Privacy Policy for eyeCARD Chrome Extension

Overview

eyeCARD ("we", "us", or "the extension") is a Chrome browser extension that provides psychological analysis of marketplace product cards. This privacy policy explains what data we collect, how we use it, and your rights.

1. Account & Authentication Data

Authentication is performed using your Telegram username as a login and a password that you set. The following data is processed:

• Telegram username (login): Your Telegram username, used as the unique account identifier. We do not collect email addresses or phone numbers.
• Password hash: Your password is stored on the backend only as a bcrypt hash. The plain-text password is never retained.
• Telegram ID: Your Telegram user identifier, used to link your extension session to your account and deliver reports via the Telegram bot.
• JWT token: A session token stored locally in your browser (chrome.storage.local) to authenticate API requests.
• Coin balance: The number of eyeCARD coins in your account, cached locally for performance.

2. Product Card Data

Sent to backend only when you explicitly request analysis by clicking the "Analyze" button:

• Product images: Binary image files from the product card you are analyzing (downloaded from your browser cache, not from the marketplace directly).
• Product text: Product name, description, and attributes extracted from the page you are viewing.
• Marketplace identifier: Which marketplace the card is from (Wildberries or Ozon).
• Product SKU: The unique identifier of the product on the marketplace.

3. Telemetry

• Anonymous client ID: A random identifier generated locally to distinguish extension instances.
• Usage events: Events like extension_opened, analysis_clicked, with parameters (marketplace, SKU, timestamp).
• No personal data: Telemetry does not include your Telegram username, Telegram ID, or any identifiable information.

4. Local Storage (never sent to backend)

• Analysis cache: Results of past analyses, stored locally for 30 days to avoid re-analyzing the same product.
• UI preferences: Menu settings, language preference, etc.

5. How We Use Your Data

• Telegram username, Telegram ID & JWT: To authenticate you, track your coin balance, and deliver reports to your Telegram account.
• Product images & text: Solely for the purpose of psychological analysis (the single purpose of the extension). Data is processed on our backend and not stored permanently.
• Telemetry: To improve the extension's performance and user experience. Data is aggregated and anonymized.

6. Data Sharing & Third Parties

• Backend processing: Product data is sent to our FastAPI backend hosted on Google Cloud Run (GCP, us-central1 region). We do not share your data with any other third parties.
• Payments: If you purchase additional coins, payment processing is handled by ModulBank (a Russian payment service) via our Telegram bot. We do not store your payment credentials or financial data in the extension or backend.
• No data selling: We do not sell, rent, or trade your personal data to any third party.

7. Data Retention

• JWT token: Stored locally until you log out or the token expires.
• Analysis cache: Automatically deleted after 30 days.
• Backend logs: Server logs may retain IP addresses and request metadata for up to 30 days for security and debugging purposes.
• Telemetry: Aggregated data is retained indefinitely; individual events are not linked to your identity.

8. Your Rights

You have the right to:

• Access: Request a copy of the data we hold about you (contact us via the email below).
• Deletion: Request deletion of your account and associated data (Telegram username, Telegram ID, analysis history, and balance) by logging out of the extension and contacting support.
• Opt-out of telemetry: Telemetry can be disabled in the extension settings (menu → preferences).

9. Data Security

• All API communication uses HTTPS encryption.
• Passwords are stored as bcrypt hashes; plain-text passwords are never retained.
• JWT tokens are stored in Chrome's secure local storage.

10. Children's Privacy

The extension is intended for adult users (marketplace sellers). We do not knowingly collect data from children under 13.

11. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

12. Contact Us

If you have questions about this privacy policy or wish to exercise your data rights, contact us:

• Email: support@eyecard.ru
• Website: eyecard.ru
• Telegram support: @eyecard_support