Privacy Policy
Effective July 2026
1. What we collect
Account information: your email address and login details when you create an account.
Connected mailbox credentials: the app passwords or AYCD Inbox keys you provide so we can read your mail. These are stored encrypted and are used only to fetch messages.
Order data extracted from your emails: order numbers, items, totals, retailer names, shipping addresses on orders, and tracking numbers. We extract what is needed to build your dashboards.
Billing information: payments are processed by Stripe. We never see or store your full card number — Stripe sends us only what is needed to know your subscription is active.
2. What we do NOT do
We do not sell your data. We do not share your order history, your email contents, or your credentials with third parties for marketing.
We do not send email from your accounts, delete or modify your messages, or access mail unrelated to order tracking beyond what scanning requires to identify order emails.
We do not log into retailer websites or act on your behalf anywhere.
3. How credentials are protected
Mailbox credentials are encrypted at rest with AES-256 and decrypted only at the moment a scan connects to your mailbox. Access to production systems is restricted, and credentials are never written to logs.
4. Service providers
We rely on a small number of providers to run the service: Stripe (payments), Supabase (account login and data hosting), PostHog (product analytics), and an email delivery provider (receipts and account notifications). Each receives only what it needs to do its job.
If you connect an AYCD Inbox, your use of AYCD remains governed by AYCD's own terms and privacy policy.
5. Retention and deletion
Your data stays in your account while your subscription is active. You can export your orders at any time from the app.
If you cancel, you may request deletion of your account and all associated data at support@orderscrape.com, and we will honor it. Stored mailbox credentials are deleted immediately when you disconnect an account.
6. Analytics
We use PostHog to understand how the marketing site and app are used: pages visited, buttons clicked, features used, and session recordings of how pages are navigated. Everything typed into a form field, including passwords and mailbox credentials, is masked before it leaves your browser. Recordings show the page as you saw it, so they can include order details on screen; we use them only to fix problems and improve the product. We do not run third-party advertising trackers.
7. Changes
If we make material changes to this policy, we will notify you by email or in the app before they take effect.
8. Contact
Privacy questions or deletion requests: support@orderscrape.com.