DealWorm Privacy Policy

Last updated: October 22, 2026

DealWorm is a Chrome extension that estimates what an item on a web page is worth. This policy covers the extension, its credits service and this website (dealworm.xyz). It explains what the extension reads, what it sends and to whom, what is stored and for how long, and the choices you have.

"We" and "us" mean the developer of DealWorm. Contact: nlorsung@gmail.com

Summary

• The extension reads a page's content only when you ask it to value that page, by clicking its toolbar icon or its right-click menu. With optional photo access, it also checks the address of a tab you switch to against your saved items.
• To value an item it sends the page's details, photos and a screenshot to Anthropic, the company that makes the Claude AI. It sends your search words to eBay.
• You can pay for the AI in two ways. With your own Anthropic API key and no sign-in, nothing comes to us: your browser talks to Anthropic and eBay directly. With credits, you sign in with Google, and our server keeps your email address, your balance and a record of your purchases and charges. The photos and page text of a check pass through our server on the way to Anthropic, and we don't store them.
• Stripe handles payments. We never see your card number.
• Your saved items, buyers, lists and watchlist stay in your browser.
• We don't sell your data, use it for advertising, or use it for anything except running DealWorm.
• This website has no cookies, analytics or trackers.

1. What the extension reads, and when

When you click the toolbar icon or one of its right-click menu items on a page, the extension reads these from that tab:

• the page's address and site name;
• the title, the price and currency shown, and the brand and condition if the page lists them;
• the first 800 characters of its description;
• the web addresses of the item's photos, up to 24;
• any text you had selected, or the photo you right-clicked.

It also takes a screenshot of the visible part of that tab, which shows whatever is on screen in it. A page's first check starts as soon as the panel opens on it, so close anything private on the page before you click the icon. For later checks, you can leave the screenshot or any photo out by clicking its tile in the panel.

If you turn on optional photo access in Settings:

• the extension downloads the selected photos itself, without sending your cookies, instead of passing their web addresses on;
• when the side panel is open and you switch tabs, it compares the new tab's address with your saved items. If you valued that page before, it reads the page again to show the saved result. Nothing is sent anywhere unless you run a check.

Apart from the daily eBay searches for items on your watchlist (section 2), the extension doesn't load or read pages in the background. It doesn't record the pages you browse.

2. What is sent, and to whom

Anthropic (the Claude AI)

Used for identifying the item, checking which sold listings show the same item, web searches for current listings and prices, "Find buyers", "Scrap & lot value", and the optional model test, which sends the same request to other Claude models.

What is sent:

• the page's address, site name, title, price, brand, condition and description, and any text you selected;
• the photos you leave selected (6, 12 or 20 at most, per Settings), and the page screenshot unless you switched it off. With photo access, enlarged close-ups cut from the photos are sent too. Without it, photos are sent as web addresses and Anthropic downloads them from the website;
• the eBay sold listings found (titles, prices, sale dates and thumbnail addresses) and the search words;
• your country, and your ZIP or postcode and distance if you set them;
• for "Find buyers": the item's saved details (name, brand, model, variant, condition, the listing title, the search used, the estimate, and your asking price and tags if set) and its small preview image.

Claude's web searches are run by Anthropic using these details, with your country as the approximate location.

How it is sent:

• With your own API key, it goes straight from your browser to api.anthropic.com, using your key.
• With credits, it goes to our server, which forwards it to Anthropic with our key and sends back the answer.

Anthropic's commercial terms say it may not train models on customer content (https://www.anthropic.com/legal/commercial-terms). By default Anthropic deletes API inputs and outputs within 30 days. Content its safety systems flag can be kept for up to 2 years (https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data). The web-search filtering that Opus and Sonnet use runs code, and Anthropic keeps that working data for up to 30 days (https://platform.claude.com/docs/en/manage-claude/api-and-data-retention).

eBay

To find recent sales, the extension loads eBay's public "Sold items" search for your country (ebay.com, ebay.ca, ebay.co.uk or ebay.com.au). The search includes:

• the search words (from the page title, the AI's identification, or what you typed);
• your ZIP or postcode and distance, if you set them.

These requests come from your browser with your eBay cookies, so eBay sees them as your own visits, as your account if you're signed in to eBay. Items on your watchlist are searched again once a day while Chrome is open. eBay's User Privacy Notice: https://www.ebay.com/help/policies/member-behaviour-policies/user-privacy-notice-privacy-policy?id=4260

Our server (credits only), hosted by Supabase

Our server is a Supabase project in the United States (Ohio).

• Sign-in: Google gives the extension a sign-in token (through this website, as "Google" below explains), which the extension passes to Supabase Auth, our sign-in service. Supabase Auth keeps your Google account's email address and Google account ID. It also keeps the basic profile details Google includes in that token (your name and profile picture address), when you signed in, and a record of each active sign-in session until you sign out. Your sign-in tokens are saved in your browser.
• Account: We keep your credit balance and a ledger. For each purchase the ledger records the pack, the amount and currency, Stripe's Checkout Session and event ids, and the time. For each AI request it records the amount charged, what Anthropic charged us, the model requested and the model that answered, the numbers of tokens and web searches, and the time. It also records the free-trial credit.
• Free trial: We keep a one-way fingerprint (hash) of your email address so that the $0.25 free trial is given only once per email address. It's kept even after you delete your account, and is used only for that.
• Checks: The photos, page text and other request content pass through our server to Anthropic and back. We don't store them.
• Technical logs: Supabase keeps short-lived logs of requests and sign-ins, such as the time, the address requested, your IP address and browser type. They're kept for about 7 days.

Supabase's privacy policy: https://supabase.com/privacy

Google (credits only)

Google's sign-in page opens in its own window. We ask Google only for your basic identity: openid, email and profile. Google learns that you signed in to DealWorm. We don't access any other Google data, such as Gmail, Drive or contacts.

When you've signed in, Google sends the sign-in token to dealworm.xyz/auth/callback, in the part of the web address after the "#". Browsers don't send that part to any server, so the token never reaches the website's host. The page passes it straight to the extension, and doesn't keep it or send it anywhere else.

The use and transfer of information received from Google APIs by DealWorm adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy). Google's privacy policy: https://policies.google.com/privacy

Stripe (only when you buy credit)

Stripe's checkout page opens in a new tab. You enter your card details there, and Stripe processes the payment under its own privacy policy (https://stripe.com/privacy). We send Stripe the pack you chose, your account number, and your email address, which Stripe fills in on its page.

When the payment goes through, Stripe notifies our server. That notice includes the details you entered at checkout, such as your email and billing country. We keep only what the ledger entry above lists. We never see your card number.

This website (dealworm.xyz)

This website is hosted by Vercel. It has no cookies, analytics or trackers, and it doesn't load anything from other websites. To serve the pages, Vercel processes the usual details of each request, such as your IP address, browser type and the page asked for. Vercel's privacy policy: https://vercel.com/legal/privacy-policy

Websites and links

• With photo access, photos are downloaded from the websites that host them.
• The panel shows links to search other marketplaces and to image search (Google Lens, Bing Visual Search). They open only if you click them, and the image-search links contain the photo's web address.

3. What stays in your browser

The following is kept in Chrome's storage for the extension on your computer. It isn't synced to your other devices, and nothing in it is sent anywhere except as section 2 describes.

• Settings: country, optional ZIP or postcode and distance, your Anthropic API key if you use one, your message signature, and model and photo choices.
• Saved items. Each one keeps:
  • the page address, site, title and listed price, and its photo addresses;
  • a small preview image, made from the first downloaded photo, or else from the screenshot;
  • the identification, the sold listings and web listings found, the estimates, and the history of checks with their costs;
  • the status, asking price, tags and notes you add;
  • any "Find buyers" and scrap results.
• Buyers you add (the names, contact details and notes you type), lists, and your watchlist (searches, area and price history).
• Model test results, if you use the model test.
• With credits: your sign-in session (access and refresh tokens, account id and email) and your last known balance.

Chrome's temporary session storage also holds the page a click asked to value, and a 30-minute cache of AI answers so that a retry isn't charged twice. That storage is cleared when Chrome restarts.

Messages, catalog files and spreadsheets you create are copied or saved by you. The extension doesn't send them anywhere.

All of this is deleted when you remove the extension.

4. What we don't collect

• your browsing history, beyond the pages you ask it to value;
• your keystrokes, clicks, mouse movements or other activity;
• cookies, passwords or other data from the websites you visit;
• anything from other tabs (except, with photo access, the address of a tab you switch to, which is checked against your saved items in your browser);
• analytics or tracking data. The extension and this website have no analytics, ads or trackers.

Your own Anthropic API key and your buyer profiles never reach us.

5. How we use data

We use data only to provide DealWorm's features:

• valuing items;
• running credits: signing you in, keeping your balance, billing AI requests, giving the free trial once, and preventing abuse;
• answering your support requests;
• meeting legal obligations.

We don't sell or rent your data. We don't use it or share it for advertising, and we don't use it to decide creditworthiness or for lending. We share data only with the services described in section 2, and only to provide the feature you're using, or when the law requires it.

The use of information received by DealWorm adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

6. How long data is kept

• In your browser: until you delete it in the extension or remove the extension.
• Request content (photos, page text): not stored by us. Anthropic keeps it as described in section 2.
• Your account, balance and ledger: until you delete your account. Deleted data can remain in Supabase's daily backups for up to 7 days.
• The email fingerprint used for the free trial: kept after account deletion, only to prevent a second trial.
• Supabase technical logs: about 7 days.
• Stripe keeps its own payment records as its privacy policy and the law require.

7. Your choices

• Use the extension without an account: Enter your own Anthropic API key instead of signing in. Or don't use the AI at all: you still get eBay sold listings.
• Turn off the AI check in Settings. Then nothing is sent to Anthropic.
• Choose what's sent: Click a photo or the "page" screenshot tile to leave it out of the next check. A page's first check starts as soon as you open the panel on it.
• Remove photo access in Settings (Remove access), or at chrome://extensions > DealWorm > Details > Site access.
• Delete saved data: Delete saved items, buyers and lists on their pages, stop tracking items on the Watchlist page, and delete model test results on the Model test page.
• Sign out in Settings. This ends your sign-in session on our server and removes it from your browser.
• Delete your account in Settings. This deletes your account and its ledger from our server. Any remaining credit is lost, and the email fingerprint described above is kept.
• Stop Google sign-in for DealWorm in your Google Account's third-party connections (https://support.google.com/accounts/answer/13533235).
• Remove the extension to delete everything it stored in your browser.
• Ask us: Email nlorsung@gmail.com to see, correct or delete the data our server holds about you. We'll respond within 30 days.

8. Security

• All connections use HTTPS.
• Our Anthropic and Stripe keys are kept only on our server, never in the extension.
• Sign-in access tokens expire after an hour and are renewed automatically.
• Your own API key, if you use one, is kept in Chrome's storage for the extension on your computer and sent only to api.anthropic.com.
• No system is perfectly secure, but we limit what we keep to what is listed here.

9. Children

DealWorm isn't directed to children under 13, and we don't knowingly collect their personal information. If you believe a child has created an account, email us and we'll delete it.

10. Where data is processed

Our server and database are in the United States. Anthropic, Google, Stripe, Vercel and eBay may process data in the United States and other countries, under their own policies.

11. Changes to this policy

If we change what DealWorm collects or how it uses data, we'll update this policy and the "Last updated" date. We'll also tell you in the extension and ask for your agreement before the new practice applies to you.

12. Contact

Questions or requests about privacy: nlorsung@gmail.com