← Home

Privacy policy — dealsbot feeder

Last updated: 2026-07-05

The dealsbot feeder browser extension is a personal-use tool that reads structured product data already present on pages you choose to open and forwards it to an ingest endpoint you configure and run yourself (by default http://127.0.0.1:8765/ingest, started with python run.py serve).

What the extension does NOT do

No analytics or telemetry. The extension does not track your browsing, does not use cookies, and does not send anything to the extension's authors.
No third-party sharing. Data is sent only to the ingest endpoint you set in the options page. Nothing is transmitted to any server operated by the authors or any third party.
No remote code. All JavaScript ships inside the extension package. Nothing is fetched or eval'd at runtime. The manifest declares an extension_pages Content Security Policy of script-src 'self'; object-src 'self' and no <script src> points at a remote origin. web-ext lint passes with no errors.
No credentials to unlisted origins. The optional X-Token shared secret is attached only to requests to your allow-listed ingest URL. Requests are only permitted to loopback (http://127.0.0.1, http://localhost, ::1) over plain HTTP or to any host over HTTPS; everything else is rejected in the options UI before it can be saved.

What data is collected and sent

When you visit a supported product/listing page (currently shop.lululemon.com and www.fanatics.com), the content script reads structured product data that is already in the page (JSON-LD Product objects and data-* tile attributes) and sends the following per-product fields to your configured endpoint:

site, product_id, color, name, url
sale_price_low, sale_price_high, regular_price
brand, team, category

No page content beyond these product fields, no form input, no personal account details, and no full page HTML is transmitted. The extension does not automate clicks, logins, or checkout.

Permissions and why they are needed

Permission	Why
`storage`	Persist your ingest URL/token settings, the dedupe/queue state, and last-status shown in the popup. Stored locally via `chrome.storage.local`.
`activeTab`	Let the popup reflect the current tab's supported site.
`host_permissions: http://127.0.0.1:8765/*`	Allow the background service worker to POST products to your local ingest endpoint. This is the only host the extension fetches from.
`optional_host_permissions: shop.lululemon.com, www.fanatics.com`	Requested per-site for content extraction; you can enable/disable individual retailers.

Data retention

The extension keeps only transient local state (settings, a bounded in-flight queue, a dedupe set, and the last ingest status) in chrome.storage.local. Uninstalling the extension removes it. Any product history lives in your local dealsbot database, not in the extension.

Optional Telegram linking

If you use "Connect Telegram", the extension links this browser to your Telegram subscription via a one-time deep-link handshake confirmed inside Telegram. It stores only an opaque contributor token (in chrome.storage) and sends it as an X-Contributor header so the ingest can attribute your contributions to you. This links only your contributions — never your browsing history, which is never collected or sent. The server stores only a hash of the token; disconnect any time from the options page (and /unlink in the bot to fully revoke).

Contact

Questions about this policy? See the support page.