Privacy policy
Last updated 8 August 2026
In one paragraph
FeedParity reads your Shopify product catalogue and your Google Merchant Center product catalogue, compares them, and shows you where they disagree. It performs read operations only. It does not request access to customers, orders, or Google Ads, and it never writes to either system.
What we store, and for how long
| What we store | Why | Kept for |
|---|---|---|
| Your account: email, name, password hash | To sign you in and to send alerts you asked for | Until you delete your account |
| Integration credentials (Shopify and Google OAuth tokens) | To read the two catalogues on your behalf | Until you disconnect. Encrypted with AES-256-GCM; never stored in plain text |
| Scan results and findings | To show what changed and when it was first detected | Until you delete your account or the store |
| Product snapshots | Evidence for a finding — the values each system reported | Stored only for products involved in a finding, and deleted with the store |
| Security audit log | Sign-ins, connections, billing events, data deletions | Kept after account deletion, but unlinked from your account and containing no catalogue data |
| Billing records (Stripe customer and subscription ids) | To operate your subscription | Payment details are held by Stripe, never by us. Invoice records are retained as long as tax law requires |
What we do not collect
- Customer names, emails, addresses or any other shopper personal data.
- Orders, carts, checkouts or payment information.
- Google Ads campaigns, spend or performance data.
- Card details — Stripe handles payment data; it never reaches our servers.
The Shopify scope we request is read_products and nothing else. If Shopify ever returned a broader grant, the connection is refused rather than accepted.
A note on the Google permission
Google offers a single Merchant Center permission (https://www.googleapis.com/auth/content), and it is technically read/write — there is no read-only variant available to request. We are explicit about this rather than describing it as read-only: our implementation issues read requests only, and the Google client in our codebase has no write method, so no code path can modify your Merchant Center data.
Who else processes your data
- Our hosting and database provider, to run the application.
- Stripe, for subscription billing.
- Our email provider, to deliver the alerts you enable.
- Shopify and Google, as the sources we read from at your instruction.
We do not sell data, and we do not use your catalogue data to train models.
Deleting your data
You can disconnect either integration at any time from the Connections page; the stored credential is deleted immediately and the Google authorisation is revoked upstream.
Deleting your account from Settings removes every store, connection, scan, finding and snapshot. If you uninstall the app from Shopify, Shopify notifies us and we delete that store’s data — other stores on your account are unaffected.
To request deletion by email instead, contact us at support@getfeedparity.com.
Security
OAuth tokens are encrypted at rest with AES-256-GCM using a key held outside the database, and bound cryptographically to the store they belong to. Passwords are hashed with scrypt. Sessions are stored as hashes, so a database copy yields no usable sessions. A fuller description is in the project’s security review.
Contact
Questions about this policy: support@getfeedparity.com.