Privacy Policy
Last Updated: November 6, 2026 • Version 1.0
🛡️
Local-First & Zero-Knowledge Architecture
PickList processes all your orders, SKU calculations, and pull list sequencing 100% locally on your computer. Your sales data, buyer names, and order histories are never collected, stored, or transmitted to any third-party analytics or external database servers.
1. Introduction
This Privacy Policy describes how PickList ("we", "us", or "our") handles information in connection with our Google Chrome extension, companion helper scripts, and related software (collectively, the "Software").
We built PickList specifically for high-volume online resellers. We understand that your inventory counts, supplier SKUs, and buyer details are confidential business assets. Our architecture is deliberately designed so that we never receive, see, or broker your commercial sales data.
2. Information Accessed & Handled
PickList interacts only with the minimum necessary data to fulfill its single core purpose: turning multi-channel sales into a sequenced physical picking checklist.
A. Sales & Order Information from Nifty
- What is accessed: When you initiate a sync, the Software reads recent order summaries (item titles, SKU numbers, selling prices, marketplace platforms such as eBay, Poshmark, Mercari, Depop, Etsy, and order timestamps) directly through your existing, authenticated browser session with Nifty.
- How it is processed: This information is held transiently in your computer's local memory, parsed into physical warehouse locations (racks, bins, shelves), and formatted into task titles.
- Where it goes: It is sent directly to your chosen destination task application (Apple Reminders via local bridge/Shortcuts, or Google Tasks via direct Google API). It is never sent to our servers.
B. Google Tasks & Google Account Data
- What is accessed: If you connect Google Tasks, PickList requests permission to access the
https://www.googleapis.com/auth/tasks scope.
- How it is used: PickList uses this access solely to create and manage your designated "Daily Pull List" task list, insert sequenced order items, and check for existing tasks to prevent duplicates.
- Authentication Tokens: OAuth 2.0 access tokens and refresh tokens are securely stored locally within your browser using Chrome's native
chrome.identity and chrome.storage.local APIs. Tokens are never transmitted to external servers.
C. Extension Settings & Local Cache
- PickList stores your preferred sync settings (such as chosen task destination, sorting mode, lookback window, and last sync timestamp) strictly within your browser's local sandbox via
chrome.storage.local.
D. Payment Information
- License payments are securely processed by Stripe.
- We do not receive, process, or store your credit card details, bank account numbers, or billing addresses. Stripe provides only a customer identifier and a confirmation of active license status.
3. Google API Services User Data Policy (Limited Use Disclosure)
PickList's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, analytics, profiling, or machine learning model training.
4. Data Sharing & Third Parties
- No Sale of Personal Data: We do not sell, rent, license, or disclose your personal information or your buyers' information to third parties, data brokers, or advertisers for any reason.
- No Tracking Analytics: PickList does not load Google Analytics, telemetry scripts, ad networks, or background user tracking software.
- Direct API Communication: All network requests made by the extension are direct, encrypted HTTPS requests between your browser and the respective official service endpoints:
api.nifty.ai (your inventory source)tasks.googleapis.com (official Google Tasks API)*.workers.dev (secure license verification)
5. Data Retention & Deletion
- Transient Processing: Order details from Nifty are processed in-memory and discarded once the tasks are delivered. No permanent database of your sales exists on any server.
- Local Data Removal: You can completely erase all local settings, cached timestamps, and stored OAuth credentials at any time simply by removing the extension from your browser (
chrome://extensions → Remove).
- Google Access Revocation: You can disconnect PickList's access to your Google Tasks account at any time through your Google Security Settings at https://myaccount.google.com/permissions.
6. Security
We employ defense-in-depth security practices. All communications with third-party APIs utilize industry-standard Transport Layer Security (TLS/HTTPS). In accordance with Chrome Extensions Manifest V3 standards, PickList executes within a sandboxed environment with zero inline script execution, strict Content Security Policy (CSP), and minimal requested privileges.
7. Children's Privacy
The Software is designed for commercial business operators and resellers and is not intended for use by children under the age of 13. We do not knowingly access or collect information from children.
8. Changes to this Privacy Policy
We may periodically update this Privacy Policy to reflect changes in our practices, platform requirements, or applicable laws. Any modifications will be posted here with an updated "Last Updated" timestamp.
9. Contact Us
If you have questions, feedback, or privacy-related inquiries regarding PickList, please reach out to us: