Security and data

What we store

• The feed URLs you give us and the product data in those feeds.
• Your brand settings, templates and rules, copies of your product photos, the images we draw and the feeds we build.
• A record of each update (counts, warnings and errors) and of when Meta or Snapchat fetched your feeds.
• Your account: email address, a hash of your password if you set one, and your sessions.

The full list, and who processes it for us, is in our privacy policy.

What we never do

• We never ask for access to your Meta or Snapchat ad account, and never touch it.
• We never create a catalog for you. You add our feed URL to the catalog you have.
• We never change your store or your own feed; we only read it.
• We never see or store card numbers: payments go through Dodo Payments.
• We never sell your data or use your product data to train AI models.
• We never write feed URLs, feed tokens or email addresses to our logs.

How stores are kept apart

• Every database query for customer data is limited to one store, and every stored file sits under that store's own ID.
• Every request for a store checks that it belongs to the signed-in account. Someone else's store looks exactly like one that does not exist.
• Feed URLs carry a 256-bit secret token, checked in constant time. Store IDs are random.
• We fetch your feed and photos only from public internet addresses, never from private networks.

Signing in

• Passwords are stored only as a salted, slow hash.
• Emailed sign-in codes last 15 minutes, work once, and stop after 5 wrong tries.
• Sign-in forms are protected against bots and limited per email and per network.
• Sessions last 30 days, in a secure cookie; we store only a hash of the session token.

How long we keep data

• Replaced images: 30 days after they are replaced.
• Feed snapshots from each update: 14 days.
• A paused store: its images and feeds are deleted after 90 days.
• Your account: until you ask us to delete it.

Deleting your data

Email hello@catalogbadge.com from the address on your account. We delete everything under the account, stores, images and feeds included, within 7 days of the request. Remove our feed URLs from your catalogs first, so they go back to your own images.

Reporting a security problem

If you find a security issue, email hello@catalogbadge.com. We will reply and keep you updated until it is fixed.