Privacy policy
Last updated October 13, 2026
BuyWise reads the product on a page when a check runs, removes personal details before anything leaves your browser, and never sells your data or uses it for ads.
When it reads a page
- Free: only the tab you check, when you click BuyWise. If the page doesn't look like a product, or looks like an account, checkout or private page, BuyWise asks before sending anything.
- Pro, with automatic checks on: product pages as they load, and only on sites that sell physical products, plus any site you turn on yourself. On sites judged not to sell products, BuyWise doesn't run at all. On a site that hasn't been judged yet, it only looks, in your browser, at whether the page is a product page (see below). Pages that don't look like product pages, and cart, checkout, account, order and login pages, are never sent. On shops that also keep personal records, such as pharmacies, only pages that are clearly marked up as a product are sent.
- Never: banking and payment, health, government, email and messaging, and sign-in sites it recognizes. BuyWise doesn't read or send pages there, even if you click it, and automatic checks can't be turned on there.
How it decides which sites sell products
From the site's name and, if that isn't enough, the site's public homepage, which our server fetches on its own with no cookies and nothing of yours. Never from what you see on the site. The answers are shared by everyone and built into the extension, so most sites are decided in your browser without asking us. For a site that isn't on the list yet, with automatic checks on, BuyWise first checks in your browser whether the page looks like a product page. Only if it does, it sends the site's domain name (for example example.com, never the full address), with no install ID attached, and keeps the answer.
What it sends
- The site's domain (not the full page address) and the page title.
- For a site not on our list: its domain name alone, as described above.
- The product section's text: title, price, specs, seller, shipping, returns, ratings and reviews (up to about 6,000 characters), plus any product data the page publishes for search engines.
Emails, phone numbers, card-like numbers and delivery names are removed first. Form fields, passwords, cookies and browsing history are never read. The text goes to our server and to the AI provider that computes the scores. It is used to compute the scores and, when the page is a product listing, to add the product's details (never the page text) to our product record. It is used for nothing else. The AI provider also receives domain names, and summaries of public homepages, when deciding whether a site sells products.
What we store
| Data | Purpose | Kept for |
|---|---|---|
| Scores for a checked page, with a one-way hash of its text (not the text) | Faster results | A short time |
| Our product record: product, brand and store details and our scores, with the date of the check and nothing about who checked | Seeing how prices, products, brands and stores change over time, and improving our scores | Indefinitely |
| Daily check count per random install ID, and daily usage per Pro license | Daily limits and abuse prevention | A few days |
| Checks counted in each billing month, per Pro license | Your monthly allowance, and billing | About a year |
| Whether a site sells products, per domain (not per person) | Deciding where automatic checks run | Up to about a year, less when we're unsure |
| A scrambled one-way code made from your IP address (we can't turn it back into the address) | Abuse prevention | A few days |
| 👍 / 👎 feedback, with the score it's about | Improving scores | A few months |
| Usage totals, such as how many checks were made each day and roughly how many people made them, counted across everyone and never per person | Running the service and planning capacity | About a year |
| Pro: license key, Stripe customer and subscription IDs, subscription status, email, linked install IDs, daily activation count, and when and which version of the terms you accepted | Pro access, notices about your subscription, and a record of your consent | Until you ask us to delete it, except that we keep records of your consent and payments as long as the law requires |
Our hosts keep standard request logs (IP address, time) briefly for security. This website (not the extension) uses cookieless analytics to count page visits; it sets no cookies and doesn't track you across sites. In your browser, BuyWise keeps your settings, recent scores and, on Pro, your license key; settings and the key sync to Chrome browsers on the same profile. If you enter your license key on buywise.fyi/account to sign in, that page keeps it only for the session, in that browser tab, and never puts it in the page address. The page that opens right after you pay for Pro on our website or through an AI assistant sets one cookie, kept for about a day, so that only your browser can show your license key again.
AI assistants and the BuyWise API
Assistants such as ChatGPT, Muse and Claude can ask BuyWise about a brand or a product listing through our API (details). They send the brand name or the product details they already read (title, brand, price, ratings, seller, a few specs) and at most the store's domain; a full page address is cut to its domain before anything else happens. Banking, health, government, email and sign-in sites are refused, and emails, phone numbers and card-like numbers are removed before the details reach our AI provider. We don't receive your conversation.
| Data | Purpose | Kept for |
|---|---|---|
| Scores for a product or brand, filed under a one-way hash of the details (not the details) | Faster results | A short time for products, a few months for brands |
| Our product record: the product, brand and store details sent with a request and our scores, with the date and nothing about who asked | Seeing how prices, products, brands and stores change over time, and improving our scores | Indefinitely |
| A scrambled one-way code made from the caller's IP address (we can't turn it back into the address), or from the assistant's anonymous user ID | Daily free checks, rate limits and fair use | A few days |
| API keys: a hash of the key, its name, the install or Pro license it belongs to, and its daily check counts | Access, limits and billing | About a year |
| When an agent starts a Pro purchase: a hash of its one-time claim token (not the token), and the checkout it's for | Giving that agent its API key once the purchase is paid | About a day |
| When an agent pays per request: a scrambled one-way code made from its wallet address (we can't turn it back into the address), and its daily check counts | Counting paid checks, rate limits, and our payment records | About a year |
| A one-way hash of each payment authorization (not the authorization) | Stopping the same payment from being used twice | A few minutes |
| Per-minute counts of payments that failed or haven't settled yet, per one-way wallet code or scrambled network code | Abuse prevention | A few minutes |
Paying per request. An agent without an API key can pay for a request in USDC on the Base blockchain (x402). Its signed payment, which includes its wallet address, goes to our payment processor, Coinbase, which checks it and settles it on Base. As with any blockchain payment, the settled transfer (the paying wallet's address, ours, the amount and the time) is public on Base for good, and neither we nor anyone else can remove it. We don't log wallet addresses, payment signatures or transaction IDs, we keep only the one-way codes above, and the AI provider never sees any of it.
Signing in through an assistant
Some assistants ask you to sign in to BuyWise when you connect it, so your checks are counted for you alone rather than for everyone your assistant serves. On our sign-in page you choose how: Continue with Google, where Google tells us your email address and that it's verified (we ask for nothing else, and never see your Google password); an emailed 6-digit code, where your address goes to our email provider only to send the code; or a Pro license key. We don't keep your email address: we keep a one-way code made from it, so the same address always reaches the same account, and we can't turn the code back into the address. The assistant then holds a token that lets it check products for you, and nothing else.
| Data | Purpose | Kept for |
|---|---|---|
| Your sign-in account: a one-way code made from your email address (not the address), when it was made, and whether by Google or an emailed code | One account per email address, with daily checks of its own, and abuse prevention | About a year |
| Each connection: which assistant it's for, the account or Pro license it uses, when it was made, and one-way hashes of its tokens (not the tokens) | Keeping you signed in, and stopping the connection when it's revoked | Up to 90 days after the assistant last renewed it |
| While you sign in: the assistant's sign-in request, a hash of the emailed code, and one cookie on our sign-in page that ties the steps to your browser | Finishing the sign-in safely | Up to 15 minutes; the cookie, a day |
| Counts of codes sent and accounts made, per one-way email code and per scrambled network code | Abuse prevention | A day or two |
Our product record
From October 3, 2026, we keep a lasting record of the products, brands and stores checked with BuyWise, anywhere in the world, and of our scores for them. We use it to see how prices, products, brands and stores change over time and to make our scores better. Checks made before then are not in it.
- What it holds: the store's domain; the product's name, brand, condition, price and currency, any earlier or list price the listing shows, its star rating and a rounded review count; on marketplaces, the seller's name as the listing shows it; the brand's name for a brand check; whether a store we checked sells products; our scores, and 👍 / 👎 feedback on them; the date of the check (not the time); and whether the check came from the extension or an AI assistant.
- What it never holds: anything about who checked. No install ID, license or API key, email, IP address or code made from one, assistant user ID, account, location, language or device details. No full page addresses, page text, reviews or reviewer names. Entries are not linked to each other by person.
- Kept de-identified: we keep the record only in a form that can't reasonably be linked to you or your device, we don't try to identify anyone from it, and anyone we ever share part of it with must agree to the same. If an entry turns out to contain someone's personal details, we remove them.
- Not shared: we use the record only to provide and improve BuyWise. If that changes, we'll update this policy first, and the change will apply only to checks made after it.
- Sellers: if you sell on a marketplace and want your seller name removed, email support@buywise.fyi.
Because nothing in the record identifies you, we can't find entries from your own checks, and none of them are about you.
Who processes data
Our hosting, database and storage providers (US), the AI provider that computes the scores, Stripe (payments; we never see your card), Coinbase (payments by agents in USDC, settled on the public Base blockchain), an email delivery provider (only to send sign-in codes) and a cookieless analytics provider for this website. If you choose Continue with Google, Google handles that sign-in under its own privacy policy.
Our commitments
We don't sell or rent data, use it for ads, or build profiles of what you browse or buy. Our use of data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Where privacy laws give you rights
We are based in the US, and our providers store data in the US. Where laws such as the GDPR or UK GDPR apply, we rely on our contract with you to run checks and Pro; on our legitimate interests to prevent abuse, keep limits fair and keep the product record, which says nothing about who checked; and on our legal obligations for payment and consent records. You can ask us to access, correct, delete or port data about you, or object to how we use it, by emailing support@buywise.fyi, and you can complain to your local data protection authority.
Your choices
From the extension's settings you can turn off automatic checks, hide scores or sites, stop automatic checks on sites you turned on, and clear saved scores. Uninstalling removes everything in your browser. To disconnect an assistant, remove BuyWise in that assistant's settings; a connection that isn't renewed ends after 90 days, and we end it sooner if you ask. To delete Pro data or a sign-in account (tell us the email address you signed in with), or to ask anything, email support@buywise.fyi. We'll update the date above if this policy changes.
BuyWise is run by Mitchell Kucy. Using it is also subject to our terms of service.