The short version
Your shelf lives on your device. Credenza works with no account at all. If you make an account, four optional features can store data on our servers: your plan, your synced shelf, your shared links, and your usage counters. Each one is listed below. Everything else stays on the device, and the server functions keep no content.
Credenza also counts visits with Google Analytics, and only after you accept it. The first page you open asks. Your shelf is never part of that count.
If you make an account
An account is optional. The app runs without one. You need an account only for Pro, cloud sync, and shared links.
- Supabase Auth stores your email address and a hashed password, or the sign-in provider you chose. Credenza never sees a plain password.
- Your account id ties every server record below to you. That id is a random UUID, not your email.
Delete the account and every record below goes with it, in the same operation. Write to the address at the end of this page to request that.
What Pro stores
Stripe takes the payment. Credenza never sees your card number, and no card data touches our servers. Stripe processes your payment details under its own privacy policy.
Our server keeps one row for your plan. That row holds:
- Your plan and billing status, and the date the paid period ends.
- Your Stripe customer and subscription identifiers, so a renewal finds you.
- Usage counters per feature, including permanent Free allowances and monthly Pro allowances. These are counts, never the content of a request.
What cloud sync stores
Cloud sync is off until you turn it on. When it is on, the server holds one copy of your shelf so a second device can read it: items, photos, notes, sizes, prices, hauls, and QC records. It is the same shelf, stored so you do not lose it with the device.
Row-level security binds that copy to your account id. Another signed-in account cannot read it. Your body measurements are not part of the synced shelf, and stay on the device.
What a shared link stores
A shared link is public by design. When you make one, the server stores a snapshot of the items you chose, under a random 12-character code. Anyone with that code can read the snapshot. Treat the code like the link it is.
- You choose which fields go in the snapshot: prices, notes, quality, sellers, parcel.
- A field you switched off is absent from the snapshot, not hidden by styling.
- Shared pages carry a no-index instruction, so search engines skip them.
- Credenza counts no views. There is no visitor log for a shared page.
- Delete a link from Profile → Shared links, and the page it served answers 404. Set an expiry and the link stops working on its own.
What stays on your device
Credenza stores these records in your browser's local storage:
- Your shelf: saved items, photos, notes, sizes, prices, hauls, and QC records.
- Your preferences: theme, currency, fit settings, and your default agent.
- Your body measurements, if you enter them: height, weight, chest, waist, hip, and related measures. These never leave your device.
- An outbound click log: which agent and which marketplace you opened, with a time stamp. It holds at most 500 entries. It has no item names and no links.
- Your answer to the visitor-counting question: the single word granted or denied.
The browser extension stores its own saves in the extension's local storage on your device. The service worker keeps offline copies of the app itself in the browser's cache storage.
What the server functions see
Some features call Credenza server functions because marketplaces block direct browser requests. A request carries only what that feature needs:
- Link enrichment: the one marketplace or album URL you asked about.
- Size-chart scan: the album photo URLs you asked to scan.
- Reddit import: the one post URL you asked to read.
- Image relay: the album photo URL, because Yupoo refuses a direct browser request. Credenza relays 6 photos an album by default and caches them; the rest open at the album itself.
Each function logs one outcome line per request: the route, a hashed client key, the status code, and the latency. The log never contains URLs, queries, item titles, or post text. Function logs follow Netlify's retention.
What Anthropic processes
The size-chart scan and listing translation send the request content to the Anthropic API to produce an answer. Anthropic processes this data under its own privacy policy and retention terms. Credenza sends no body measurements and no click log to Anthropic.
What visitor counting stores
Credenza counts visits with Google Analytics. Counting is off until you accept it. The first page you open shows a bar with two buttons. Nothing is stored on your device, no cookie exists, and no request reaches Google, until you choose Accept.
Accepting records the page addresses you open on this site, the page that sent you here, your country and city, your browser and device type, sign-in and checkout steps, successful card and chart actions, allowance walls, and each Buy tap with the shopping agent and marketplace you opened. Google Analytics removes part of your IP address before it stores anything. Google processes this data under its own privacy policy.
Credenza never sends your shelf, your item titles, your marketplace links, your notes, or your body measurements to Google. Choosing No thanks keeps the whole site working.
Who else processes your data
Credenza uses five processors. Each one has its own privacy policy.
- Netlify: hosting and the server functions.
- Supabase: accounts, the synced shelf, shared links, and plan rows.
- Stripe: payment, receipts, and the customer portal.
- Anthropic: the size-chart scan and listing translation.
- Google Analytics: counting visits, after you accept it.
Credenza sells no data, and runs no advertising network and no advertising pixel. Google Analytics receives no advertising signal from this site: advertising storage and personalisation stay switched off whatever you choose.
Referral links
Buy links may include a referral code. Credenza may earn a commission on agent shipping fees. A referral never changes your item price. Your stored links always keep the original marketplace address; the code attaches only when you tap Buy.
Retention
- On-device records stay until you erase them.
- Server functions keep no content after a request ends.
- A synced shelf stays until you delete the account or turn sync off and erase it.
- A shared link stays until you delete it, or until its expiry passes.
- Your plan row stays while the account exists. We keep it after a cancellation so a later renewal restores the same account.
- Anthropic's retention follows the Anthropic API terms.
- Stripe's retention follows Stripe's terms. Tax law requires it to keep receipts.
Export and deletion
Export: open Profile → Import & backup and download your shelf as a .json file. Pro also exports a .csv for a spreadsheet. Getting your shelf out lists the columns in each file and when to take one.
Delete on the device: open Profile → Erase my data. This removes every Credenza record on the device: the shelf, the preferences, the body measurements, the click log, and the offline caches.
Delete a shared link: open Profile → Shared links and delete it. The page it served then answers 404.
Delete the account and its server records: write to the address below. We remove the account, the synced shelf, every shared link, and the plan row. Cancel a paid plan first, from the Stripe customer portal in your profile.
Contact
Questions and deletion requests: support@credenzafashion.com. One person reads this address.