Privacy

A few things are kept in your own browser rather than on our servers.

• Your theme choice (light, dark or system) and your recent checks, the last few products you looked up, are kept in your browser's local storage.
• An API key you choose to keep for the tab, on Check your key or in the docs' “Try it” panels, is kept in session storage and cleared when you close the tab. The key is only ever sent to TrackPin's own API, in a request header.

You can clear all of these at any time from your browser's settings.

The TrackPin extension runs only on amazon.com pages. On a product page it reads the product ID (ASIN)from the page and sends only that to TrackPin to get the product's verdict. It doesn't read anything else on the page, your Amazon account, your cart or your searches, and it sends nothing from other websites.

The extension stores one setting in your browser: whether the card is switched on. It has no account and no key, and it doesn't use cookies. To limit how many lookups one network can make, our server counts requests by a hashed IP address, in memory only. Like every request to our site, a lookup is recorded in our web server's access log (your IP address and the address asked for, which includes the product ID), kept for 14 days for security and then deleted.

When you request an API key, we store what you enter: your name, email, company, the plan you chose, your use case and your expected volume (and, for Enterprise requests, the needs you tick). We also store a hashed IP address (a one-way hash, not the address itself) and your browser's user agent, to limit spam and repeat submissions.

We use these details only to issue your key and to support you while you use it. We don't sell them or use them for advertising.

We keep a request for up to 12 months, then delete it.

For each API key we count requests per day, to enforce its daily quota. Calls made through RapidAPI are counted per day too, under a pseudonymous id (a hash of the RapidAPI username), to apply per-minute and live-check limits. These counters are deleted automatically after 2 days.

API keys are stored as a one-way hash, so nobody at TrackPin can read your full key back. Keep your key somewhere safe; you can reset it if you lose it.

Pro and Business are paid by card through Stripe. You enter your card, email and billing details on Stripe's checkout page, and Stripe handles them under its own privacy policy; they never reach our servers. We keep only Stripe's ids for your customer record and subscription next to your key's hash, so the key gets the plan you pay for.

We keep the email a key was sent to or paid with next to the key, so you can sign in to manage it. Free keys are sent as a one-time link that works for 7 days. Signing in has no password: we email you a one-time link through our email provider, Resend. The link expires after 15 minutes and a sign-in lasts 30 days, kept in a cookie that only the developer pages use. We store only a hash of each link and of the sign-in, and we use your email for nothing else.

When you set a price alert on a product page, we store your email address, the product, the alert you chose, the price when you set it, and when. We email you a link to confirm it through Resend; an alert you don't confirm is deleted after 7 days. A confirmed alert sends you one email when the price drops, then stops; it is deleted 30 days after it's sent, or after 180 days if the price never drops.

Every alert email has a link to stop that alert and one to stop all of yours; stopping deletes them at once. We use your email for nothing else: no newsletter, and it's never shared or sold. To stop people flooding an inbox with sign-ups, we briefly count requests per IP address in memory, without storing it.

When you ask for a product we don't track yet (on its page, through the API or with the extension), our server checks it on amazon.com and, if amazon.com lists it, adds it to the products we track. From then on it's on TrackPin like any other product, with the date we started tracking it. Who asked isn't stored with it.

On the website, to limit how many of these checks one visitor can start (2 at once, 20 a minute), we use a hashed IP address(for IPv6, of the first 56 bits). It's kept in our server's memory only, not in our database, and is gone after a restart.

Every page loads Google Analyticsso we can see which pages are read, where visitors come from and which visits end in a free key or a paid plan. Google receives the address of the page you're on (without one-time links or checkout ids, and including what you searched for on TrackPin), your IP address, which it doesn't store, and browser and device details. With your consent it sets the _ga cookies, kept up to 14 months, to tell repeat visits apart. We see totals and trends, not who you are.

We advertise on Google, and every page loads the Google tag (Google Ads) so we can tell which ads bring visitors, and which visits end in a free key or a paid plan. Google receives the address of the page you're on (without one-time links or checkout ids), your IP address and browser details, and, if you arrived from one of our ads, the ad click. With your consent it sets advertising cookies (such as _gcl_aw, kept up to 90 days) and may use the visit for ad personalisation.

Google handles this under its own privacy policy. Apart from page addresses, we send Google nothing you type, and never email addresses or API keys.

UK, EEA and Switzerland: nothing is stored and analytics and ad signals stay off until you press Accept on the banner. If you reject, Google gets only cookieless signals without personalisation. Elsewhere: these cookies are on by default. If your browser sends Global Privacy Control, we turn off ad personalisation and the sharing of ad data wherever you are. Your choice is kept in your browser's local storage.

Change cookie choice

• No shopper accounts. Checking prices and setting price alerts never need a sign-in; only developers who buy a plan can sign in, by email link.
• No other ad networks.Google Ads is the only advertising script on TrackPin, and we don't sell your data.
• No other analytics.Google Analytics is the only analytics script, and we don't use it to identify you.

Product photos load directly from Amazon's image servers, without telling them which TrackPin page you're on. When you follow a link to amazon.com, Amazon's own privacy notice applies there.

Those links pass through trackpin.co/go/ first, which adds one to a daily count for that product. Nothing about you is stored with the count: no IP address, cookie or device details. Amazon still isn't told which TrackPin page you came from.

TrackPin is an Amazon Associate, so the link carries our Associates tag. That tells Amazon the visit came from TrackPin, and Amazon may set its own cookies to credit us if you buy. Amazon's privacy notice covers those cookies; TrackPin never receives your order details, only totals per product.

If this page changes, the date at the top changes with it.

Questions about privacy? Email [email protected].