Fexlo Privacy Policy
This policy describes what the code in this version of Fexlo actually does. If the code changes, this text changes with it.
Effective date: 2026-10-26 · Version of Fexlo this describes: 0.10.1
Who we are: Fexlo is made and operated by Akhil Gupta (“we”). Contact: akhil1998@gmail.com.
1. The short version
- Fexlo is a Chrome extension that collects, organises, compares and exports public product-catalogue data from websites you choose.
- What you collect stays in your browser. Products, variants, pages, your lists of websites, your filters and your batches are stored on your device (in the extension's own browser storage). Fexlo does not upload them to us or to anyone else, and it has no analytics, advertising or tracking.
- To have an account, Fexlo sends a small amount of account data to our account service (Supabase): your name, email, password (for sign-in), optional organization, and your account status.
- Before each new extraction Fexlo asks the account service whether your account may extract right now. That request carries your sign-in token, nothing about the websites or products.
2. What data is processed, where, and why
| Data | Where it goes | Why | Kept |
|---|---|---|---|
| Full name, email address, optional organization | Our Supabase project (Postgres, hosted in the AWS Asia Pacific (Mumbai, India) region) | To create and identify your account and greet you | Until you delete your account |
| Password | Supabase Auth, which stores only a salted hash. The extension never stores or logs your password after sign-in | To sign you in | Until you delete your account |
| Email verification (when it is switched on) and password-reset emails | Sent through Supabase Auth's email delivery (and any email provider we configure there; we will name it here if that changes) | To verify your address and let you reset your password | Per the provider's retention |
| Sign-in session (tokens) | Your browser's extension storage | To keep you signed in | Until you sign out or the session expires |
| Account status (active / suspended), role, timestamps | Supabase | To let an administrator suspend abusive accounts and to run the global on/off switch | Until deletion |
| Administrator audit trail (who suspended/activated whom, which settings changed) | Supabase, readable only by administrators | Accountability | For as long as needed for accountability; entries are limited to the action, the administrator, the affected account and the time (no passwords, tokens or product data) |
| Service request logs (time, address of the request, browser type, which account function was called) | Supabase's own infrastructure logs for our project | To run, secure and debug the account service | For the provider's log retention period |
| Which datasets you last chose in Product Insights | Your browser's extension storage | To reopen Insights where you left it | Until you change the choice or remove the extension |
| A temporary copy of an unsaved edit (written only while a panel closes) | Your browser's extension storage | So the last edit is not lost; removed after the next successful save | Until the next start of Fexlo |
| Products, variants, collection data, exports | Your browser only | The purpose of the extension | Until you delete them (Library → Delete) or remove the extension |
| Lists of websites, filters, saved lists, batches, progress | Your browser only | Bulk Fetch | Same |
| Websites you ask Fexlo to read | Contacted directly from your browser with ordinary public requests (no cookies, no login) | To read the public catalogue you asked for | Not stored by us |
We do not receive, store or sell: the products you collect, the websites you list, the pages you visit, your browsing history, or the contents of your exports. Fexlo does not read your history and does not enumerate your tabs.
3. What the extension does on websites
- On a page you are looking at, when you click the Fexlo toolbar button, Fexlo reads that page to find product lists (Chrome's “active tab” permission applies only to the tab you clicked on).
- For Bulk Fetch, Fexlo asks Chrome for access to each website you list, one at a time, from your click. Without your permission it does nothing on that site. You can withdraw it any time in Chrome (Extensions → Fexlo → Site access).
- Fexlo opens each listed site in a background tab, reads only its public catalogue files at a gentle pace (spaced requests, one at a time per site), obeys
robots.txt, and stops when a site refuses (401/403), asks it to slow down (429) or shows a bot check. It does not solve CAPTCHAs, rotate proxies or disguise itself. - Product Insights (price statistics, availability counts, change detection) are calculated on your device from data you already collected. No AI service is used and nothing is sent anywhere.
- All code that runs is inside the extension package. Fexlo never downloads or runs code from a server.
4. Sharing
- Supabase (our account service provider) processes the account data in §2 as our processor.
- During Early Access an account may be activated without verifying your email address; we then record on the account that the address was not verified, and we do not use it as proof of identity. Email delivery for verification (when switched on) and password-reset messages goes through Supabase Auth and the sending service configured there. Those messages contain only a link and your address.
- We do not sell personal data, do not use it for advertising or credit decisions, and do not share it with third parties except as required by law.
- The websites you read see ordinary requests from your own browser/IP address, like any visit. Fexlo cannot hide that.
5. Your choices and rights
- Edit your name and organization in Account → Profile.
- Delete your account in Account → Profile → Delete account. This removes your Supabase account and profile. Data stored on your devices (your Library, batches, exports) is not removed by this; it is yours and stays until you delete it (Library → Delete all) or uninstall the extension. Copies of exports you saved are outside our control.
- Signing out keeps your local data on the device but hides it from the app until you sign in again; another account on the same browser does not see it.
- To exercise access, correction or deletion rights that you cannot do in the app, write to akhil1998@gmail.com. We process account data to provide the service you asked for (performance of a contract) and to keep it secure (legitimate interests). Depending on where you live (for example India's DPDP Act, the EU/UK GDPR or California), you may have further rights, such as access, correction, erasure and complaint to your data-protection authority; we will honour them as the law requires. Your account data is stored outside the country you may live in (see §2).
6. Security
Account traffic uses HTTPS. Database access is restricted by row-level security: you can read only your own profile, and only administrators (verified on the server) can use administrator functions. Passwords are handled by Supabase Auth. No service-role or secret key is contained in the extension. No system is perfectly secure; please use a strong, unique password.
7. Children
Fexlo is not directed at children under 16, and we do not knowingly create accounts for them.
8. Availability and the on/off switch
An administrator can pause extraction for everyone, or suspend an account, to protect websites and the service. This never deletes your saved data or stops you exporting it. It needs a connection to take effect.
9. Chrome Web Store user-data commitments
- Fexlo uses the information it handles only to provide its single purpose: collecting, organising, comparing and exporting public product-catalogue data from websites you choose, and running the account that goes with it. It is not used for advertising, profiling, credit or lending decisions, and is not sold or transferred for any unrelated purpose.
- Limited Use: the use of information received by Fexlo adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.
- Website content: the public product data Fexlo reads from the websites you choose is processed in your browser and stored only in your browser; it is not sent to us or to any third party. No person at Fexlo can read it, because we never receive it.
- Account details (name, email, optional organization) can be seen by administrators of the account service, for running and securing it, and by Supabase as our service provider. They are not used for anything else.
- Google: Fexlo does not use Google sign-in, Google APIs or any data from a Google account.
- If this changes: if Fexlo ever handles user data in a way not described here, this policy and the in-app notices are updated first, and the change is announced in the extension before the new handling starts.
10. Changes
We will update this policy when the extension's behaviour changes and show the new date. Material changes will be announced in the extension.
11. Contact
akhil1998@gmail.com