Privacy policy (draft for counsel)

Effective date, version and changes

This policy is version 2026-10-30, effective 2026-10-30. It describes what CrestPix ("we") collects when you use crestpix.com and our AI assistant connector, why, who processes it, and the choices you have.

When we make a material change we publish a new version here with a new effective date, show a notice on the site, and ask signed-in users to accept the new version the next time they sign in. Earlier versions are available on request.

Personal information we collect

We collect more than an email address. The categories are:

Email address, if you create an account or ask to be notified about a product.

Watches, target prices and saved lists you create while signed in.

Consent records: which version of this policy and the terms you accepted, and when.

Analytics sessions and events: pages and products viewed, searches (their length and result count, not the words), links pasted (the store, not the full link), and clicks on buy buttons, together with how you arrived (campaign tags and the referring site's host name, never the full referring address).

A hashed IP address, used for rate limits on link checks and for click logs. We never store your raw IP address, and the hash is deleted after 30 days.

Cookies we set ourselves: cp_sid (this visit's analytics session, ends with your browser session or 30 minutes of inactivity), cp_vid (a first-party visitor identifier for up to 12 months, never set when your browser sends Global Privacy Control or Do Not Track), cp_gid (a signed random identifier that counts link checks), and the Supabase authentication cookies that keep you signed in.

How we use it

To run the site and your account, send the alerts you ask for, enforce fair-use limits on link checks, prevent abuse, measure which features help shoppers, and correct prices and claims you report. We do not sell or share personal information, and we do not use it for cross-context behavioral advertising.

Third parties that process data

Supabase: account authentication and our database.

Resend: sending account and alert emails.

Cloudflare: content delivery and caching, and Cloudflare Turnstile, which checks your browser when you run several link checks.

Fly.io: hosting for our web site and background jobs.

Stores and Feedico, our affiliate partner: when you click a buy link, the store (and, for a paid link, Feedico) receives the click as any link would. The tracking code we add to paid links identifies the page and channel, never you.

Collection by other parties over time and across sites

Other parties may collect personal information about your online activities over time and across different web sites when you use CrestPix. Embedded YouTube, TikTok, X and Reddit players load only when you tap them; once loaded, those platforms can set their own cookies and collect information under their own policies. Cloudflare Turnstile does the same when it checks your browser on link checks.

Do Not Track

We respond to Do Not Track signals. When your browser sends Do Not Track, we treat it exactly like Global Privacy Control (below): we set no persistent visitor identifier. CrestPix itself does not track you across other sites.

Global Privacy Control

We honour Global Privacy Control. When your browser sends it, we still count the visit, but we set no persistent visitor identifier (no cp_vid cookie) and remove one we set before. We do not sell or share personal information, with or without the signal.

Analytics

Our analytics are first-party only: we measure visits with our own code on our own servers. We use no session replay, no advertising pixels, and no creator or social-network tracking pixels. Automated traffic is identified and left out of our figures.

YouTube API Services

CrestPix uses YouTube API Services to find and show YouTube reviews. Google's use of information is governed by the Google Privacy Policy at https://policies.google.com/privacy. When you tap a YouTube video to play it, YouTube may set cookies on your device. You can revoke CrestPix's access to your data through Google's security settings at https://security.google.com/settings/security/permissions (CrestPix does not ask for access to your Google account today).

X (Twitter) embedded posts

Draft: counsel to confirm this section's wording.

Posts from X are shown as a tap-to-load placeholder. X's script loads only after you tap; from then on X may collect information about your device and the page, including through cookies, under its privacy policy at https://x.com/en/privacy. To avoid this, don't tap to load X posts, or block third-party cookies in your browser.

How long we keep it

Draft: counsel to confirm this section's wording.

Quick-check results: 24 hours.

Hashed IP addresses: 30 days.

Analytics events: 13 months, then only aggregated daily totals are kept.

Account data (email, watches, lists, consent records): until you delete your account.

Your choices

You can delete your account at any time from your account page, which deletes your email address, watches and lists.

Every email has an unsubscribe link; we honour it within 10 business days.

You can block or clear our cookies in your browser, or send Global Privacy Control or Do Not Track, and the site still works.

You can ask us for a copy of your data or to correct it through the contact details below.

Minimum age

CrestPix is for adults. You must be 18 or older to create an account. We do not knowingly collect personal information from anyone under 18.

AI assistant connector

When you use CrestPix through an AI assistant connector, we receive the tool request (for example, a product name), never your conversation. We log the tool used, the outcome and the response time, without any identifier of you, for the retention periods above, and the same choices apply.

Contact

Privacy questions and requests: hello@example.com, or the contact page at /contact.

Postal address: to be published before accounts open (G10)