Privacy & Cookie Policy

This Privacy and Cookie Policy explains what data CARTHACKER LLC ("CartHacker", "we", "us") collects when you use carthacker.com (the "Service"), why we collect it, where it is stored, and what rights you have under the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA). We wrote this document to be read, not skimmed. No filler, no ambiguity.

1. Data Controller

CARTHACKER LLC, Registration Number 0008117506, organized under the laws of New Mexico, USA.

• Mailing / European contact address: c/o POSTFLEX PFX-509-419, Emsdettener Straße 10, 48268 Greven, Germany
• Privacy contact: reveal protected email

2. What We Collect

2.1 Account Data

• Email address - required for account creation, Premium billing receipts, and the newsletter (opt-in only).
• Username - your public identifier for comments and account access.
• Country - the two letter country code that our network edge provider, Cloudflare, attaches to each request, saved on your account each time you sign in. It has one job: when an email from us names the CartHacker Premium price, it quotes the price for your country, in your currency and with tax included where your country requires it. The IP address it was derived from is not stored with it. Legal basis: legitimate interest in quoting a price that is correct and lawful where you live (Art. 6(1)(f) GDPR).

2.2 Technical Data

• IP address - Cloudflare, our network edge provider, forwards the connecting IP address to our servers with every request. We use it for security (the Wordfence firewall and rate limiting, which work on a one-way hash of the address) and to build the one-way hashes described in Sections 2.3 and 2.6 to 2.8, and it appears in server security logs, which rotate automatically (Section 7). We never build profiles from it.
• Request metadata - user agent, referrer, and timestamps, processed in standard server logs for security and debugging.

2.3 Site Statistics (CH Pulse)

We measure carthacker.com with CH Pulse, a script of our own that reports only to our own servers in Finland. When a page loads, it sends one request with the path of the page (any query string removed), the domain of the page that linked to it, the campaign tags in the link if it has any (utm_source, utm_medium and utm_campaign), the width of the browser window and the first two letters of the browser language. While you read, it reports every 30 seconds how long the tab was in front of you with some activity and how far down the page you scrolled. It also notes a click on a CartHacker Premium button, a sign-up link, a link to one of our tools, the newsletter or another website, and copying a code example. That is all of it.

CH Pulse sets no cookie and writes nothing to your browser's storage. From the request itself we derive the browser and operating system families, a device class (mobile, tablet or desktop) and the two letter country code that Cloudflare attaches to the request. Unique visitors are counted with a daily visitor code: a one-way hash of your IP address and user agent, combined with a secret key that our server creates for each day and deletes two days later. Once that key is deleted, nobody, us included, can connect the code to an address, and the same reader on two different days counts as two visitors. CH Pulse never stores your IP address.

If you are signed in, the page views and clicks above are stored with your CartHacker account, which is how we learn which guides members actually finish and which tools they come back to. It decides what we write and build. Nobody outside CartHacker sees this record, and we never sell it or use it for advertising.

CH Pulse does not run at all when your browser sends a Global Privacy Control or Do Not Track signal. Requests from known bots, crawlers and page speed tools are thrown away, and so are requests that do not come from a page on carthacker.com. Legal basis: legitimate interest in measuring and improving our own website (Art. 6(1)(f) GDPR). You can object at any time. Write to the privacy contact in Section 1, or switch on Global Privacy Control in your browser, which stops the measurement on every page at once.

Programs such as AI assistants can ask for the Markdown version of a page, a plain-text copy without the layout. Each such request is added to two daily totals on our server: one for the page, and one for the family of the program that asked, read from its user agent (for example Claude or ChatGPT). That is the whole record. It holds no IP address, no visitor code and no account, and a request that carries a Global Privacy Control or Do Not Track signal is not counted.

Search engines and AI services read public pages with automated programs called crawlers, such as Googlebot, Bingbot, GPTBot and ClaudeBot. Our server recognizes them by the name in their user agent. It also checks the connecting address against the address lists that Google, Microsoft, OpenAI, Perplexity and Apple publish, which tells a real crawler from a program that only borrows its name. For every crawler request we keep the crawler's name, the time, the page it asked for (any query string removed), the response code, how long our server took to answer and the result of that check. That is the whole record. It holds no IP address, no visitor code and no account, and a request whose user agent names no crawler is never part of it.

2.4 Behavioral Engagement Telemetry (Anti-Spam and Security)

The Service runs a lightweight, first-party engagement engine that measures behavioral usage patterns: active reading time on a page, page view counts, and code snippet copy events. This exists for two reasons:

• Security and rate limiting - copy-event throttling and abuse detection protect our infrastructure and content from automated scraping and spam.
• Interface behavior - the same signals drive on-site interface states, such as when we invite highly engaged readers to consider a Premium subscription.

These counters are stored in your browser's localStorage (first-party, never transmitted to advertising networks) and, for rate-limiting purposes, as a short-lived server-side counter keyed to a hashed identifier that expires automatically within hours. No cross-site tracking is involved. Legal basis: legitimate interest in securing our infrastructure (Art. 6(1)(f) GDPR).

2.5 Payment Data

Premium payments are processed by Paddle.com, our online reseller and Merchant of Record. We never receive or store your full card number. We receive only transaction confirmations, subscription status, and billing country.

2.6 QR Code Generator and Scan Data

The QR Code Generator builds codes entirely inside your browser. With scan tracking switched off, which is the default, the content you type into it is never transmitted to us - not the web address, not the business card details, not the WiFi password. Those codes carry your content directly in the printed pattern, no request passes through our servers when somebody scans one, and no scan of them is ever visible to us or to you. Switching scan tracking on is the only thing that changes this, and the paragraph below sets out exactly what it changes.

Saving a code is opt-in and requires an account. When you switch scan tracking on, we create a short link on our domain and store the payload you chose, so that we can answer scans and so that you can change what the code says later. What we store depends on the code type: a website code stores the destination address; a business card code stores the contact fields you filled in; a WiFi code stores the network name, the security type and the network password in readable form, because a phone that scans it has to be shown the password to be able to join; a text code stores your message. For the last three, scanning opens a page hosted by us that displays those details. Anyone holding the code can read them, which is the point of printing it, so treat a saved WiFi code exactly as you would treat the sign it is printed on and delete it when the credentials change for good.

Alongside the payload we store two things that describe the picture rather than the content: a design record (the colours, module shape, corner style, frame, call to action text, error correction level and, if you added one, a reduced copy of your logo image) and a rendered PNG copy of the code at up to 1024 pixels. Both exist so that you can return months later, recover your exact settings and download the same file again instead of rebuilding it from memory. Both are overwritten whenever you restyle the code, and both are erased the moment you delete the code or your account.

Each scan of a saved code records:

• a salted, one-way hash of the scanning device's IP address - the address itself is never written to disk, and the hash exists only to separate repeat scans from unique ones;
• the two letter country code supplied by our network edge provider;
• a device class (mobile, tablet or desktop) and operating system family derived from the browser user agent;
• the timestamp of the scan.

We do not store raw IP addresses of scanners, we do not set cookies on the scanning device, we do not pass scan data to advertising networks, and we do not build profiles of the people who scan your codes. Requests from known crawlers and link preview services are discarded rather than counted. Scan data is visible only to the account that owns the link.

Legal basis: contract (Art. 6(1)(b) GDPR) for account holders who choose to create tracking links, and legitimate interest (Art. 6(1)(f)) in aggregate, non-identifying scan measurement and in protecting the redirect service from abuse. If you are an account holder using tracking links for your own customers, you act as the data controller for that campaign and we act as your processor.

2.7 Trust Seals & Badges on Your Store

If you install the Trust Seals & Badges script on your store, your shoppers' browsers load it from carthacker.com. It draws your badges. Each time the shopper leaves a page with badges or switches tabs, their browser sends what changed since its last report: the store key, the page path without its query string, the language the badges were shown in, a device class worked out from the browser window width and, for each group, whether it was shown, whether at least half of it was on screen for one second, how many badge links were clicked and which badges they were, and, only while an impact test runs, whether that page view showed or held back the group and whether an add to cart happened. The device class is mobile, tablet or desktop.

Only daily totals are stored. The script sets no cookie and writes nothing to the shopper's browser storage, no identifier of the shopper exists anywhere in the system, and we do not record IP addresses: a one-way hash of the address is held for one minute to rate-limit abusive traffic and then expires. Requests from browsers on addresses other than the store address you registered, and from known bots and page speed tools, are discarded. Legal basis: legitimate interest in aggregate, non-identifying measurement for the store owner (Art. 6(1)(f) GDPR). For your shoppers' page views you act as the data controller and we act as your processor.

2.8 Core Web Vitals Monitoring on Your Store

Core Web Vitals Monitoring is the snippet you paste into your store's theme to see its real loading times in the Core Web Vitals tab of your dashboard. Your shoppers' browsers load it from carthacker.com, or from your own site when the CartHacker WordPress plugin installs it (Section 2.10); the script and what it sends are the same. Once per page view, when the shopper leaves the page or switches to another tab, or after five minutes on it, the script sends one request back to us containing: your site key; the path of the page, with the query string and anything after a # removed; the platform and the kind of page (for example a product page or the cart), worked out from the page itself; the network type the browser reports, such as 4g; the width of the browser window; and the loading measurements the browser records about that page, which are Largest Contentful Paint, Interaction to Next Paint, Cumulative Layout Shift, Time to First Byte, First Contentful Paint and the total load time.

From the request itself we derive, and store with each page view: the browser and operating system families, read from the user agent (for example Chrome on Android); a device class (mobile, tablet or desktop); the two letter country code that Cloudflare attaches to the request; and a daily visitor code. That code is a one-way hash of the shopper's IP address and user agent, combined with the date and a secret key held on our server. It only counts unique visitors per day. Because the date is part of it, the same shopper produces an unrelated code the next day, so a visit cannot be linked to a visit on any other day. The IP address itself is never written to the database; a separate hash of it is held for one minute to stop one machine from flooding the endpoint, and then it expires.

Monitoring keeps one record per page view, because loading times are reported as percentiles and a percentile cannot be computed from a daily total. Those records are deleted after 45 days. Before that, a daily job reduces them to statistics per day: page views, unique visitors and loading times by page type, device, browser, operating system and country, plus a rolling list of your most visited pages with their loading times. The script sets no cookie and writes nothing to the shopper's browser storage. Requests from addresses other than the store you registered, and from known bots, crawlers and speed testing tools, our own included, are discarded.

On CartHacker Premium we also test up to 50 of your store's most visited pages on a rotating schedule, through Google's PageSpeed Insights and Chrome UX Report services (Section 4). Google receives the public address of each page tested and nothing about your shoppers. Legal basis: legitimate interest in aggregate performance measurement for the store owner (Art. 6(1)(f) GDPR). For your shoppers' page views you act as the data controller and we act as your processor. The records are visible only to the account that registered the store, and we never combine them with any other data.

2.9 Account Activity

Your account keeps a short activity record: when you sign in and with which method, which PDF tools you start while signed in, and when you were last on carthacker.com and on which page. Read together with what your account already holds (speed tests, QR codes, badge groups and monitoring snippets), it shows us how the tools are really used and lets us answer a support question with facts instead of guesses. Only CartHacker can see it. Legal basis: legitimate interest in running, securing and improving the Service (Art. 6(1)(f) GDPR).

2.10 CartHacker Plugins Connected to Your Account

A CartHacker WordPress plugin contacts carthacker.com only after you press its connect button (Start free monitoring or Build my trust badges) and confirm the connection on carthacker.com while signed in. For each connected site we store: the site's address; which CartHacker tool the plugin serves (Core Web Vitals Monitoring or Trust Seals & Badges); the plugin version it reports; when the site was connected and when the plugin last called us; and a one-way hash of the access token the plugin holds. The token itself goes to the plugin once. We never store it. The plugin also tells us whether the site runs WooCommerce, which sets the platform of your store in the dashboard. Between your confirmation and the plugin's first call we also keep a one-time code, as a hash, which is deleted when it is used or after two minutes. To rate-limit those calls, a one-way hash of the calling server's IP address is held for ten minutes and then expires.

With that token the plugin can read, and only read: your plan, the site key or badge store key it needs, and the statistics your dashboard shows for that tool. It shows your display name and a shortened form of your email address in your WordPress admin. It cannot change your account, your settings or your billing. Disconnecting the site in the plugin or in Settings, Store, Connected sites deletes the token at once. What the plugin measures on your store is described in Sections 2.7 and 2.8. Legal basis: contract (Art. 6(1)(b) GDPR).

3. Infrastructure and Data Location

• Origin servers: Hetzner Online GmbH, data centers located in Helsinki, Finland. Application data at rest stays within EU data boundaries.
• Email delivery: transactional and support email is routed through our Zimbra infrastructure hosted with OVH (EU).
• Edge and DDoS protection: Cloudflare, Inc. acts as a reverse proxy in front of every request, caches public files and filters attack traffic before it reaches our servers.
• Web Application Firewall: Wordfence operates at the application layer to block malicious requests. It processes request metadata strictly for security purposes.

4. Third-Party Processors

We share data only with processors necessary to operate the Service, under data processing agreements:

• Paddle - payment processing, sales tax and VAT, and subscription billing, as our Merchant of Record.
• Cloudflare - edge security, caching, and network delivery.
• Resend - delivery of account email (sent from mail.carthacker.com) and of the newsletter (sent from news.carthacker.com), from its EU region in Ireland. Resend receives the recipient address and the message itself. Links in newsletter email, and only there, pass through Resend click tracking (links.news.carthacker.com), which records that a link was opened; whether an email was opened is not tracked. The subscriber list itself stays in our own account database.
• Google PageSpeed Insights and Chrome UX Report - page speed testing for the Store Speed Test and the automated tests in Core Web Vitals Monitoring. Google receives the public web address being tested, and no account or shopper data is sent with it.

Where data leaves the EU (for example to Google in the USA), transfers are protected by Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

5. Cookies and Local Storage

5.1 Strictly Necessary (no consent required)

• Authentication cookies - keep you logged in to your account.
• Security cookies (Wordfence WAF) - distinguish legitimate visitors from attack traffic.
• Preference cookie (ch_theme) - remembers your dark/light mode choice for 365 days. Contains no identifier, only the literal value "dark" or "light".
• Sign-in preference cookie (ch_hint) - remembers which sign-in method you used last (the literal value "google", "facebook", "github", or "email") for 180 days, so the sign-in prompt leads with the right button. It contains no account identifier and no personal data.
• Sign-in prompt cookie (ch_ql_mute) - set only when you dismiss the sign-in prompt, so we stop showing it. Contains the literal value "1" and nothing else.
• localStorage engagement counters - described in Section 2.4, used for security and rate limiting.
• Recommended card memory (localStorage "chRec") - the card in the article sidebar that recommends CartHacker Premium remembers, in your own browser, when you last saw each recommendation, which ones you clicked and whether you paused it, so the next article opens on a different one. It holds those times and a pause setting, nothing else, and is never sent to us.
• Badge builder draft (localStorage "chb-draft") - keeps an unsaved design from the Trust Seals & Badges builder in your own browser for up to 7 days, so that signing up does not lose it. It is not sent to us until you press Save.
• Store connection cookie (chb_connect) - set only while a store plugin connects to your account, and kept for 15 minutes so the connection survives signing in. It holds the connecting store's address and the plugin's return address.
• Plugin connection cookie (ch_connect) - set only while a CartHacker WordPress plugin connects to your account (Section 2.10), and kept for 15 minutes so the connection survives signing in. It holds the connecting site's address, the plugin's return address and the plugin's one-time security values.

5.2 Sign-In Prompt (Google Identity Services)

If you are not signed in, we may show Google's own sign-in prompt so you can create a free account in one tap. This loads a script from Google (accounts.google.com), and Google may read its own cookies to determine whether you are already signed in with them. Google acts as an independent controller for that check; see the Google Privacy Policy.

The prompt never transmits your identity to us unless you actively choose to continue. Dismiss it and it stops appearing, for progressively longer periods each time. If you prefer never to see it, dismissing it twice suppresses it for a year on that browser.

5.3 Analytics and Marketing

We currently use no analytics cookies and no advertising cookies, and our own site statistics (Section 2.3) set no cookie of any kind. If we add analytics such as Google Analytics 4 or advertising on free content in the future, we will ask for your consent with a cookie banner before any such cookie is set, add a cookie settings link to every page so you can withdraw that consent at any time, and update this policy first. Refusing those cookies will never restrict access to any content.

6. Legal Bases (GDPR)

• Contract (Art. 6(1)(b)) - account management, Premium subscription delivery, billing.
• Legitimate interest (Art. 6(1)(f)) - infrastructure security, WAF, rate limiting, fraud prevention, aggregate service improvement, our own site statistics (Section 2.3) and the account activity record (Section 2.9).
• Consent (Art. 6(1)(a)) - the newsletter, and any analytics or advertising cookies we may add in the future.
• Legal obligation (Art. 6(1)(c)) - tax and accounting records for paid subscriptions.

7. Retention

• Account data - for the life of the account, deleted within 30 days of a verified deletion request.
• Billing records - as required by tax law (typically 10 years for invoice data).
• Server security logs - rotated automatically, typically within 30 days.
• Site statistics (CH Pulse) - each page view and click record is deleted after 13 months; after that only daily totals remain, with no visitor code and no account in them. The secret key behind the daily visitor code is deleted two days after the day it served.
• Crawler requests (Section 2.3) - each request record is deleted after 14 days; daily totals per crawler and per page, and the first and last visit of each crawler to each page, are kept for 13 months. None of them holds an IP address.
• Account activity - sign-in, tool and last seen records are deleted after 13 months, and at once when you delete your account. Page views stored with your account lose that link when the account is deleted and count as anonymous from then on.
• Behavioral engagement counters - localStorage persists until you clear it or reset it in-app; the server-side rate-limiting counter expires automatically within 12 hours.
• Trust Seals & Badges - badge groups are kept while they exist on your account, their daily view totals for 400 days and the split by page, language and device for 190 days. Deleting a group erases its counters. Deleting your account erases all of it.
• Connected plugin sites (Section 2.10) - kept until you disconnect the site, the plugin disconnects itself, or you delete your account. One-time connection codes are deleted when used or after two minutes.
• Core Web Vitals Monitoring - the record of each page view is deleted after 45 days, while the daily statistics and the list of most visited pages are kept for as long as the store stays registered on your account, which is what lets Premium show months of history. Removing the store from the Core Web Vitals tab erases all of it. So does deleting your account.
• Saved QR codes, their payloads, their design records, their stored PNG copies and their scan records - retained while the code exists on your account. Deactivating a code stops it resolving immediately but keeps everything else intact so you can switch it back on; deleting the code erases its payload, its design, its stored image and every scan ever logged against it, and none of that is recoverable. Deleting your account removes all of it.

8. Your Rights - GDPR (EU/EEA Visitors)

• Right of access, rectification, and erasure of your personal data.
• Right to restriction of processing and right to object to processing based on legitimate interest.
• Right to data portability in a machine-readable format.
• Right to withdraw consent at any time, without affecting prior processing.
• Right to lodge a complaint with your local supervisory authority.

Send requests to reveal protected email. We respond within 30 days and may ask you to verify ownership of the email address associated with the request.

9. Your Rights - CCPA/CPRA (California Residents)

• Right to know - what categories of personal information we collect and why (this document is the disclosure).
• Right to delete - request deletion of your personal information, subject to legal retention duties.
• Right to correct - request correction of inaccurate personal information.
• Right to opt out of sale or sharing - we do not sell personal information, and we use no advertising cookies, so nothing is shared for cross-context behavioral advertising under the CPRA. We honor Global Privacy Control (GPC) signals, and if we ever add advertising cookies, a cookie settings link on every page will let you opt out.
• Right to non-discrimination - exercising your rights never degrades your access to the Service.

10. Children

The Service is a professional resource for e-commerce operators and is not directed at children under 16. We do not knowingly collect data from children.

11. Changes to This Policy

We will post any changes on this page and update the date above. For material changes affecting registered users, we notify you by email before the changes take effect.

12. Contact

Privacy questions, GDPR/CCPA requests, and data protection inquiries: reveal protected email or by post to CARTHACKER LLC, c/o POSTFLEX PFX-509-419, Emsdettener Straße 10, 48268 Greven, Germany.