Privacy

Your account. An email address and, if your sign-in provider supplies them, a display name and avatar. Passwords are handled entirely by Auth0, our identity provider — Tote never sees or stores one.

The things you save. For each item: the title, retailer, product link, image URL, price, quantity, any variant or size you note, which cart it’s in, and where it came from (typed by hand, pasted as a link, the browser extension, the mobile app, or an AI assistant).

Shared carts. Who is in a cart, who invited them, and who added, started checkout on, or marked purchased each item. In a shared cart the other members can see all of that.

Usuals and brands. The products you rebuy, the purchases you record against them, any replacement interval you set or accept, and the brands you follow. Private to you — never reached through a cart.

Price watches and alerts. For Tote+, the items you asked us to watch, the prices we observed, and what we told you about.

Retailer clicks. When you tap “Buy at”, we record which item, which retailer, where we sent you, and when. This is what lets Tote ask whether you bought it, and it carries affiliate attribution — see below.

Purchases you tell us about. If you mark something purchased, we keep the price you say you paid and the date. We have no way of knowing this unless you tell us — we cannot see checkouts on other sites.

Notifications and connections. What we sent you and whether you opened it, your notification settings, the devices registered for push (a device token, never its contents), and which assistants or extensions you have connected.

Tote+. Your subscription’s state, plan and dates, and the billing events we processed. Card details never touch Tote — see Payments.

Product usage. A closed list of named events — account created, cart created, product added, saved, removed, retailer clicked, marked purchased, and so on — so we can tell whether the product is working. See Product analytics.

• We never take payment or store card details. Checkout happens at the retailer.
• We never sell your personal information, and we never share it with advertisers.
• We do not track you across other apps or websites.
• We do not read your browsing. The Chrome extension only reads a page when you open it and click, and only that page.
• We never buy anything on your behalf, including via an AI assistant.
• We never let affiliate money decide what you see: which items we show, and the order we show them in, is never influenced by what pays.

Authorised Tote staff can open an internal dashboard that lists accounts with counts — your email address and name, when you signed up, when you last did something, how many carts, items, usuals and saved brands you have, how many shared carts you are in, your Tote+ status and plan, and which surfaces you have connected. It is there for support and for operations: answering “why is this not working for me”, and knowing what the product costs to run.

It does not show what is in anyone’s cart. No product names, links, photos or prices; no notification text; nothing from Ask Tote. Access is a short list of email addresses held in our deployment configuration rather than a flag anybody can grant themselves, and to everyone else the page does not exist.

Some “Buy” links earn Tote a commission. Every outbound link goes through Tote first (/api/go/…), and the server decides whether an affiliate program covers that store. Most of the time none does and you go straight to the retailer’s own URL.

When one does, we add — or wrap the link in — that network’s tracking parameters. The networks are the usual ones for retail: CJ, Impact, Rakuten Advertising, Awin, ShareASale and Amazon Associates, depending on the store. What we pass them is a random click ID (the id of a row in our own click table, or a throwaway ID if you’re signed out), the surface the link was on (for example a product page), and which app you clicked in. Nothing else: no email, no name, no Tote account ID, no cart contents. We also send the browser with Referrer-Policy: no-referrer, so they don’t learn the Tote page you came from.

What the network learns anyway is what any website learns when your browser visits it: your IP address, your user agent, and whatever cookie it sets to remember the click. That is between you and them, under their privacy policies — which is why we treat affiliate links as “sharing” and let you turn them off.

A link that already carries somebody else’s affiliate tag is passed through untouched: that commission is theirs, not ours.

Every event is recorded in our own database first, and that is the copy that matters. A second copy of each event goes to PostHog, which turns them into charts. What PostHog receives: the event name, a random Tote ID for you, and small dimensions like which store a Buy link went to, which screen you were on, and your plan. Never your email, name, a product title, a URL, or anything from your cart. The events are sent from our servers, so PostHog does not see your IP address.

The site also uses Vercel Web Analytics and Speed Insights for visit counts and page speed. They set no cookies and record no identifier.

You can turn product analytics off in your privacy settings, or for one browser on Your privacy choices. When it’s off, nothing is sent to PostHog or Vercel. We still write our own row saying the event happened, with your account ID and any item or cart IDs removed, so our totals don’t quietly bend when people opt out. That row stays in our database and is never shared.

If your browser sends the Global Privacy Control signal, Tote honours it as an opt-out of both analytics and affiliate links, for that request. If you’re signed in we save it to your account, so it also applies to things that happen when no browser is involved — a price check, an email, an assistant. You can turn things back on later from a browser that isn’t sending it, or from the app.

Ask Tote, cart analysis, the price estimate and the background repair of items saved with details missing all use Anthropic’s models, through Anthropic’s API. What we send is the question you typed, plus the cart or item it is about and a short list of things you have saved — titles, retailers, prices, links. Cart analysis also sends what you have marked purchased, because comparing against it is the point. Item repair sends only the product URL, for the model to read that page. We never send your email address, your name or your Tote account ID.

Anthropic processes it to answer and does not train on it, under their commercial terms. We keep a record of each call’s cost and token counts — not the prompt or the answer. If we ever route AI requests to another provider, this page will say so before we do.

If you connect ChatGPT, Claude, or another assistant, it acts strictly on your own cart, using a token issued to you and scoped to Tote. There is no account or user parameter on any tool it can call, so it cannot reach anyone else’s data even if asked to. It cannot buy anything. What you say to your assistant is governed by that assistant’s own privacy policy, not this one.

Pasting a link asks our server to read that page for a title, image and price. It requests the page anonymously — no cookies, no credentials, nothing identifying you — and reads only the public metadata a link preview would.

Tote sets no advertising or tracking cookies. The complete list:

• Sign-in session (__session, plus its numbered parts, and short-lived __txn_… cookies during login). Strictly necessary: without them you cannot stay signed in.
• Your privacy choices (tote_opt_out, tote_no_analytics). Strictly necessary: they exist only to remember that you said no.
• In your browser, not sent to us: a dismissed “did you buy it?” prompt for the current tab, and the ticks on the free checklist tools. Both stay on your device.

That is why there is no cookie banner: everything above is either strictly necessary or stored only on your device, and the analytics we do run set no cookies at all. If that ever changes, the banner arrives with it.

Auth0 (Okta) handles sign-in and stores your credentials. Prisma Postgres hosts the database. Vercel hosts and serves the application. PostHog receives the product analytics described above. Sentry receives error reports — with cookies, tokens and query strings stripped, no IP address, and no session replay, because a replay of Tote is a recording of your shopping. Stripe takes payment on the web and Apple in the iOS app. Resend sends our email — including the sign-in and password-reset messages, which come from hello@trytote.shop — and Apple Push Notification service delivers push. Anthropic runs the AI features. Each processes data only to provide that service.

Links in Tote’s email go through links.trytote.shop before they reach where they are going, so we can count how many people clicked a price alert or an invitation. Resend records the click, the time and the link. We do not track whether you opened an email: there is no tracking pixel in our mail, which is also why our own numbers say “clicked” and never “opened”.

Tote+ is billed by Stripe on the web and by Apple in the app. Card numbers never reach Tote: Stripe holds them, and we keep your subscription’s state, plan and dates. Stripe and Apple keep their own billing records for as long as their own legal obligations require, and deleting your Tote account does not erase those.

Your account data stays until you delete it, or delete your account. Deleting an item or a cart removes it immediately. Notifications, click records and analytics events are kept while the account exists; we have no automatic expiry on them today, and if we add one this page will say what it is.

When you delete your account, everything personal goes at once. Three things are kept with the link to you removed: outbound click records (an affiliate network bills from its own report weeks later, and we have to be able to reconcile it), usage counts, and the cost records for AI calls. Backups roll off on our database provider’s own schedule.

Download it. Your privacy settings has a one-click export of everything tied to your account, as a JSON file.

Delete it. The same screen deletes your account, straight away and without emailing anybody. It lists the consequences first: private carts and their items go; a shared cart you own passes to the longest-standing other member, who keeps everything in it, including what you added; a web subscription is cancelled immediately; an App Store subscription is the one thing only you can cancel, in iOS Settings.

Turn things off. Product analytics and affiliate links each have a switch, and we honour Global Privacy Control.

Depending on where you live you may have rights to access, correct, export or erase your data, and to object to processing. The buttons above cover access, export and erasure without asking anybody; for anything else, email us and we will comply. We will not treat you differently for exercising any of it.

Tote does not sell personal information for money and never has. We take a deliberately cautious reading of “sharing”: an affiliate click means your browser visits a network that can set its own cookie, and product analytics mean a vendor holds a copy of your events. Both are treated as things you can opt out of, in one place — Your privacy choices, also linked in the footer of every page. Global Privacy Control does the same thing automatically, and we do not require an account to honour it.

Tote isn’t intended for anyone under 13, and we don’t knowingly collect their data.

If this policy changes in a way that affects what we collect or how we use it, we will say so here and update the date above.

Questions, exports, or deletion requests: privacy@inquentity.com