Privacy Policy for SellerExtreme

Data and feature choices

SellerExtreme can manage inventory and local orders without a seller-account connection. Some optional features store or share data outside the app. This notice describes the current app's data paths; it does not mean that the entire app never transmits information.

Inventory and warehouse records

The app saves the product information you enter, scan, import, or review, including identifiers, names, quantities, saved photos, costs, prices, and listing text. Warehouse documents also contain named storage locations, 3D coordinates, stock movements, and local or imported order workflow records. These records may contain business information you supply.

When Apple iCloud Documents is available to the signed app and your account, SellerExtreme can store and sync warehouse documents through Apple iCloud. Otherwise, it uses local documents. Saved warehouse coordinates can be included in these documents. iCloud availability and conflict handling do not guarantee that every change has reached another device.

Camera and spatial alignment

Camera permission supports product scanning and spatial placement. Saved ARWorldMap references describe features of the surrounding space so the app can try to realign later camera sessions. These reference files are device-local, excluded from backup, and not uploaded or synced by this app. They are separate from saved shelf names and coordinates. Syncing a warehouse document does not transfer a trusted camera-alignment reference to another device, and these files are not a complete saved warehouse mesh.

On-device intelligence

Eligible devices can use Apple's on-device Foundation Models for seller assistance and listing or placement suggestions. The app's AI inference path does not send prompts to a remote model API. Availability depends on the device and Apple Intelligence settings; manual and rule-based workflows remain available. Reviewing an AI suggestion does not by itself publish it to a marketplace.

Optional commerce connections

Opening Commerce connections contacts SellerExtreme's Cloudflare-hosted broker over HTTPS to check provider readiness, even before you authorize an account. Like other network requests, this exposes connection information such as your IP address and request metadata to the service.

If you authorize a supported seller account, the broker handles provider authorization and exchanges a one-time code for a SellerExtreme session stored in the app's Keychain. Marketplace client secrets and refresh credentials remain server-side. Authorized connections can import product identifiers, titles, SKUs, barcodes, inventory sources, quantities, and order references and line items. Connected accounts may refresh when you open this screen or return to the app.

When you confirm supported stock, listing, or fulfillment actions, relevant business data is sent through the broker to the provider. This can include product and inventory-location identifiers, quantities, reviewed listing text, order line items, and tracking information. Availability and write capabilities vary by provider; a local order completion is not a marketplace shipment or payment.

Disconnecting requests revocation of the SellerExtreme session and, on success, removes its local token and connection metadata. It does not delete imported local records or historical data held by the provider or server. This notice makes no retention or deletion-time promise for those services; their policies and account controls also apply.

Optional local Muse sharing

Enabling Muse sharing creates an app-wide, read-only snapshot of the active warehouse in the device's shared App Group for SpacePlant-signed apps with access to that group. It includes warehouse identity, product names, SKUs, quantities, named locations and coordinates, order references and line items, workflow state, and operational signals. It does not include dedicated image, barcode, cost, marketplace credential, or customer-address fields, but information entered into names, SKUs, or other shared text may still be included. This connector does not itself send the snapshot to Meta; local App Group sharing is not Meta approval or an approved cloud connector. Turning it off attempts to remove the shared snapshot, but cannot retract copies another app has already read.

Exports and backup limits

CSV export includes inventory fields such as names, barcodes, quantities, attributes, costs, prices, and scan dates. You choose where to save or share that file. CSV is not a complete backup of order history, spatial placements, warehouse documents, or device-local AR references. Use sample inventory for beta evaluation and keep a separate copy of important inventory before changing versions; neither CSV nor iCloud is a guarantee of complete recovery.

Server data and retention details

This section adds details about the current Cloudflare-hosted commerce broker and the separate Muse developer-preview service. It does not turn on a connection or upload local warehouse records merely because you read this page.

Authorization and session records

Provider authorization flow records contain the provider, app redirect, app state, creation time, and, for Shopify, the shop domain. They expire after 10 minutes and are deleted when the callback consumes them. One-time exchange-code records contain the provider, grant identifier, app redirect, and account display name. They expire after 2 minutes and are deleted on exchange. Session records contain the provider, grant identifier, and creation time; the server keys them by a hash of the session token. They expire after 30 days or can be deleted by disconnecting the corresponding session.

Provider grants and operation receipts

Provider grant records contain the provider, account display name and provider-specific shop, merchant, seller, or marketplace identifiers, a creation time, and an encrypted access or refresh credential. These grant records have no automatic expiry or self-service deletion endpoint in the current broker. Deleting a SellerExtreme session does not delete its provider grant or revoke the provider's own authorization.

The broker fetches product, inventory, order, and listing data to process authorized requests; it does not keep a full persistent product, order, or listing cache. It does retain successful inventory and fulfillment operation receipts for retry protection in Cloudflare storage. These receipts can include provider, product, inventory-source, order and external-fulfillment identifiers, quantities, and completion times; an external-fulfillment identifier can include a tracking number. These receipts have no automatic expiry or self-service deletion endpoint in the current broker. Disconnecting does not delete them.

Muse developer-preview snapshots

The separate cloud developer-preview service accepts an authenticated snapshot for one configured review warehouse. The latest snapshot replaces the previous one and has no automatic expiry. An authenticated snapshot-delete operation is available to the preview operator. Allowed fields include warehouse identity, product names and SKUs, quantities, named placements and coordinates, order references and lines, workflow state, operational signal text, and supported action strings. Dedicated photo, barcode, cost, customer-address and marketplace-credential fields are not included, but shared free text may contain information entered by the seller. The review tools are read-only and do not move inventory, publish listings, fulfill orders, or take payments. Enabling local in-app Muse sharing does not itself upload a cloud preview snapshot or establish Meta approval.

Request logs and trace metadata

Cloudflare receives connection and request metadata when the service is contacted, including for readiness checks and these public pages. Request logs and sampled traces may be retained, including request URLs and query parameters, methods, response status, timings, user-agent or device information, and coarse geographic metadata. Authorization callback parameters and Muse search terms may appear in URLs. Error logs can include provider messages or order references. These platform records are separate from the app's local documents and from stored broker records; their retention depends on Cloudflare's policies, plan, and account settings. This notice does not promise that request data or server records are never retained.