
Only provide product information you are authorized to process. Do not include order or customer exports, buyer records, credentials, regulated data or other sensitive personal information; the example catalog shows the columns that belong in a product file. A secret detector can reject recognized credentials in an uploaded catalog, but cannot guarantee detection of every sensitive value or personal data. If something that should not be there was uploaded to your saved workspace, delete the report in your account or contact us and we will remove it from the active database; a file sent to the no-account check is not saved, so there is nothing of it to remove on our side beyond provider logs.
Shopify connections and store actions
Shopify access is limited to the approved development store and may be unavailable. The connection screen shows actual availability. With separate permission, the integration can read products and variants, request aggregate sales reports and prepare supported product changes. Sales queries request product identifiers, quantities, revenue and recorded-cost totals rather than buyer or order identifiers.
Connection records include the shop domain, encrypted access and refresh tokens, requested and granted permissions, metadata and hashes of short-lived authorization state. Supported changes are sent to Shopify only after the relevant permission, an exact preview and your separate confirmation. The work history records outcomes, including uncertainty after interrupted requests.
When available and enabled, scheduled checks refresh data at your chosen interval and save results; they do not edit the store or send email. A separately enabled in-app digest saves a summary when findings change. A saved schedule preference does not itself prove that the integration or schedule is currently available.
Subscriptions and payments, when a plan is on sale
Paid plans are for businesses and sole proprietors in the United States. Stripe collects your billing name and address during payment. You can complete your separate FeedGuard business profile before using paid features: business or sole proprietor name, buyer type, US state, intended catalog use and confirmation that you are authorised to act for the business. Your first free catalog check does not require this profile. We use these details to activate the service, check purchase eligibility and provide support.
We keep the profile, its confirmation version and completion time; the plan, price, seller and agreement edition; Stripe customer, checkout and subscription references; and the billing name, country, state and five-digit ZIP code from Stripe’s completed checkout record. We do not copy the street address, full card numbers or bank credentials into this profile. The older pre-payment business confirmations remain associated with purchases made through that older flow. A network-country hint can hold an unusual purchase for review; it is not proof of residence.
Stripe processes card and billing details on our behalf and, for fraud prevention and legal duties, for its own purposes under its own privacy notice. No sales tax is added under the current subscription collection policy; this is not a declaration of tax exemption. Stripe retains its own invoices and payment records. We keep payment, tax and refund records for as long as applicable accounting, tax and legal obligations require. We use your account email for service and billing messages and do not use payment or profile data for marketing.
Scheduled monitoring and Merchant Center, when enabled
If you subscribe to FeedGuard Care and switch monitoring on, our servers open the public product pages and images listed in your saved catalog on a schedule, so the sites that host them receive ordinary requests from FeedGuard. We save the check results and a short history (the latest 60 runs). If you connect Google Merchant Center, we store an encrypted refresh token and use Google’s required permission to read product status and available performance reports only; disconnecting removes the saved connection, and you can also revoke permission in your Google Account. If alert emails are enabled and the sender is available, Resend receives your account email address and the alert message.
Early-access requests, when the form is on
The early-access form collects your email address, the plan you ask about, an optional store host name, the page and campaign tag you came from, and the version and time of the consent wording you agreed to. We use them only to email you once when the selected plan becomes available; requesting access creates no subscription and no marketing subscription. A request is kept for up to 365 days or until you withdraw it, whichever comes first, and is then deleted by our retention job; if the plan opens in that time we email you once. Withdraw at any time by emailing support@feed-guard.com from the address you used: we then delete the store name, campaign tag and display copy of your address and keep only your address, the plan, the consent version and the time of withdrawal as a suppression record, so a later form entry cannot restart messages; that record is deleted after three years. Any message we send you will carry our sender identity, a truthful subject, our mailing address and a simple way to opt out.
Storage and removal
The file workspace retains one original and one current catalog/report plus up to 20 recent change summaries. The store workspace retains a current product/aggregate snapshot, short-lived change previews and a work ledger. Its interface shows the latest 30 runs; the ledger remains until account closure or a verified shop-data erasure request. There is no automatic inactivity deletion in the current service.
- Download: saves a copy of your current catalog or report to your device.
- Delete a report: removes the saved file report; it does not disconnect a shop or restore the free allowance.
- Disconnect a shop: clears local connection credentials, cancels monitoring and removes pending previews while keeping saved reports and work history.
- Close an account: removes active account-linked catalog, store snapshot, previews, ledger, monitoring preferences, passkeys, challenges, email-action and delivery records, sessions, support requests, purchase confirmations and connection data. An active subscription is cancelled immediately first, and invoices and payment records held by Stripe and in our accounting remain as described above.
A verified Shopify shop-data erasure request removes the related imported catalog, connection, commerce snapshot, previews and ledger. Uninstalling the Shopify app clears local connection credentials but does not by itself remove the saved catalog.
If the free check was used, a hash of the normalized email address and the time the allowance was consumed remain after closure to prevent repeated free checks. This record has no automatic expiry. It does not contain the catalog, password or readable email, but it can still be linked to a supplied email by hashing that email; it is not anonymous information.
Security rate limits use counters keyed by hashed request identifiers (such as a hashed IP address) with the counter family, the count and the end of the counting window. A hash of this kind is a pseudonymous identifier, not anonymous information: someone who knows an address can compute its hash. The end of a window restarts the count; the counter itself is deleted 30 days after its window ends (see the table below). Hosting and database services process operational and connection metadata. Provider logs and backups can remain after deletion from the active application database; account closure does not erase them immediately. The service does not promise a fixed provider-log or backup erasure period.
Support emails are separate from account-stored support requests. Closing an account does not automatically delete mailbox correspondence. Contact us about relevant messages when requesting deletion. Downloads and any copies you make remain under your control.
Vercel hosts the application, Neon provides database storage and Google Workspace handles messages to our support address. Resend is used for account security emails and alerts when enabled, Stripe processes payments when a plan is on sale, and Google provides Merchant Center data when you connect it. Provider information describes their functions, roles and links to their own notices. FeedGuard does not offer a US-only processing or data-residency commitment.
How long we keep it
This table states our own retention rule for each kind of record. Where a provider keeps data under its own rules, we say so and make no promise for it.
| Record | Why we keep it | How long | How it ends |
|---|---|---|---|
| Account, sessions, passkeys, recovery data | Sign-in and security | Until you close the account; sessions last up to 24 hours | Closing the account deletes them from the active database |
| Saved catalog, report and change summaries | The service you use | Until you delete the report or close the account | You delete the report, or close the account |
| File sent to the no-account check | Building the preview | Not saved; analysed in memory | Nothing to delete in our database; provider logs follow the provider’s rules |
| Security counters (hashed identifier, family, count, window end) | Limiting abuse | 30 days after their window ends | Our retention job deletes them |
| Early-access request | One availability email | Up to 365 days, or until you withdraw | Retention job; withdrawal on request |
| Early-access suppression record | Not contacting you again | Three years from withdrawal | Retention job |
| Business profile | Account completion, activation and support | Until you close the account | Account closure removes it from the active database; provider backups follow provider rules |
| Purchase confirmations | Showing what you agreed to | Until you close the account (Stripe keeps its own record) | Closing the account |
| Invoices, payment, tax and refund records | Accounting, tax and legal duties | As long as those duties require | Not deleted on request while required; then removed |
| Monitoring history and Merchant Center connection | The Care service | Latest 60 runs; connection until you disconnect or close | Disconnect, account closure or the 60-run limit |
| Optional analytics events | Improving public pages, only after you opt in | Set by the analytics provider; separate from the six-month storage of your choice | Contact us about a privacy request |
| Provider logs and backups | Operating and securing the service | Set by each provider; no fixed period promised | Provider rules |
Cookies, browser storage and analytics
Sign-in uses an essential HTTP-only cookie, with Secure and SameSite=Strict attributes in Production and a 24-hour session lifetime. Signing out invalidates the session. Passkey verification uses a separate essential HTTP-only, SameSite=Strict cookie for up to five minutes, also Secure in Production. Shopify authorization uses a separate essential Secure, HTTP-only, SameSite=Lax callback cookie for up to ten minutes.
When enabled, optional PostHog analytics helps us improve the public home, pricing and help pages. It records page views, clicks, scrolling and masked page replays only after you choose Allow analytics. Declining does not restrict the service. It does not measure eye movements.
Account, password and recovery pages, catalogs, store connections, store actions, file comparisons, the file check, the early-access form and example tools are excluded or masked. We do not identify you to PostHog using your account, email or shop. Input values and page text are masked in replays; console output and network request or response contents are not recorded. Query strings, URL fragments and referring URLs are excluded from analytics. These controls reduce collection; the provider still receives the network information needed to receive a request.
You can change your choice using Analytics preferences in the footer. Withdrawing stops further collection and reloads the page; it does not automatically erase earlier records. The browser saves your choice and its expiry for up to six months; that is how long your choice is remembered, not how long analytics records are kept. Global Privacy Control or Do Not Track prevents optional collection. Clearing browser storage removes the saved choice. Essential sign-in storage is separate.
PostHog processes permitted analytics for us through its European cloud service when the integration is enabled. Analytics records are separate from your account data, and closing an account does not automatically remove them. Contact us about a privacy request. We do not sell or share catalog data for advertising. Hosting may still process ordinary request and security metadata. See analytics provider information.
Optional advertising measurement
Advertising measurement has its own voluntary choice, separate from website analytics, account registration and payment. When it is enabled, choosing Allow advertising measurement lets us measure whether a Google ad click led to the first successfully saved catalog check or first verified paid subscription in an eligible new account. Declining does not affect access or price. An example, preview, unsuccessful check, test payment or renewal is not a new-customer conversion.
After you agree, this browser stores the Google click identifier from the landing page and your choice for up to 30 days. On sign-in we bind the choice to your account, with an expiry no later than that browser choice or our finite measurement period. When account consent expires, we stop new exports immediately and automatically clear its click identifier through a scheduled cleanup. Withdrawing account consent also clears that identifier. We keep a private consent and event record to enforce the choice and prevent duplicate reporting. These records can retain the status of requests already sent or with an uncertain outcome. Consent given after an event does not authorize reporting that earlier event.
Our protected server sends Google Ads, through the Data Manager API, only the click identifier, the event type and time, and a random identifier used to prevent duplicates. It sends no account email, catalog, payment credentials, payment identifiers or payment amount. Google can associate the click identifier with information it already has. We use no advertising pixel, enhanced conversions, remarketing or personalized audience list for this integration. Our server, rather than your browser, makes this conversion request.
Use Advertising measurement preferences in the footer to decline or withdraw. Global Privacy Control and Do Not Track prevent optional measurement in that browser. Withdrawal applied while signed in stops future queued exports and removes the locally stored click. If you are signed out, sign in again to apply withdrawal to the account, or contact support. Clearing browser storage alone does not notify the account or remove records already sent to Google.
A request already sent or being processed cannot safely be treated as unsent. Withdrawal does not automatically erase or retract earlier Google conversion counts. Contact us for a privacy request; we will assess the available deletion process and applicable rights. Closing the account removes its active local measurement records. Provider records and limited operational records may remain under their retention rules. See Google advertising provider information.
Unsaved editing and navigation state stays in the current page. A browser may restore page state when navigating back. Reloading the saved workspace uses the server version; reloading the local comparison discards its in-memory data.
Product thumbnails in the saved workspace can load directly from image URLs in your catalog. The image host receives an ordinary browser request, including network information such as your IP address. These images use no-referrer. The comparison tool displays values as text and does not fetch their images or product links.
Requests, contact and changes
You can contact the FeedGuard team through the public contact page without signing in, including for access, correction or deletion requests and security concerns. We may need proportionate verification before disclosing or deleting account information. Do not send passwords, recovery keys, tokens or identity documents with an initial request.
The service is intended for adults working with business product catalogs. Creating a free account activates no paid service and no marketing messages. This notice describes the current service; we publish changes here with an updated version, and earlier notices stay available exactly as published: October 25, 2026, before advertising measurement; Privacy notice before business-profile onboarding; September 25, 2026, with optional analytics; September 25, 2026, before optional analytics; September 24, 2026.