Privacy Policy

Last updated: 2026-09-20

What we collect

Account email (via Clerk authentication), the keywords you type, and the listings you generate (title, description, tags) are stored so you can view your generation history and export it.

If you join through a referral link or refer someone else, we record which account referred which, and whether a one-time referral bonus was granted, so we can credit the correct accounts and prevent abuse of the program. We do not share either account's email or other personal data with the other party as part of this.

Anonymous demo usage

The free, no-signup demo at /tools tracks your IP address and a random device identifier (stored in a cookie) to enforce the demo's monthly generation limit and prevent abuse. This data is kept for about 30 days, then automatically deleted, and is not linked to an account unless you sign up.

Photos are never stored

If you upload a product photo, it is sent once to our AI provider to generate your listing text, then discarded. We do not save uploaded photos to our database or any file storage.

Third parties we use

• Clerk: authentication
• OpenRouter (Google Gemini): AI text/vision generation
• Payment processor: payment processing (Merchant of Record)
• Resend: transactional email
• Sentry: error monitoring
• PostHog: product analytics (only if you accept analytics cookies)
• Railway: application hosting and database infrastructure
• Cloudflare Turnstile: bot protection on sign-up
• Etsy: if you choose to connect your Etsy shop, we use Etsy's API, with your explicit authorization (OAuth), to read your shop and sales data (views, favorites, sales counts) so we can show it to you. We do not access this without your consent, we only request read access, and we never publish or modify anything in your Etsy shop. Your access credentials are encrypted at rest; you can disconnect at any time from Settings, which deletes the stored credentials.
• Advertising partners (e.g. social media platforms): with your consent, we share a hashed (never plain-text) version of your email address and some ad-click identifiers, so an ad platform can tell that an ad it showed led to a signup. This helps us understand which ads are worth running.

We do not sell your personal data. Our payment processor handles your payment details directly; we never see or store your card information.

Cookies

We use essential cookies for authentication (via Clerk), error monitoring (via Sentry), bot protection on sign-up (via Cloudflare Turnstile), and a first-party device cookie (demo_id) to enforce the free demo's monthly generation limit. These are required for the service to function and are not used for advertising or cross-site tracking.

With your consent, we also set a first-party cookie (tc_attr) that remembers which ad or link brought you to the site, and read similar cookies set by our advertising partners (e.g. Meta's _fbc/_fbp). This is only used to measure ad performance, never to build a cross-site profile of your browsing elsewhere, and it is off by default until you accept the cookie banner.

With your consent, we also use PostHog to understand how visitors use the site (pages viewed, features used) so we can improve the product. This is off by default; it only runs if you click “Accept” on the cookie banner, and you can withdraw consent at any time by clearing your browser's local storage for this site. PostHog analytics is not used to build advertising profiles or shared with ad networks.

Chrome extension

If you install the TagCraft Chrome extension, it reads the listing-editor page on etsy.com you're actively on: your product photo, and whether the title/description/tag fields already have text (so it can ask before overwriting anything). It sends your photo and your chosen category/tone/language to the same generation endpoint the web app uses (tagcraft.app/api/listings/generate), using your existing tagcraft.app sign-in — no separate extension account or password. To keep that session current, the extension reads Clerk's authentication cookie on clerk.tagcraft.app. It does not read Etsy cookies. Photos are never stored, exactly as with the web app (see “Photos are never stored” above). The extension does not read or modify anything on etsy.com outside the listing-editor page you open it on, and never submits Etsy's form on your behalf — you always review and click Etsy's own Save/Publish yourself.

Legal basis for processing (GDPR)

We process your account data to perform our contract with you (providing the generation service, including Etsy sync and the referral program once you opt into them) and based on legitimate interest (error monitoring, fraud and abuse prevention, including for the referral program). Analytics cookies (PostHog) are processed based on your consent, which you may withdraw at any time. You may request access to, correction of, or deletion of your data at any time.

Your rights (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data (see Data deletion below)
• Request a portable copy of your data
• Object to or restrict certain processing, including analytics
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact support@tagcraft.app.

International data transfers

We and our processors (Clerk, OpenRouter, our payment processor, Resend, Sentry, PostHog, Railway, Cloudflare, Etsy) may process data outside your country, including in the United States. Where required, we rely on those providers' Standard Contractual Clauses or equivalent safeguards for transfers of EEA/UK personal data.

California residents (CCPA/CPRA)

We do not sell personal information as defined by the CCPA. With your consent, we share limited, hashed information with advertising partners for ad measurement (see “Third parties we use” above), which CCPA may classify as “sharing” for cross-context advertising — you can opt out at any time by declining or clearing cookie consent. California residents may request access to or deletion of their personal information by contacting support@tagcraft.app.

Data retention

We keep your account data and generation history for as long as your account is active. If you delete your account, we delete this data within 30 days, except where we must retain records (e.g. billing history) to comply with tax or legal obligations.

Data deletion

You can request deletion of your account and all associated listings by contacting support@tagcraft.app. This includes any connected Etsy credentials, which are deleted along with the rest of your account data.

Children's privacy

This service is not directed at children under 18 and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

We may update this policy as the service evolves. We will post the updated version here with a new “Last updated” date.

Governing entity

This service is operated by Roman Pastushenko, Georgia (the country).

Contact

Questions about this policy: support@tagcraft.app