Account information
FeedGuard stores your email address, a password hash, a hash of your recovery key, account dates, the accepted Terms version and hashed session tokens with expiry times. Raw passwords and recovery keys are not stored in the account database. This information identifies your account, allows sign-in and recovery, and protects access.
If you add a passkey, we store its public key, credential identifier, chosen name, device transport and backup metadata, verification counter and use dates. Your private key and biometric data are not sent to FeedGuard. Short-lived verification challenges expire after five minutes. Account recovery removes passkeys and signs out sessions; removing a passkey also signs out other sessions.
Account confirmation and recovery emails are available only when the security sender is enabled. The account screen shows availability. When enabled, Resend receives your email address and a security message containing the link. We store one-use token hashes and limited delivery records, not raw links or message bodies. New requests replace previous links; confirmation links expire after 24 hours and reset links after 15 minutes. Email recovery requires a previously confirmed email, replaces the recovery key and invalidates sessions and passkeys. Marketing messages are not enabled.
Account and service records include registration and sign-in dates, confirmation status, connection information, usage records and saved support requests. Operational administrators may access underlying systems when necessary to maintain the service or handle incidents.
Catalog checks and browser-only comparisons
In the saved file workspace, selecting a file reads it in your browser. Running a check sends the catalog and supplied context to our server. A successful check saves the original catalog, the latest revised catalog and the report in your account. This file workflow does not send the catalog to an AI model, Shopify or Google Merchant Center.
The separate CSV comparison tool reads two files in your browser, using a unique identifier you select. It does not upload file contents, save them in your account or send their values to an external service. Comparison state stays in page memory. Clear or reload discards it; downloads stay on your device until you remove them. Loading the website itself still involves ordinary hosting requests and connection metadata.
Only provide product information you are authorized to process. Do not include buyer records, credentials, regulated data or other sensitive personal information. A secret detector can reject recognized credentials in an uploaded catalog, but cannot guarantee detection of every sensitive value.
Shopify connections and store actions
Shopify access is limited to the approved development store and may be unavailable. The connection screen shows actual availability. With separate permission, the integration can read products and variants, request aggregate sales reports and prepare supported product changes. Sales queries request product identifiers, quantities, revenue and recorded-cost totals rather than buyer or order identifiers.
Connection records include the shop domain, encrypted access and refresh tokens, requested and granted permissions, metadata and hashes of short-lived authorization state. Supported changes are sent to Shopify only after the relevant permission, an exact preview and your separate confirmation. The work history records outcomes, including uncertainty after interrupted requests.
When available and enabled, scheduled checks refresh data at your chosen interval and save results; they do not edit the store or send email. A separately enabled in-app digest saves a summary when findings change. A saved schedule preference does not itself prove that the integration or schedule is currently available.
Storage and removal
The file workspace retains one original and one current catalog/report plus up to 20 recent change summaries. The store workspace retains a current product/aggregate snapshot, short-lived change previews and a work ledger. Its interface shows the latest 30 runs; the ledger remains until account closure or a verified shop-data erasure request. There is no automatic inactivity deletion in the current service.
- Download: saves a copy of your current catalog or report to your device.
- Delete a report: removes the saved file report; it does not disconnect a shop or restore the free allowance.
- Disconnect a shop: clears local connection credentials, cancels monitoring and removes pending previews while keeping saved reports and work history.
- Close an account: removes active account-linked catalog, store snapshot, previews, ledger, monitoring preferences, passkeys, challenges, email-action and delivery records, sessions, support requests and connection data.
A verified Shopify shop-data erasure request removes the related imported catalog, connection, commerce snapshot, previews and ledger. Uninstalling the Shopify app clears local connection credentials but does not by itself remove the saved catalog.
If the free check was used, a hash of the normalized email address and the time the allowance was consumed remain after closure to prevent repeated free checks. This record has no automatic expiry. It does not contain the catalog, password or readable email, but it can still be linked to a supplied email by hashing that email; it is not anonymous information.
Security rate limits use counters keyed by hashed request identifiers. Hosting and database services process operational and connection metadata. Provider logs and backups can remain after deletion from the active application database; account closure does not erase them immediately. The service does not promise a fixed provider-log or backup erasure period.
Support emails are separate from account-stored support requests. Closing an account does not automatically delete mailbox correspondence. Contact us about relevant messages when requesting deletion. Downloads and any copies you make remain under your control.
Vercel hosts the application, Neon provides database storage and Google Workspace handles messages to our support address. Resend is used for account security emails when enabled. Provider information describes their functions and links to their own notices. The free service does not offer a US-only processing or data-residency commitment.
Cookies, browser storage and analytics
Sign-in uses an essential HTTP-only cookie, with Secure and SameSite=Strict attributes in Production and a 24-hour session lifetime. Signing out invalidates the session. Passkey verification uses a separate essential HTTP-only, SameSite=Strict cookie for up to five minutes, also Secure in Production. Shopify authorization uses a separate essential Secure, HTTP-only, SameSite=Lax callback cookie for up to ten minutes.
When enabled, optional PostHog analytics helps us improve the public home, pricing and help pages. It records page views, clicks, scrolling and masked page replays only after you choose Allow analytics. Declining does not restrict the service. It does not measure eye movements.
Account, password and recovery pages, catalogs, store connections, store actions, file comparisons and example tools are excluded. We do not identify you to PostHog using your account, email or shop. Input values and page text are masked in replays; console output and network request or response contents are not recorded. Query strings, URL fragments and referring URLs are excluded from analytics. These controls reduce collection; the provider still receives the network information needed to receive a request.
You can change your choice using Analytics preferences in the footer. Withdrawing stops further collection and reloads the page; it does not automatically erase earlier records. The browser saves your choice and its expiry for up to six months. Global Privacy Control or Do Not Track prevents optional collection. Clearing browser storage removes the saved choice. Essential sign-in storage is separate.
PostHog processes permitted analytics for us through its European cloud service when the integration is enabled. Analytics records are separate from your account data, and closing an account does not automatically remove them. Contact us about a privacy request. We add no advertising pixels or marketing cookies, and do not sell or share catalog data for advertising. Hosting may still process ordinary request and security metadata. See analytics provider information.
Unsaved editing and navigation state stays in the current page. A browser may restore page state when navigating back. Reloading the saved workspace uses the server version; reloading the local comparison discards its in-memory data.
Product thumbnails in the saved workspace can load directly from image URLs in your catalog. The image host receives an ordinary browser request, including network information such as your IP address. These images use no-referrer. The comparison tool displays values as text and does not fetch their images or product links.
Requests, contact and changes
You can contact the FeedGuard team through the public contact page without signing in, including for access, correction or deletion requests and security concerns. We may need proportionate verification before disclosing or deleting account information. Do not send passwords, recovery keys, tokens or identity documents with an initial request.
The service is intended for adults working with business product catalogs. No paid service or automated marketing is activated by creating a free account. This notice describes the current service; we will publish changes here with an updated version. Preserved notices: September 25, 2026, before optional analytics and September 24, 2026.