Privacy policy

1. Introduction

Profit Zones ("the extension", "we", "our") is a Chrome extension that helps Amazon FBA sellers evaluate product profitability. It overlays profit zones on Keepa price history charts, calculates ROI at historical price points, and (for subscribers) provides a Buy Box price-spread widget across US metro areas and a Bulk ASIN Analyzer.

This policy explains what data the extension collects, stores, or transmits; why; who it is shared with; how long it is kept; and how you can exercise your rights over it. It is written in plain English so you can read the whole thing in a few minutes.

2. Information we collect

2.1 Data you provide

• Keepa API key (optional). The extension does not require a Keepa API key. With the Keepa browser extension installed, it reads product data from Keepa's local cache on your device at no token cost (see §2.2). If you choose to provide a key, it is used only as a fallback: when that cache has no data for a product, when a feature needs data the cache does not hold (such as sibling variations in Variation Confidence), or when you approve the Bulk ASIN Analyzer's "Use API" step. You obtain it from your Keepa account and paste it into the extension's settings page. It is stored in chrome.storage.sync (encrypted in transit by Google as part of Chrome Sync) and transmitted only to api.keepa.com, when the extension makes product-data requests and when it checks your remaining Keepa token balance (a free quota endpoint, used to show the balance before a scan you have to approve). We never see or store your Keepa key on our servers.
• License key (premium subscribers only). Issued by our license server after you purchase via Stripe. You paste it into the settings page. It is stored in chrome.storage.sync and sent in request headers to our license server for validation and to gate premium features.
• Email address (premium subscribers only). Collected by Stripe during checkout, not by the extension. Stripe forwards it to our license server via webhook; we store it in our licenses database so we can support your account (reissuing keys, responding to support requests, matching your subscription to your license).
• Support email you choose to send. The "Email Support" button in Settings opens a new message in your own mail client addressed to support at profitzones dot app, pre-filled with the extension version and a masked copy of your license key. The extension does not transmit, receive, or store that message; your mail client sends it, and only when you choose to. Builds older than v0.24.0 had an in-extension "Send Feedback" form that posted your name, optional email, and message text to our license server; that form has been removed, and the server endpoint stays up only until those older installs update.
• User settings. Profit target mode and value, default COGS costs, display mode, theme, velocity threshold, VAT/tax preferences, etc. These are stored in Chrome storage on your device and (for sync-scoped settings) synced to your other Chrome installations by Google. We never receive these settings.

2.2 Data the extension generates

• Device ID (premium subscribers only). When you activate a premium license, the extension generates a random identifier. It is stored locally on that one device. We send it to our license server together with the license key so we can enforce a reasonable per-license device limit (currently 2 devices per license). The device ID is not a fingerprint: it does not identify your hardware, IP address, or any real-world identity. It is local-only and random. (Our license server does separately record the IP address each activation and validation request comes from; see §2.4.)
• Cached product lookups. To save Keepa API tokens, the extension caches the product data it fetches (price history, fees, product title, weight, dimensions, offer counts, and Keepa's Buy Box holder history, which Keepa reports as public seller ids) in chrome.storage.local for up to 1 hour. The cache is purged when the extension version updates, and the oldest entries are removed when the extension's storage on your device nears its limit. Bulk ASIN Analyzer also uses an IndexedDB object store (keepaCache) on your device for the same purpose, for up to 24 hours per ASIN. This data never leaves your device. When the Keepa browser extension is installed, Profit Zones reads product data from Keepa's local cache on your device by running a small read-only script inside the Keepa frame on the Amazon page you are viewing, reducing API token usage. This data stays on-device and follows the same caching rules described above.
• Per-ASIN cost memory. When you enter a cost of goods (COGS) for a product, the extension remembers it for that ASIN in chrome.storage.local (key ppzCogsByAsin, capped at the 2,000 most recent entries) so the field is pre-filled the next time you open that product. It stays on your device and is never transmitted to us.
• Variation family cache (v1.3.0 and later). When you open Variation Confidence on a listing that has variations, the extension fetches the price, offer, and sales history of the sibling variations from Keepa using your own Keepa API key, up to 20 ASINs per request, after first reading whatever the Keepa browser extension already holds in its local cache. The result, including each variation's "bought in past month" history so the panel can read the same window your 3-Step Check does, is stored in chrome.storage.local (key varfam_ followed by the parent ASIN) for up to 24 hours so reopening the panel costs no tokens. If you turn on "include review history" in Settings (off by default), the same request also asks Keepa for each variation's review-count history; the extension shows you the token cost before you approve any fetch. This data stays on your device and is never transmitted to us.
• Remembered seller names (v1.3.0 and later). The public store names and rating figures the extension reads from seller profile pages (see §2.3) are kept in chrome.storage.local (key ppzSellerNames) for up to 30 days, capped at 500 sellers with the oldest removed first, so a seller already seen on one listing is not looked up again on the next. A stored rating older than 7 days is refreshed the next time that seller appears. Each entry holds only the public seller id, the store name, and the public rating counts. It stays on your device and is never transmitted to us.
• Product thumbnail images. During bulk scanning, the extension reads product image URLs from the Amazon page DOM (publicly visible Amazon CDN URLs). These are displayed locally in the bulk analyzer cards and are not transmitted to any external server.
• Your fee library and per-product fee choices. The custom fee library you build in Settings, and the fee selections you attach to individual ASINs, are stored in chrome.storage.local (keys ppzFeeLibrary and ppzFeeSelectionsByAsin) on your device only. They are used by the profit math that runs in your browser and are never transmitted to us or to anyone else.
• Your answer to the terms prompt (premium subscribers only). When you agree to or decline updated Premium terms, your answer is stored in your browser's synced extension storage, alongside your license key, as the version label and the date you answered. It syncs across the Chrome profiles you are signed into so that agreeing on one computer does not mean being asked again on another. Clearing the extension's storage removes it locally; because the same answer is recorded on our license server, you will not be asked again simply because you cleared it.
• Session storage. The extension uses chrome.storage.session to pass COGS (cost of goods) values between the bulk analyzer and product detail pages within a single browser session. This data is cleared automatically when the browser closes and is never transmitted externally.

2.3 Data the extension reads from Amazon pages

When you visit an Amazon product page in a supported marketplace (see manifest for the full list), the extension reads publicly visible product information from the page and from Keepa: ASIN, product title, price, fees, weight, dimensions, offer counts, sales velocity, hazmat/meltable flags, product thumbnail image URLs, and the listing's variation family (the sibling ASINs and the attributes that distinguish them). Beginning with version 1.6.0, the Sales DNA feature also reads each seller's stock and purchase-limit history and the sales rank history that Keepa already includes in the product data the extension receives, to estimate how many units sold at each price. No new request is made for it. The estimate is computed on your device, kept with the cached product data described in §2.2 and in the Bulk ASIN Analyzer files you choose to export, and never transmitted to us. If you enter your own seller ID in Settings so Sales DNA can mark your own sales, it is stored on your device only. It also queries Seller Central (using your existing logged-in session) to determine whether you are approved to sell the ASIN. Seller Central responses are parsed locally to render the eligibility lock icon; no credentials are captured or transmitted by us.

Seller Central data. For Premium subscribers, Profit Zones can also read your own Seller Central data, specifically your FBA inventory locations and your own listing price, directly in your browser using your existing logged-in Seller Central session. This is data you can already see in your own account. The extension reads it only after you authorize Seller Central access for the current browsing session, and you can pause that access at any time. Beginning with version 1.6.0, these reads require an active Premium license: without one, the extension does not request your inventory or listing price, even if you authorized that access earlier, and if your license lapses it stops making them. The sell eligibility check above is the only Seller Central read available without Premium, and authorizing it from the lock icon covers that check only. All of this data is processed locally on your device and is shown only to you. Profit Zones never transmits, aggregates, stores on our servers, or resells your Seller Central data. Beginning with version 1.4.0, and on every install no later than October 1, 2026, the extension's own Seller Central requests identify it by appending an Agent tag with our name to your browser's user agent, per Amazon's Agent Policy. Beginning with version 1.5.1, the requests the extension starts on its own on the Amazon shopping site carry the same tag: the Offers Table's requests described below, and the product pages the Bulk ASIN Analyzer loads in its scanner window when Keepa's local cache does not have a product. Pages you open or click yourself, including your own Amazon tabs, are never tagged. The tag changes one request header; it sends nothing new to Amazon, to us, or to anyone else. If Amazon shows a robot check in the scanner window, the scan pauses and hands it to you; the extension never solves, skips, or works around a robot check.

Two optional Bulk ASIN Analyzer features use the same authorized session. Gated status on bulk cards checks your approval status for each scanned ASIN, exactly as the lock icon does on a single product page. FBA inventory export reads your own FBA inventory quantities (on hand, reserved, inbound, unfulfillable) for the ASINs in a scan and assembles a CSV file that is downloaded directly to your computer. Both run only when you click the button that starts them, and neither sends anything to us.

Offers Table (v1.1.0 and later). The panel includes an Offers Table that lists the sellers on the listing you are viewing, with their fulfillment type, price, public rating, and the stock movement the extension observed. When you open the table, the extension requests two kinds of publicly visible Amazon pages from your own browser session on the Amazon site you are already on: the listing's "All offers" panel and the public seller profile pages of the sellers on that listing. These are the same pages you could open yourself by clicking through the listing. Beginning with version 1.5.1, these requests are sent by the extension's background process rather than from the page itself, still using your own browser session, so that they can carry the Agent identifier described above. The requests run only after you open the table, are throttled to a slow pace, and stop immediately if Amazon signals a rate limit. The responses are parsed locally and shown only to you; nothing from them is transmitted to us or to anyone else. Seller names in the table link to that seller's public page on keepa.com; that is an ordinary link, and nothing is sent to Keepa unless you click it. You can also export the table as a CSV file that is generated locally and downloaded directly to your computer.

Buy Box tab (v1.3.0 and later). The Offers Table also has a Buy Box tab that shows which sellers held Keepa's Buy Box on the listing over the period Keepa reports, using Keepa's Buy Box holder history, which is already part of the Keepa product data described in §2.2. Those sellers are often no longer on the listing, so when you open that tab the extension requests the public profile pages of up to eight of them, in the same throttled way and from the same browser session, to show their store names and ratings. Names and ratings it has already read are remembered on your device for 30 days (see §2.2) so the same profile is not fetched twice. Nothing from these pages is transmitted to us or to anyone else.

2.4 Data our license server receives

All license server requests go to api.officialolsons.com over HTTPS (with automatic fallback to license.amzunlocked.com during the domain transition).

• License activation / validation / deactivation: license key, device ID. For each activated device, our license server also records the IP address the request came from: the first one seen at activation, and the most recent one along with when it was last seen, updated each time the license is validated. We use these solely to enforce the per-license device limit and to spot a license being shared beyond it.
• Stripe webhooks (server-to-server, not from the extension): Stripe customer ID, Stripe subscription ID, customer email, plan type, current period end. Stored in our licenses database (Supabase).
• Customer portal redirect: license key and device ID (used to fetch a temporary Stripe-hosted portal URL). The Cancel Subscription button in Settings sends the same two items, plus a note asking the portal to open on its cancel step.
• GeoPrice price-spread proxy (premium): extension sends the target ASIN + license key header to our license server. Our server verifies the license and forwards the lookup to our upstream GeoPrice service. Your IP is not forwarded to the upstream; the upstream sees requests from our server IP.
• ASIN view logging (premium only): when a premium user views a product page, the extension sends the ASIN and public product metadata to our server to pre-warm the price-spread cache. Not called for free users.
• Promo banner and release-status configuration: the extension fetches two small static JSON files from our server. One describes which promotional banner (if any) to show in the panel footer. The other says which version of the extension is currently published, so the panel, the Settings page, and the extension's bundled update-help page can tell you when a newer version is available. The extension also reads it in the background, when it starts and about every 6 hours, to learn whether its Seller Central requests, and the Amazon requests it starts on its own, should carry the Agent identifier described in §2.3. Both are plain GETs with no license key or other identifier attached (like every request, they appear in the server request log below).
• Promo banner performance: when a promotional banner in the extension footer is shown or clicked, the extension sends an event containing only a banner identifier, the event type (shown or clicked), and the extension version. It is aggregated into a simple per-banner counter so we can measure which banners are useful. The event carries no license key, no personal data, no browsing data, and no Amazon or Seller Central data, and the counter is not tied to your account. Like every request to our server, it does pass through the request log described below.
• Server request log: like most web servers, our server keeps a log of the requests it receives: the time, the address requested, the IP address it came from, the browser user agent, and the requesting origin. We use it only to troubleshoot problems, prevent abuse, and reconcile usage of metered features such as live pricing scans. It is kept for 90 days and then deleted automatically.
• Terms acceptance (premium subscribers only): when your license requires you to agree to updated Premium terms, the extension shows you the terms and asks you to choose. If you agree, it sends your license key, your device ID, and the version of the terms you agreed to. If you decline, it sends the same three items so that your other devices stop asking you. Before the terms take effect, the prompt offers "I agree" and "Remind me later"; once they are in force, it offers "I agree" and "Decline". Nothing is sent while you have not answered: choosing "Remind me later", pressing Esc, or clicking outside the prompt closes it and sends nothing. When you agree or decline, our license server also records the IP address the request came from and your browser's user agent string (which identifies the browser and operating system), along with the date and time, so we can show that the answer was actually given. The version is a plain label such as 2026-10-01; we do not send the terms text back to ourselves, and we do not record anything about how long you spent reading, whether you opened the full terms, or where you were browsing when you answered.
• Live pricing scan counts (premium subscribers only): plans that include an allowance of live pricing scans need that allowance counted, so our license server records the number of regional price scans run under your license and the running totals it compares against your plan's daily and monthly limits. The panel shows you that meter, and shows how many scans are left, so the number is never a surprise. What is counted is the number of scans and the date, not what you looked at: the count is not stored against the ASINs you scanned, and it is not used to build a picture of what you research. Lifetime licenses are uncapped and are not metered at all.
• Scan top-up checkout (premium subscribers only, and only when you click it): if you run out of scans, the panel offers to add more. Choosing a pack sends your license key, your device ID, and the pack size to our license server, which returns a temporary Stripe-hosted checkout address that opens in a new tab. We never build the checkout address in the extension, and payment details are handled entirely by Stripe.
• Observed Sales reports (user-initiated only): the Stock Gap section of the panel shows a per-seller "Observed Sales" reading. If a reading looks wrong, you can click "Send to Profit Zones support", read a short confirmation of exactly what will be sent, and then click "Send". Only then does the extension send a report to our server. The report contains the ASIN, the Keepa marketplace id, the supply readings the extension computed for that listing (the observed sales bundle, the days-of-cover estimate and the stock figure it was based on, and the "bought in past month" figure shown on the Amazon page), the extension version, and the version of the reading rules that produced the result. The observed sales bundle includes Amazon merchant ids for the sellers on that public listing; these identify storefronts, not you. The report carries no license key, no email address, no device id, no user id, no Seller Central data, and no page URL. It is never sent automatically, and canceling at the confirmation step sends nothing.
• Unknown warehouse reports (user-initiated only, from version 1.6.3): when Buy Box by Metro finds your FBA inventory in an Amazon warehouse it does not recognize, it lists that warehouse as unmapped and offers a "Report code" link. If you click it, the extension sends our server the warehouse code, the date and the extension version, so we can add the warehouse to the map. It sends no inventory amounts, no product, no license key, no email and no device id, and nothing is sent unless you click. Like every request to our server, it appears in the server request log described above.

2.5 Data we do NOT collect

• We do not collect browsing history outside of Amazon product pages.
• We do not collect anything on non-Amazon sites. The extension has no content script on any page other than Amazon product detail pages, including a product page Amazon opens from a sponsored link (its address starts with /sspa/click). The only other place it runs code is inside the Keepa extension's own frame on that same Amazon page, to read Keepa's local cache as described in §2.2.
• We do not run third-party analytics or tracking SDKs (no Google Analytics, Segment, Mixpanel, Amplitude, Sentry, etc.). The only telemetry is the aggregate banner impression/click counter described in §2.4, which contains no personal or browsing data and is not tied to your account.
• We do not sell, rent, or share personal information with advertisers or data brokers.
• We do not read Amazon Seller Central dashboards, orders, customer messages, or any Seller Central data beyond the ASIN-approval status, your FBA inventory locations and quantities, and your own listing price described in §2.3, all of which are read locally on your device and never transmitted to us. The one exception, from version 1.6.3, is the code of an Amazon warehouse the map does not recognize, and only when you click to report it (see Unknown warehouse reports in §2.4).

2.6 Data this website collects

Sections 2.1 to 2.5, and the statements in this policy that we run no analytics, describe the extension. The extension runs no analytics. This website, profitzones.app, differs in two ways:

• Google Analytics, only if you accept. The first time you visit, a small banner asks whether you allow Google Analytics. Nothing is loaded from Google before you answer. If you click Accept, the site loads Google Analytics 4 (from googletagmanager.com), which sets first-party cookies and sends Google the pages you view on this site, the page that referred you, your browser and device type, an approximate location Google derives from your IP address, and a few named clicks on this site (Add to Chrome, a Premium checkout button with its plan, a paper download, and the support email link). We use it only to see which pages help. The site uses Google's consent mode: analytics storage is denied by default, it is granted only when you click Accept, and advertising storage stays denied either way. If you click Decline, Google Analytics is never loaded. Your choice is remembered in your browser's local storage (key pz-consent) and is never sent to us. You can change your choice anytime with "Cookie settings" in the footer of every page: withdrawing consent sets analytics storage back to denied, removes the Google Analytics cookies this site set, and shows the banner again. Google processes this data under its own privacy policy.
• Your theme choice. The site also remembers your theme choice (light, dark or system) in your browser's local storage. It is never sent to us.

3. How we use the information

• Product analysis: when the extension falls back to the Keepa API (see §2.1), your Keepa API key and product identifiers (including a listing's sibling variations when you open Variation Confidence) are sent to Keepa to fetch price history. All profit calculations happen locally in your browser.
• Sell eligibility: the extension checks your approval status for a product using your existing Seller Central session. No credentials are captured.
• License management: your license key and device ID are sent to our server to validate your subscription. The IP addresses recorded with each device activation are used only to enforce the per-license device limit and to prevent abuse from a license being shared beyond it. Validation runs when you activate, when Chrome starts, and on a background alarm about every 6 hours (the extension also re-checks when its background worker wakes, but never more often than once every 15 minutes).
• Payment: email and payment method are collected by Stripe during checkout. We receive only your email and subscription status via webhook.
• Regional pricing (premium): product identifiers are sent through our server to fetch Buy Box prices across US markets.
• Cache warming (premium): product identifiers and public metadata are sent to our server when you view a product page.
• Support: when you click Email Support, your own mail client opens a message to support at profitzones dot app; we use what you send us only to answer you.
• Terms acceptance: we use your recorded agreement solely to establish that you were shown the current Premium terms and agreed to them, and to know which version you agreed to so we do not ask you again. We use a recorded decline solely to stop prompting you on your other devices and to switch off the Premium features the terms govern. The IP address and user agent stored with either record are used only to show that the answer was made. Neither record is used for marketing, is shared with anyone, or is sold.
• Live pricing scan counts: we use them to enforce and display your scan allowance, and in aggregate to size the capacity we buy from our regional pricing provider. We do not use them to profile your sourcing activity.
• Observed Sales reports: when you choose to send one, we use it only to check and correct the supply and velocity readings behind the Stock Gap feature. The report carries no license key or account details, so we cannot reply to it, and we do not connect it to your account.

We do not use your data for advertising, profiling, model training, or any purpose beyond those listed here.

4. Third-party services

We contract with the following services to deliver the extension. Each has its own privacy policy; we have linked them for convenience.

• Keepa GmbH: product data provider. If you provide your own Keepa API key, it is sent only to Keepa; we never proxy Keepa traffic through our servers. Privacy policy
• Stripe, Inc.: payment processor for premium subscriptions. Stripe collects your email and payment method directly on its hosted checkout, both for subscriptions and for scan top-up packs; the extension never sees payment details. Privacy policy
• Supabase, Inc.: hosted PostgreSQL database for our licenses table (license key, Stripe customer/subscription IDs, email, plan, period-end), device activations with their recorded IP addresses, and terms acceptance and decline records. Privacy policy
• White Dog Inc (api.officialolsons.com, with fallback to license.amzunlocked.com): validates premium license keys, records your answer to the Premium terms prompt and counts your live pricing scans, proxies GeoPrice requests, logs premium ASIN views for cache warming, receives user-initiated Observed Sales reports, serves the promo banner and release-status configuration and records aggregate promo-banner performance counters, and (until older installs update) receives messages from the retired in-app feedback form. Hosted on a private VPS; database on Supabase (listed above).

5. Data retention

• On-device data (Keepa API key, license key, device ID, settings, per-ASIN cost memory, fee library, cached product data, the variation family cache, remembered seller names, bulk batch files): retained in Chrome storage / IndexedDB until you uninstall the extension, clear Chrome's site/extension data, or your browser's cache-clearing rules remove it. You can delete it at any time from chrome://settings/cookies or by uninstalling the extension.
• Licenses database (Supabase): we keep the license record (email, Stripe customer ID, license key, plan, period-end, device activations and the IP addresses recorded with them) for as long as your subscription is active. After cancellation, we retain it for 12 months so we can handle refund disputes, tax/accounting, and reactivation. You can request earlier deletion by emailing us (see §7).
• ASIN view logs (premium only): retained for 90 days. Logs are not tied to an identifiable person; they are associated only with the license key that submitted them.
• Support email: lives in our support mailbox like any other correspondence. Messages sent through the retired in-app feedback form by older builds are retained on our license server. You can email us to request deletion of a specific message.
• Observed Sales reports: retained on our license server as engineering data for improving Stock Gap detection. They are not tied to a license key or to any identifiable person, so there is no per-user record to look up or delete; if you want one removed, email us the ASIN and the approximate date you sent it.
• Server request log: kept for 90 days, then deleted automatically.
• Terms acceptance and decline records (including the IP address and user agent recorded with each): retained for as long as your license exists, and then for as long afterwards as we may need to show which version of the terms applied to your account. This is the one record on this list we cannot delete on request while your license is active, because the record is the agreement; deleting it would leave us unable to show what you agreed to. Deleting your license removes it.
• Live pricing scan counts: retained as daily per-license totals. They are not tied to individual scans or to any ASIN, and they age out on our ordinary server-log retention schedule.
• Stripe payment records: retained by Stripe per its own policies; we recommend reviewing Stripe's privacy policy linked above.

6. Security

• All outbound traffic from the extension uses HTTPS/TLS.
• Internal services are not externally accessible.
• Stripe webhooks are verified by cryptographic signature before we trust any event; unsigned or invalidly signed requests are rejected.
• All Keepa calls use your personal API key, which is never stored on company servers (regenerate at keepa.com/#!api if exposed).

No system is perfectly secure. If we become aware of a breach that affects your data, we will notify you at the email associated with your license (if any) and post a notice at the extension's support page.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain processing. In particular:

• Access / export: email us and we will send you a copy of every record keyed to your license or email.
• Correction: email us to update an email address or correct a record.
• Deletion: email us to delete your license record (this terminates any active subscription; cancel via the Stripe customer portal first if you want to end billing).
• Withdraw consent: uninstall the extension at any time; this stops all on-device collection and all transmission.
• Complaint: if you are in the EEA, UK, or California, you may lodge a complaint with your local data protection authority.

To exercise any right, email support at profitzones dot app. We aim to respond within 30 days.

8. Children's privacy

The extension is a professional tool for Amazon FBA sellers. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

9. International users

The extension is developed in the United States. By using it, you agree that your data may be processed in the United States and in any country where our third-party providers operate (Supabase, Stripe are primarily US/EU-based). We rely on standard contractual clauses and provider-level safeguards where applicable.

10. Changes to this policy

We will update this policy whenever the extension's data practices change materially (for example, when a new external service is added or the set of collected fields changes). The "Effective Date" at the top of this document always reflects the most recent update. Material changes will also be noted in the extension's "What's New" section in Settings and in the Chrome Web Store listing changelog. Continued use of the extension after an update constitutes acceptance of the revised policy.

11. Contact

Email: support at profitzones dot app

In-app: Settings → Email Support (opens your mail client addressed to support at profitzones dot app; fastest route for support questions)

Website: https://profitzones.app