Privacy and your data

The one-sentence version

Your sales, royalties and advertising data are read into a database inside your own browser, stay there, and are never uploaded — and MerchPPC never sees, asks for, or has anywhere to put your Amazon password.

What lives where

In your browser. Your listings, sales history, royalties and advertising data — the whole database, including the raw responses Amazon sent. Your lookout rules, tags and notes, and the rank, review and search-position readings kept for your products. All of it in this browser profile's storage.

On merchppc.com. Your account and the email address you sign in with; which browsers are connected to it, what extension version each runs, when it was last seen and what it can read designs with; your plan; and any assistant grants you approved, with an audit row per assistant call.

There are smaller records too — security events, billing, where a signup came from, errors the servers hit. The full list, with how long each is kept, is on the privacy policy. That page is the authoritative inventory and it is held to it by a test that reads the database schema, so it cannot quietly fall behind.

None of it is your sales, royalties or advertising data.

How it reads Amazon

The extension signs in as you, in your browser, using the session you already have — the same pages and reports you could open yourself, fetched at a rate-limited pace with backoff.

It changes nothing on Amazon without a row in the Publish queue that you approved.

You will never be asked for your Amazon password. If anything ever asks you for it, that is not us.

What the trademark check sends

The Create page can check a phrase against trademark registers. This is the one check that asks the website: the extension sends only the phrase and the register (US, EU or UK) to merchppc.com over its connection. The site answers from its own copy of the public registers and sends back the marks that contain the phrase. It does not call a register while you wait, and it does not keep the phrase: not in a table, not in the log. Nothing else about your listing or your account travels with it. See Trademark checks.

Rank tracking and sales rank

Reading Best Sellers Rank, reviews and search positions is done by your own browser, which loads public Amazon pages from your own connection, and the readings are kept in your browser. They are not uploaded, and no server reads those pages on your behalf. See Rank tracking.

When you connect an account

Connecting to merchppc.com authenticates the extension's connection. It does not upload your database.

If you switch on an assistant integration, questions and answers pass through our relay while you use it, and the relay stores neither. Claude and ChatGPT are separate grants, each revocable in one click at Account → Assistants.

One answer carries something you have not published: if you allow the batch permission, an assistant choosing garment colours or products can ask to see a design waiting in your batch. What it is shown is a small preview — a few hundred pixels, re-encoded, drawn on a white and a dark ground — and a few measurements taken from it (how dark its ink is, its main colours, how much of the canvas it fills), never the print file, and it passes through the relay like any other answer, unstored. On ChatGPT, which passes no picture from an app to its model, the design also travels once more as an even smaller picture — at most 256 pixels, a few kilobytes — written out as text, which ChatGPT's model turns back into a picture with its own tools and looks at. All of it is sent to that assistant's provider as part of the conversation, so their own terms apply to it. Privacy mode in the extension's settings refuses it outright, the same switch that keeps product photos out of every answer.

The extension can also read your designs on your own computer, and it does nothing of the kind until you switch it on in the batch panel. Switched on, it reads each design in your batch with a small text reader — about 31 MB, downloaded once from merchppc.com — and, on computers that can run it, with the AI model built into Chrome, which is only downloaded after you agree to it. The reading happens in your browser, and nothing is sent anywhere while it runs. What an assistant can then receive, with the batch permission, is a short text description of each design, read on your computer: the words printed on it and a sentence about what it shows, beside the preview and in the batch list. It travels like the preview — through the relay, unstored, to that assistant's provider as part of the conversation — and privacy mode withholds it exactly as it withholds the preview.

The one thing merchppc.com learns about reading is one short line per browser, sent each time it connects: whether reading is switched on, whether the text reader is ready, and whether Chrome's AI is ready, still to download, unavailable or too slow on that computer. It is sent whether or not you switched reading on, because asking Chrome what it could run reads nothing. It says nothing about any design, and it is only ever counted — to decide which readers are worth building.

The extension's own records

Besides your data, the extension keeps a few records about itself, in the same browser storage. None of them is uploaded by the extension, and the extension has no analytics or telemetry.

A debug log. Timestamped lines of what the extension did: which step ran, how long it took, how many rows came back, the status of each request, and any error. Request addresses are kept without their query strings. The lines are about the extension, not about your catalogue: none is written to hold a response from Amazon, a product title, a search term or an amount of money. Some do name a marketplace, an ASIN, your Merch account id or an advertising account id, and an error message is recorded as it came, so it can contain a value. The log is always on. It keeps the latest 8,000 lines for each part of the extension and drops the oldest; there is no time limit. Data health → Diagnostics has Download debug log and Clear log.

The last crash. If the dashboard or the background worker fails, the error message and its stack trace are kept, one record of each kind, replaced by the next. For 30 minutes afterwards Report a problem offers to quote it, with your account and advertising ids already replaced; the quote is yours to edit or delete before you send.

Reports waiting to be sent. A report you pressed Send on while merchppc.com could not be reached waits in the browser, files included, and is tried again by itself. Data health lists it and lets you discard it.

These records leave the browser in two ways, and both are yours. A report you send carries what the form lists under Exactly what gets sent, plus any file you attach: the debug log goes only if you download it and attach it, and by default your account id, advertising ids and anything shaped like an ASIN are replaced in an attached text file first. And an assistant you connected can ask how the extension is doing: it is told the state of the sync, the database and the connection, with any error text, not the debug log and not the crash record.

What deleting looks like

Uninstall the extension, or clear the browser's storage. The local database is gone. Nothing of it exists anywhere else; a re-install re-syncs from Amazon, slowly.

Delete this browser's data (Data health → Diagnostics). The database is emptied and the sync starts over. From version 1.0.0 this also empties the debug log, the crash records and the last connection error; a problem report still waiting to send is kept, and the card says how many, until it is sent or you discard it under Problem reports. In earlier versions those records are not part of it: Clear log empties the log. Your settings and the link to your MerchPPC account stay in every version, and uninstalling removes everything.

Revoke an assistant grant. That assistant loses access immediately. The other grant is untouched.

Delete your MerchPPC account. Asking us to erase it starts a seven-day countdown, and nothing is destroyed until it runs out — cancelling in the meantime leaves nothing behind. When it runs, every table that points at your account is emptied. A few records are not attached to your account and survive; the privacy policy names each one and says why, rather than letting you assume otherwise. Your local database — your data — stays yours, in your browser.

The trade, in both directions

Nobody else holds your numbers, and there is no cloud backup either. A second computer starts its own sync from zero. Data health and sync covers what that means day to day.