Security
Security and privacy
Short version: your records live on your computer, not on our servers. Here is exactly what the app does send, where it goes and why.
What stays on your computer
Your orders, sales, inventory, expenses, income and settings are stored in a database on your own machine. They are not uploaded to us, and we have no copy we could read, lose or hand over. Backups are files you keep on your own disk, and everything exports to CSV or Excel whenever you like.
Device Sync (iPhone app, beta)
If you link the iPhone app, your changes travel between your devices end-to-end encrypted. The key only exists on your own devices, so our sync relay only ever holds scrambled data and public keys, never anything readable.
What the relay can see is the outline: that your devices sync, when, and how big each change is. Not what is in it. Your pairing code is the key itself, so treat it like a password.
For the technical reader: XChaCha20-Poly1305 for the data, X25519 for key exchange and Ed25519 for signatures.
The licence check
To check your licence, the app talks to our licence server. It sends your licence key, a fingerprint of your computer, the app version, and your username and linked Discord name. No orders, sales or any other business data.
The fingerprint is how one licence stays on one computer. Switching machines? Unbind the old one in Settings > License and activate on the new one.
Email import
Email import is optional. If you turn it on, the app signs in to your inbox from your computer, and your login stays on your computer. It reads order confirmation emails to turn them into orders. It never sends, deletes or changes anything in your inbox.
Emails from shops the app already knows are read on your machine, start to finish. When an email is from a shop it does not know yet, the text of that one email is sent through our server to an AI model (Anthropic's Claude) so it can be read. We do not store it, but the AI provider does see it on the way through. Look-backs over older emails only use the on-device reader.
Sometimes the app offers a Send button so we can build a reader for a shop it cannot read yet. That email only reaches us if you press it.
Payments
Payments are handled by Whop. We never see your card details.
Other things that go online
- Parcel tracking sends your tracking numbers to the carriers to get updates.
- eBay, Vinted and Amazon connections talk to those platforms with your own sign-in, kept on your computer.
- The Checkouts panel is opt-in. If you connect your bots to it, their checkout events are stored on our dashboard so it can show them to you.
- The assistant sends your question to the AI to answer it. We keep that a chat happened, not what was said.
The full legal detail is in our Privacy Policy. Questions? Email [email protected].