Privacy
What this app keeps
Your order file's columns, with buyer emails encrypted, deleted after 7 days or when you ask, unless you link your PayPal login (below). CPSC's public recalls and product safety warnings. PayPal sales data is built to be deleted within 48 hours under PayPal's deletion rule. Stored decisions use your own order number or a keyed hash. It keeps a keyed fingerprint of each PayPal webhook delivery to refuse repeats, with no ids or amounts.
If you type a store's address, RecallReachBot reads that store's robots.txt and public /products.json, about 5 seconds apart. It keeps each title and whether it's for sale, deleted after 7 days or when you ask, unless you link your PayPal login. It never keeps the vendor, and never reads a store unless someone typed its address.
If you use the phone app, your phone's push token is kept with your shop and deleted with it.
If you connect your PayPal account, the app keeps your PayPal merchant id, encrypted, and what PayPal said about the connection. That is an account link, not sales data, so it is kept like your shop: deleted when you disconnect, when PayPal says you took your consent back, or with your shop. Your sales are read from PayPal when you press Check with PayPal, and deleted within 48 hours.
If you link your PayPal login, the app keeps a keyed hash of your PayPal account id with your shop, so that login opens your shop from another browser. It asks PayPal for nothing else, no name or email, and keeps no PayPal token. Linking also keeps your shop, with its order file, listings and receipts, past its 7 days: until you delete it, or until a year passes with no link or sign-in, when it is all deleted. Unlinking brings back the 7-day rule. The hash is deleted when you unlink, or with your shop.
A safety receipt keeps the family's item words and encrypted email with the shop that took it, until the family or the shop deletes it, for at most 3 years, and sooner if the shop's data is deleted: 7 days after a real shop joined, or, for a shop whose owner signs in with PayPal at least once a year, a year after the last sign-in; within 48 hours for a demo shop. The receipt page shows the exact date. The email is shown only to the owner preparing a notice. Receipt data does not go to Claude or Channel3. The family gets a delete link on screen to bookmark, not by email.
If you answer "Is this the recalled product?", the recall number, your own title for the item and your answer are kept with your shop and deleted with it. The public page shows counts only.
What goes to a third party
If you press Check with Claude, CPSC's text and your item's title, SKU and listing description go to Anthropic. Nothing PayPal returns does, and no buyer's details do. The app never emails anyone: messages open in your own mail, and you send them. A push to your phone goes through Expo and Apple or Google, and carries only a CPSC recall number and a link to your queue.
For your shop's privacy policy
You can copy this. It is a template, not legal advice.
If a product you bought from us is recalled for safety, we may email you about it using the email from your order. We check our past sales against U.S. CPSC recalls. Product details from our own catalog may be processed by our service provider, Anthropic. We never use this for marketing. Sales data from PayPal is deleted within 48 hours.
For your checkout
A box buyers can tick, so future buyers have said yes. For past buyers who never saw it, whether PayPal's terms allow this email is unclear, and we say so plainly.
Email me if an item I buy is recalled for safety.