Privacy Policy

Public browsing

You can browse the public catalog without creating an account. We do not currently operate public account registration, contact forms, newsletters, Google Analytics, advertising trackers, or fingerprinting.

On instrumented pages, we record first-party referral and interaction events such as campaign landings, Product views, and user-initiated merchant clicks. A random session identifier in session storage is also set as an HttpOnly cookie without a persistent expiry, so our server can connect those events. Events may include page path, language, creator/campaign IDs, Product/Offer IDs, and environment. They are not tied to a name or email address.

Outbound click records

When you choose a non-Amazon merchant link through our /go route, we record the selected Offer, Product and merchant identifiers, the chosen language, the time, the session identifier, and creator/campaign attribution when available. When supplied by your browser, the referrer is reduced to its origin and path. We use this minimal record to operate and understand outbound navigation. It is not proof of a sale or conversion.

Amazon links go directly from your browser to Amazon using the stored link. A user-initiated click may be included in our first-party funnel-event records, but it does not create a /go redirect log. Neither record proves a sale or conversion.

• We do not intentionally store an IP address in the application click table.
• We do not attach a name, email address, advertising ID, or browser fingerprint to these event records.

Administrative authentication

Authorized administrators use Supabase authentication. Supabase session cookies are used to maintain and protect those private sessions. Public visitors do not need an administrative session.

Infrastructure and operational logs

The application runs on Cloudflare Workers and stores application data in Supabase. Those providers may process network and operational information under their own policies to deliver, secure, and diagnose their services. We do not claim that infrastructure logs are the same as our minimal application click table.

Services not currently used for public data

The public product does not currently send visitor prompts or personal data to OpenAI. Resend is not currently used for a public newsletter or contact workflow. If those behaviors change, this policy should be updated before or when the feature is introduced.

Retention, choices, and corrections

A specific public retention period has not yet been adopted and requires legal and operational review. The session cookie has no persistent expiry; session and event records remain subject to the application retention policy, which is still under review. You may avoid merchant click records by not using merchant buttons; page views and interactions on instrumented pages may still be recorded. For privacy-related inquiries, email privacy@siftorio.com. For product-data corrections, use the address on the Contact page.

Children and changes

The service is intended for general U.S. shopping research and is not directed to children. We may update this policy when actual practices change and will revise the date shown above.