Privacy Policy

Last updated 2026-10-27

This policy explains what Rowmoss (Zijian Xiao, China) collects and why.

What we collect

• Account: your email address and a scrambled (hashed) version of your password. We cannot read your password.
• What you add:
  • Supplier product CSV and conversion settings: validate and convert your file
  • Short-lived browser and network digests: isolate anonymous previews and enforce hourly limits
  • Browser digests, event categories and daily UTC counts: measure the funnel with explicit exclusions; retained for 30 days without IP addresses or file contents
• Account usage: when you signed up and, if this product records it, when you first unlocked your first complete product CSV. We use these times to understand whether the product is helpful.
• Payments: handled by Creem, our merchant of record. We never see your card details; we receive your email, what you bought, and the payment status.
• Payment identifiers: Creem order, subscription and transaction IDs and their internal account association, used for accounting. These are pseudonymous identifiers that can be linked to a person.
• Technical: your IP address, used briefly to stop abuse (for example too many sign-in attempts).

Cookies

We use only first-party cookies: one keeps you signed in, one protects forms, and one remembers which link first brought you here (for example a directory or a forum post) so we know which places help people find us. We count page views per day without storing your IP address. No advertising cookies and no tracking across other sites.

Who processes data for us

• Creem (payments and invoices)
• Our email provider (account and service emails)
• Our hosting provider (where the service runs)

We do not sell your data.

The operator's internal root sync process receives daily counts and payment records with raw payment identifiers for reconciliation. The operator's Radar business dashboard receives daily counts and payment records with hashed identifiers for business reporting. Both receive payment records without email addresses or the content you add. Hashing these identifiers does not make them anonymous.

How long we keep it

Account details and account usage records are kept while your account exists and deleted when you delete it.

Anonymous supplier files, settings and previews expire 24 hours after upload. Saving a preview to your account starts a 72-hour window. Unlocking starts a 72-hour download window. Expired files, previews and complete CSVs are deleted by the next cleanup run, which runs every 15 minutes. After expiry, upload and preview the file again; unlocking it again costs one credit. Unused credits do not expire.

Product event logs and daily summaries are retained for 30 days. They record visit exclusions, upload outcomes, successful previews, checkout session IDs and webhook-confirmed payments or refunds. Product event logs do not contain uploaded file contents or raw IP addresses. Browser digests are used to exclude repeat visits and owner or test traffic. Payment accounting records have the separate retention period below.

Creem and the operator retain accounting records, including payment identifiers and the internal account association, for as long as required by law, even after account deletion. These account-data and accounting retention periods also apply to the operator's internal sync process and Radar dashboard, including raw or hashed payment identifiers.

Your rights

You can see, change or delete your data from your account, or ask us at Contact support.