Privacy Policy

Information we collect

SoldCount offers read-only analytics on public TikTok Shop listings. To run the service we collect only what we need.

• Account data — your email and, when you sign in with Google, the Google identity (email, name, profile) you authorize. We store your email and a provider identifier.
• Listings you track — the products and shops you add to your watchlist, plus the snapshots we capture to derive sold counts, price bands, and momentum.
• Usage and device data — analytics events (sign-in, CTA clicks, page views) via PostHog, browser and device type, and IP address (used to rate-limit enrollment and for security).
• No payment data — SoldCount does not process or store payment card information.

How we use your information

We use this data to provide the service: sign you in, build and show analytics for the listings you track, and send the notifications you have opted into when a tracked listing changes.

We also use it to improve and secure the product (for example, understanding usage, preventing abuse, and rate-limiting). We never sell your personal information, and we never write to, reprice, or otherwise modify your shop or anyone else’s.

Cookies & local storage

We keep a short-lived access token in memory and a refresh token in an HttpOnly, Secure, SameSite=Lax cookie scoped to the auth API — JavaScript cannot read that cookie.

We also store a non-sensitive “had_session” flag in localStorage solely to hint whether to attempt a silent refresh on page load. PostHog may set its own cookies for analytics; you can block or clear these.

How we share information

We share data only with the processors that help us run the service: Google (to authenticate you when you choose Sign in with Google), PostHog (analytics), and our hosting and email providers — each under contract and only to provide the service.

We disclose information if required by law.

Data retention & deletion

We keep your account and tracked-listing data while you have an account. You can request access, correction, or deletion at any time (see Contact); we delete account data on request, subject to any legal retention obligations.

Security

We use industry-standard measures — HTTPS in transit, HttpOnly refresh cookies, least-privilege access, and bounded database connection pooling. No method of transmission or storage is 100% secure.

Changes to this policy

If we change this policy, we will post the updated version here with a new “Last updated” date. Material changes will be highlighted where we can.