Privacy Policy

1. About This Policy

This policy explains how Pricemist processes personal data when you use our website, web app, browser extension, or mobile app.

Data Controller: Jacek Polecki Business Services (NIP PL5423022046), a registered business in the European Union. For privacy questions or requests, use our monitored contact form.

2. Information We Process

The information we process depends on the features you use. Some comes from you; some comes from your device, sign-in or payment provider, retailers, or people who interact with your shared content. You can choose whether to add optional profile information, upload photos, or share collections. Account and purchase information is needed to provide the corresponding features.

2.1 Account and profile data

This includes your email address, name or username, sign-in provider and identifiers, account and notification preferences, country, subscription state, and support communications. Apple or Google sign-in may provide profile details according to the permissions you grant. If you join a waitlist, we use the details you provide for the update you requested.

Public profiles and collections can show the handle, display name, bio, collection text, selected products, notes, and approved avatar you choose to share. Public pages may appear in search engines. An unlisted collection is accessible to anyone with its sharing link, and recipients can forward that link. Changing sharing settings cannot recall copies others have already made.

2.2 Avatars and product photos

Avatars are reviewed before public display using automated safety checks and, where needed, authorized staff. This can involve sending the image to an AI service provider such as OpenAI. Pending images are held in private storage; rejected images and review records may be retained for moderation, appeals, or legal needs as described below.

Photos submitted to identify products are processed by image-identification and search providers. This can involve temporary storage and a short-lived access link for the provider. These uploads are used for identification and offer matching, rather than added to your public profile or kept as a personal photo library. Product images obtained from retailers may be stored with saved products.

2.3 Saved-product and activity data

We store saved URLs, product and price history, collection membership, watch and alert settings, purchase/return details you enter, coin ledger entries, and feature activity needed to provide and secure the service.

2.4 Device, push, and diagnostics data

We may process browser or app version, operating system, IP address, approximate location derived from it, security logs, and crash or performance diagnostics. Mobile notifications use an Expo push token to address your app installation. Device records are deactivated for delivery when you sign out, delete your account, or disable the registered device; deactivation does not necessarily erase the record immediately.

2.5 Billing and purchase verification

Paddle handles web checkout and Apple handles App Store purchases. Pricemist does not receive your complete card number or Apple payment credentials. We receive and retain purchase identifiers, subscription and payment status, and verification records needed to provide Plus and coins, resolve billing issues, prevent duplicate benefits or fraud, and meet financial-record obligations.

2.6 Analytics

We use analytics and attribution tools, including PostHog and, on supported web pages, Google Analytics and Fastlane, to understand visits, feature use, reliability, and how people find Pricemist. Data can include page visits, interactions, purchase states, errors, referral information, device context, and approximate location. Signed-in web and mobile activity may be linked to your account identifier and profile details, including email and name.

PostHog session replay may record interactions and displayed content on supported web and mobile screens to help investigate problems and improve usability. Input masking and filtering are used where supported to limit collection of sensitive information. Moderation event analytics exclude report details and rejected public-content text.

3. Public Content, Reports, Blocks, and Moderation

Public sharing is optional. We filter public text at publication boundaries and review user-uploaded avatars before they become public. Signed-in users can report public profiles, collections, and shared items, and can block another account. Blocking limits what the two signed-in accounts can see or do with each other's public content; anonymous public pages remain reachable by design.

Reports can include account and content identifiers, a reason, optional details, relevant evidence, and review records. Authorized staff may use this information to investigate, moderate content, handle appeals, and address legal or security issues. A report alone does not automatically cause account deletion.

Resolved reports are normally scheduled for deletion after 24 months. Open cases and records needed for a legal or security matter may be kept longer. Account deletion removes or redacts eligible account links and report details, and removes associated block records. Retention depends on the case and the requirements described in section 6.

4. How We Use Information and Our Legal Bases

• Provide accounts, saved products, monitoring, alerts, public sharing, coins, subscriptions, and support
• Verify purchases, fulfill benefits, reconcile provider records, and process or record refunds and revocations
• Deliver service messages, price alerts, optional push notifications, and requested waitlist updates
• Send relevant product tips and Plus offers, taking account of your plan, feature use, notification preferences, and applicable marketing rules
• Prevent fraud, abuse, duplicate grants, unauthorized access, and unsafe public content
• Measure reliability and product usage and improve the service
• Comply with legal, tax, accounting, safety, and dispute-resolution obligations

We rely on performance of our contract with you for account, shopping, sharing, and paid features; legal obligations for required financial records and lawful requests; and legitimate interests for security, fraud prevention, support, service improvement, and permitted customer communications. Those interests are balanced against your rights. Consent is the legal basis where required, including for relevant optional tracking or marketing.

5. Sharing and Service Providers

We do not sell personal data. We share information as needed with providers for hosting and storage, email, Expo push delivery, product identification and price monitoring, analytics and attribution, billing, safety checks, and support. These include the providers named above and AI, search, and monitoring services such as OpenAI, SerpApi, and Firecrawl, depending on the feature. Authorized staff and advisers may access information when needed for support, security, business administration, or legal matters.

Apple, Paddle, sign-in providers, and retailers may also handle information as independent controllers under their own privacy policies. Retail links may include affiliate identifiers, allowing us to earn a commission without changing your price. The browser extension's handling of retailer links is described separately below.

We may disclose relevant information to meet legal obligations, protect rights or safety, prevent fraud, resolve disputes, or support a merger, acquisition, or sale of the business, subject to applicable protections. Processing may take place outside the EEA. Where required, transfers rely on an adequacy decision or safeguards such as Standard Contractual Clauses. You can contact us for information about the safeguards relevant to your data.

6. Retention and Account Deletion

Retention depends on the type of information, why it is needed, your account activity, and applicable legal requirements. Account and library data is generally kept while you use the service. Support, security, and analytics records are kept for the periods needed to resolve issues, investigate abuse, understand service performance, or meet legal obligations. Financial and purchase records may be retained after account deletion for accounting, refunds, fraud prevention, payment reconciliation, and legal claims. Data that no longer needs to identify you may be deleted or anonymized.

In-app account deletion disables access, removes your library and public profile from the service, removes identifying details from the active account, deactivates push delivery, and removes or redacts eligible related records. Avatar removal includes background storage cleanup; rejected avatars are normally scheduled for cleanup after 30 days unless needed for a held case. Limited billing and security identifiers may remain to recognize later provider events and prevent duplicate benefits.

Deletion from the active service does not necessarily remove every backup, log, or record held by a provider at the same time. Remaining records are subject to the retention purposes above. Retailer product and price information that is not tied to your identity may remain in the shared catalog. Copies of public content held by search engines or other people may remain outside our control; this does not limit your statutory rights.

Deleting Pricemist does not cancel an App Store or Paddle subscription. Cancel it with the provider that sold it to stop renewal, as explained in our Terms of Service.

7. Browser Extension

When you ask the extension to save a product, it reads that page's address and available product details—such as name, price, currency, image, and structured product data—and sends them to Pricemist. If you enable the optional site-access permission for the floating save button, the extension also reads pages you visit locally to detect whether a product is present and to display the button; that page content is not transmitted unless you save. While you are signed in, the address of a detected product page may be sent to Pricemist to check whether it is already in your library. We do not build a general browsing history from your browsing.

Local browser storage holds authentication state, your signed-in account's basic details, preferences, a bounded recent-saves list, saves waiting to retry, short-lived caches of your own collections and watch count, product-detection settings, and a random per-installation identifier. The extension sends bounded usage events—such as install, permission granted, and save outcome with the store domain—to measure and improve the extension; after you sign in, that installation identifier is associated with your account. Host, cookie, active-tab, scripting, alarms, context-menu, and storage permissions support these functions and communication with Pricemist over HTTPS. The extension does not add or modify affiliate parameters on the store links you open from it.

Pricemist's use of information received through the browser extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

8. Security, Cookies, and Your Choices

We use technical and organizational measures appropriate to the information and risks involved, including access controls and encrypted transport. Safeguards evolve with the service, and no system can guarantee absolute security.

Cookies and similar storage support sign-in, security, preferences, attribution, and analytics. You can control browser storage and optional notifications through your browser or device, although blocking essential session storage may prevent sign-in.

You can manage email preferences in the app or use an unsubscribe link where provided. Essential account, security, and purchase messages may still be sent. Contact us to object to direct marketing or raise a question about tracking and your choices.

9. Your GDPR Rights

Depending on the processing and applicable law, you may request access, correction, deletion, restriction, or portability, and object to processing based on legitimate interests. You can object to direct marketing and withdraw consent where it is the basis for processing; withdrawal does not affect processing that was lawful before it. You may complain to your local data-protection authority or Poland's Personal Data Protection Office (UODO).

Use our contact form to exercise a right. We may verify your identity and will respond within the period required by law.

10. Children and Automated Decisions

Pricemist is not intended for children under 16. We do not use solely automated decision-making that produces legal or similarly significant effects. Public-content filtering and fraud signals may restrict an action, but staff review and the monitored contact/appeal route remain available.

11. Policy Updates and Contact

We may update this policy as our service, providers, or legal requirements change. The date above identifies the latest revision. We will provide additional notice or obtain consent where the law requires it.

For privacy questions, rights requests, moderation appeals, or concerns about this policy, use our monitored Contact Form.