1. Architecture & Zero-Server Data Processing Declaration
StoreXray is architected and distributed as a 100% Client-Side, Direct-to-Browser Software Utility. Unlike legacy cloud-based web scrapers or remote proxy services, StoreXray does not operate intermediary data collection servers, cloud processing queues, or centralized product databases.
What Happens Exclusively in Your Browser RAM
- Public Catalog Extraction: Direct HTTP
GETrequests to publicly accessible Shopify storefront endpoints (/products.jsonand/collections.json) originate directly from your local Chromium instance. - Financial & Margin Modeling: All variant flattened rows, discount arbitrage calculations (
compare_at_pricevs.price), and bulk price multipliers execute in volatile browser memory (ArrayBuffer/ V8 heap). - Local File Compilation: Binary generation of 3-Tab Executive Excel workbooks (
.xlsx), standard.csvfiles, and bulk product image archives (.zipvia localJSZip) is performed 100% offline inside your browser and written directly to your local disk via the Chrome Downloads API.
What StoreXray Never Collects or Transmits
- Zero Browsing History Exfiltration: StoreXray never logs, transmits, or monitors the websites, URLs, or domains you visit.
- Zero Catalog Telemetry: No product titles, SKUs, vendor lists, pricing matrices, or product images extracted by your browser are ever uploaded to StoreXray servers.
- Zero Session Hijacking or Cookie Harvesting: StoreXray never reads, modifies, or exports authentication cookies, session tokens, Shopify Admin credentials, or personal customer records.
2. Chrome Manifest V3 Permissions Justification Table
In strict adherence to the Google Chrome Web Store Developer Program Policies regarding Principle of Least Privilege, StoreXray requests only the minimum technical permissions in manifest.json required to perform local catalog analysis and file generation:
| Manifest Permission | Technical Justification & Trigger Scope | Privacy & Zero-Exfiltration Safeguard |
|---|---|---|
| activeTab | Used strictly when the user explicitly clicks the StoreXray toolbar icon to detect whether the currently active browser tab corresponds to a compatible Shopify e-commerce storefront and to resolve its base origin domain. | Never runs passively across background tabs. The active tab URL is evaluated solely in local memory and is never transmitted externally. |
| host_permissions (<all_urls>, http://*/*, https://*/*) |
Required because independent Shopify storefronts operate across millions of bespoke custom domains (e.g., brand.com) while hosting product imagery on cdn.shopify.com. This permission enables the extension popup and Full-Screen Workspace (dashboard.html) to execute direct client-side fetch() calls to public catalog endpoints (/products.json) and package public product images into a local .zip archive without routing traffic through any third-party proxy server.
|
Network requests occur exclusively between the user's browser and the target e-commerce storefront currently being audited by the user. Zero background crawling. |
| storage (chrome.storage.sync & local) |
Used exclusively to persist on the user's own device: (a) License Key activation status and white-label agency brand name, (b) UI theme preference (Obsidian Dark / Polaris Light), (c) the local monthly store quota counter (QuotaTracker), and (d) the local export counter (ReviewPromptTracker) so the review banner is never shown repeatedly once dismissed.
|
Stored 100% locally in the user's Chromium profile. Users can clear or reset this storage at any time in 1 click or by uninstalling the extension. |
| downloads |
Required to save the in-memory generated 3-Tab Excel workbooks (.xlsx), standard .csv files, and bulk product photo archives (.zip) directly to the user's local hard drive via chrome.downloads.download.
|
Triggered strictly upon user click on an Export or Download button. Files are created from local Blob / Data URLs in browser RAM.
|
| scripting |
Used solely as an on-demand, read-only fallback (chrome.scripting.executeScript) on the active tab to inspect public storefront metadata (window.Shopify or meta[name="shopify-digital-wallet"]) when a storefront uses custom routing.
|
Strictly read-only inspection. StoreXray never modifies storefront DOM layouts, never injects third-party ads, and never alters checkout forms. |
3. Google Chrome Web Store "Limited Use" Disclosure
"The use of information received from Google APIs and Chrome Extension APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. StoreXray does not transfer, sell, or use user data for serving personalized advertisements or creditworthiness."
In addition to the verbatim declaration above, StoreXray certifies compliance with the four pillars of Google's Limited Use Policy:
- Single User-Facing Purpose: Access to Chrome Extension APIs is strictly limited to providing user-initiated e-commerce catalog inspection, spreadsheet export (
.xlsx/.csv), and image archiving (.zip). - Prohibition on Data Sale or Brokerage: StoreXray never sells, rents, licenses, trades, or transfers user data to data brokers, ad networks, or information resellers.
- Prohibition on Personalized Advertising & Credit Lending: StoreXray never uses data accessed through Chrome APIs for targeted advertising, retargeting, behavioral profiling, creditworthiness assessment, or lending decisions.
- Prohibition on Human Readership: Because no user browsing or catalog data leaves the user's local device, no StoreXray employee, contractor, or automated backend system can read or inspect the storefronts you analyze.
4. License Validation & Merchant of Record (Lemon Squeezy / Stripe)
Commercial subscriptions and lifetime licenses for StoreXray—specifically the Pro Monthly ($19.99/month), Pro Annual ($199.00/year), and Founding Agency ($999.99 One-Time) tiers—are processed by our authorized third-party Merchant of Record (Lemon Squeezy, LLC / Stripe, Inc.).
- Zero Payment Card Storage by StoreXray: StoreXray never collects, processes, views, or stores credit card numbers, debit card numbers, CVV security codes, or bank account credentials. All checkout operations occur on PCI-DSS Level 1 encrypted checkout pages hosted directly by Lemon Squeezy / Stripe.
- Alphanumeric License Key Validation Only: Upon completing a purchase, the Merchant of Record issues an alphanumeric
License Key. When you enter this key into the StoreXray extension, the extension validates the token format and cryptographic entitlement solely to unlock local tier quotas (Pro Monthly,Pro Annual, orFounding Agency) stored inchrome.storage.sync. - Billing Records & Tax Compliance: As Merchant of Record, Lemon Squeezy handles global VAT/GST calculation, invoicing, and 1-click subscription management under their respective privacy policy (lemonsqueezy.com/privacy).
5. FTC Affiliate Disclosure & Third-Party B2B Deep Links (16 CFR Part 255)
In full compliance with the United States Federal Trade Commission (FTC) Guides Concerning the Use of Endorsements and Testimonials in Advertising (16 CFR Part 255) and international advertising transparency standards, StoreXray discloses the following commercial relationships:
- Value-Added B2B Sourcing & Partner Links: Certain convenience workflows inside the StoreXray popup, Full-Screen Workspace, and exported
.csv/.xlsxworkbooks—including🏭 Wholesale Factory Searchlinks pointing to Alibaba.com or AliExpress, B2B dropshipping platforms (e.g., Spocket), andShopify Partnertrial links—contain affiliate attribution query parameters (such asutm_source=storexray_affiliate). - 100% User-Initiated Click Activation (Zero Cookie Stuffing): StoreXray strictly prohibits silent affiliate injection, background iframe loading, automatic tab redirects, or "cookie stuffing." Outbound partner links are inert URL strings that activate if and only if the user voluntarily clicks on the respective action button or spreadsheet hyperlink.
- Zero Additional Cost to the User: If you choose to click an affiliate link and subsequently register or transact on a third-party B2B platform, StoreXray may receive a referral commission at zero additional cost to you. This revenue subsidizes the ongoing maintenance of the Free Community Tier ($0).
6. Public E-Commerce Data & Intellectual Property Disclaimer
StoreXray functions strictly as a client-side data formatting, competitive benchmarking, and catalog interoperability tool that structures Storefront Public Metadata—information intentionally published to the open web by e-commerce merchants for public consumer viewing (such as product titles, retail prices, variant options, and public CDN image URLs).
- No Bypass of Access Controls: StoreXray never bypasses authentication gates, password-protected storefronts, CAPTCHAs, rate-limiting firewalls, or private backend APIs. It reads only what the user's browser is already authorized to view publicly.
- End-User Responsibility for Commercial Use: All product descriptions, brand names, trademarks, and photographic assets downloaded via StoreXray remain the intellectual property of their respective merchant owners or licensors. The end user assumes sole legal responsibility for how exported spreadsheets (
.xlsx/.csv) or downloaded image archives (.zip) are used, and agrees not to engage in trademark infringement, counterfeit listing, or unlawful copyright misappropriation. - Independent Software Disclaimer: StoreXray is an independent B2B analytics product and is not affiliated with, endorsed by, or sponsored by Shopify Inc., Alibaba Group, or Google LLC.
7. GDPR (EU/EEA/UK), CCPA/CPRA (California) & International Privacy Rights
We recognize and uphold the statutory privacy rights granted to individuals under the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and Brazil's LGPD:
Because extension state resides in your browser's chrome.storage, you can exercise complete, irreversible erasure at any moment by removing the StoreXray extension from Chrome or clearing extension storage in chrome://extensions. For billing records held by our Merchant of Record, email privacy@storexray.com for deletion within 72 hours.
Every catalog audit and image archive you generate is immediately delivered to your local machine in open, non-proprietary formats (.xlsx, .csv, .zip). You retain 100% custody and portability of your files without lock-in.
StoreXray does not "sell" or "share" personal information as defined under California Civil Code § 1798.140, nor have we done so in the preceding 12 months. No opt-out toggle is required because zero behavioral sharing occurs.
Local software execution occurs under Performance of a Contract (Art. 6(1)(b)) when you explicitly invoke the extension, and Consent (Art. 6(1)(a)) when you install the extension from the Chrome Web Store.
8. Data Retention & Security Posture
- 0-Day Cloud Retention for Browsing & Catalogs: Because StoreXray does not maintain a central database of user browsing activity or extracted product catalogs, our cloud data retention period for storefront audits is 0 days.
- Volatile Memory Garbage Collection: Extracted catalog objects held in browser RAM during a popup or Full-Screen Workspace session are automatically purged by the Chromium V8 garbage collector immediately upon closing the popup or workspace tab.
- Zero Remote Code Execution (MV3 Bundled Dependencies): All third-party parsing libraries (
vendor/xlsx-js-style.min.jsandvendor/jszip.min.js) are statically bundled inside the signed Chrome extension package. StoreXray never downloads or executes remote JavaScript (eval()or external script tags) inside the extension context. - Transport Layer Encryption: All direct browser-to-storefront requests and license verification calls enforce HTTPS over TLS 1.2/1.3.
9. Contact & Compliance Officer Details
For questions regarding this Privacy Policy, Chrome Web Store compliance audits, GDPR/CCPA data inquiries, or enterprise license administration, please contact our Compliance & Support Desk: