Privacy Policy

Last updated: September 26, 2026

1. Who are we?

Picksly (the picksly.fr website, the Chrome extension and the Android app) is published by a sole trader registered in France (SIREN 104 124 904, APE code 62.01Z). The API is hosted on api.picksly.fr (Fly.io Inc., San Francisco, USA — servers in the Paris region).

2. Data collected

Picksly collects a strict minimum of data:

• User account (optional): email address and hashed password (bcrypt) if you create an account on picksly.fr. Account creation is entirely optional and the extension works without an account.
• Shopping profile: the selected tier (Budget / Smart / Premium) is stored locally in chrome.storage.local on your device. If you create an account, this preference is also kept server-side to enable syncing across multiple installations.
• Cumulative savings (versions before 4.7.10): older versions of the extension kept an estimated savings total, stored only locally on your device (chrome.storage.local). This total is no longer calculated or shown: version 4.7.10 deletes it when it updates.
• Technical logs and product measurement: the API records HTTP calls (method, anonymised URL, response code, duration) for monitoring. The extension also creates a random local identifier, without email or browsing history, only to measure activation, retention and uninstall; this pseudonym is dissociated from events after 35 days. HTTP logs are deleted automatically after 7 days. Site visits are counted with an irreversible fingerprint of the IP address (computed with a secret key held by the server), without keeping the address itself; this fingerprint is deleted after 13 months.
• Social login: if you sign in with Google or Facebook, we receive your email address and an account identifier from that provider, solely to create or link your Picksly account. We never post anything on these networks.
• Searches and products viewed: the text of your searches and, for the extension, the product on the page where you use it (title, price, image, page address) are sent to the server to find alternatives. Searches and clicked links are recorded to measure and improve results; the text of searches is erased after 13 months. If you are signed in, your searches, followed products, price alerts and saved comparisons are linked to your account.
• Emails: if you subscribe to the weekly newsletter (confirmed by email) or follow a product’s price from your account, your email address is used for these messages; you can unsubscribe at any time.
• Personalisation without an account: on the website, a signed cookie keeps in your browser the categories and products you viewed or rated, to tailor suggestions (6 months). It is not stored on our servers unless you sign in, and you can erase it at any time from the suggestions section.
• Audience measurement: the site counts its own visits on its own servers, with no third-party tool and no cookie: page views, referring site, browser type and country, plus an irreversible fingerprint of the IP address (never the address itself) to count distinct visitors. Page by page, it also records how far the page was scrolled, how long it stayed on screen and which links or buttons of the site were clicked (never what you type), linked to the same fingerprint to understand how the site is used. This data is kept for 13 months.
• Reports: if you report an incorrect offer, we store the reason you chose (price, link or product), your optional comment (300 characters at most — please do not write personal data in it), the platform used (site or app), the market and the language, and a fingerprint of your IP address (never the address itself) used only so that the same report is not counted twice.

Picksly does not collect: your browsing history outside the product pages and searches where you use Picksly, your purchase history, your IP address in clear form, your banking or payment data, nor any identifiable personal data other than those listed above.

3. Data sent to third parties

• Google Gemini (visual search and suggested alternatives): (a) image search: when you use this feature (drag-and-drop, paste or right-click on an image), the image is sent to the Google Gemini API to identify the product; this transmission is initiated exclusively by your explicit action; (b) alternatives and comparisons: to suggest alternatives or answer a question about a comparison, the name of the product you are viewing (or your query, or your question) and, for a comparison, the title, price, condition, brand and merchant of the compared products are sent to the same service; no email, account identifier or IP address is included. This data is processed by Google, including in the United States, i.e. outside the European Union; this transfer is covered by the European Commission’s standard contractual clauses, which Google includes in its terms. See Google’s policy: policies.google.com/privacy.
• Merchants (Amazon, eBay): to find offers, our server queries these platforms with the name of the product searched for. No personal data about you is transmitted in these requests.

Your data is never sold to third parties.

4. Legal basis for processing (GDPR)

For users creating an account: processing based on the performance of a contract (Article 6.1.b GDPR).
For technical logs: legitimate interest in the security and stability of the service (Article 6.1.f GDPR).

5. Retention period

• Account data: kept as long as the account is active. Deleted on request.
• HTTP logs: rolling 7 days, automatic deletion.
• Local data (profile, preferences): until the extension is uninstalled or manually cleared from Chrome settings.
• Search text and IP fingerprint of visits: 13 months, then erased; extension installation pseudonym: dissociated from events after 35 days.
• Cookies: session 30 days, security token 24 hours, language and country 1 year, personalisation and shop display 6 months.
• Offer reports: 180 days; dead-link reports: 30 days; observed prices awaiting confirmation: 2 days.

6. Your rights

In accordance with the GDPR, you have the right of access, rectification, erasure, restriction and portability. From your account, you can download your data (my data) and delete your account (delete my account). For any other request: contact@picksly.fr.

You can delete all your local data at any time by uninstalling the Chrome extension (Settings → Extensions → Picksly AI → Remove).

7. Cookies

The picksly.fr site sets: a signed httpOnly session cookie (30 days) and an httpOnly CSRF security token (24 hours), needed for the user area; language and country preference cookies (1 year); a signed personalisation cookie (6 months, see above); a shop display preference cookie (tab, category, condition — 6 months); and, for the length of a redirect, one-hour technical cookies. No advertising, analytics or third-party tracking cookies are set.

8. Data hosting

The API is hosted by Fly.io Inc., 2261 Market Street #4990, San Francisco, CA 94114, USA. The data is physically stored in the cdg region (Paris, France), on Fly.io’s infrastructure.

9. DPO contact / complaints

For any question regarding this policy or to exercise your rights:
contact@picksly.fr

You also have the right to lodge a complaint with the CNIL (French data protection authority): cnil.fr/fr/plaintes.

10. Android app

The Picksly app for Android works without an account. In addition to the above, it processes the following data:

• Installation identifier: a random identifier is created on first launch and kept in the device’s encrypted storage. It accompanies your searches, your price alerts without an account and the app’s usage measurement (screen opened, search started, link opened — without the text of your searches). It contains no email address, phone number or advertising identifier. It is dissociated from your searches and from usage measurement after 35 days. It is also used to keep your comparisons saved without an account and your suggestion preferences (products liked, dismissed or already shown); these preferences are erased after 6 months without use.
• Sharing to Picksly and searches: when you share a product page to Picksly from another app, or type a search, the shared text or address is sent to our server and handled like a search on the website (see sections 2 and 3). The app reads nothing else: neither your browsing history nor the content of other apps.
• Photos: the camera and the gallery only open when you ask. The chosen photo is sent to our server and then to Google Gemini to identify the product; it is not stored: only a fingerprint of the image and the resulting search are kept, to avoid analysing it again.
• Notifications: if you allow them, a notification token provided by Expo (Expo Push, which relies on Google’s Firebase Cloud Messaging) is stored on our server with the installation identifier, the app language and, if you are signed in, your account. It is used only to tell you about a price drop on a product you follow; the alert text passes through Expo and Google to reach your phone. You can turn notifications off at any time in Android settings.
• Account (optional): if you sign in (email and password, Google or Facebook), your account key is kept in the device’s encrypted storage. From “My space” you can download your data and delete your account without going through the website.
• Data kept on the device: your language, country, profile (Budget, Smart or Premium) and the products of a comparison in progress. If you are signed in, your account’s email address and its verification status are also kept, together with the account key, in the device’s encrypted storage. The home-screen widget only shows the number of searches on your account. Everything is erased when you uninstall the app.
• What the app does not do: it asks for neither your location, your contacts nor the microphone; it uses no advertising identifier and no ad network; no crash-reporting service is enabled. All exchanges with our server are encrypted (HTTPS).