How COMPR handles your data

Effective and last updated: 19 October 2026.

Who operates COMPR

COMPR is currently in pre-launch preparation. Final legal operator details required for the paid public release will be published before launch. For privacy questions or requests during pre-launch, contact ms-timon@outlook.com.

What COMPR collects and how

Product pages

When you open COMPR on the active tab, the extension reads publicly visible information from that page to detect and display the product. Depending on what the retailer publishes, this can include the product name, brand, price, currency, image URL, colour, material, size, category, model and product identifiers, availability, retailer domain, product-page URL, delivery or return information, and visible promotions. COMPR can also check up to three same-retailer promotion pages linked from the active page for publicly displayed discount codes. Those requests omit retailer login credentials.

Opening COMPR processes this information locally. It is stored in your browser only when you choose to save the product. COMPR does not request your complete browsing history and does not continuously monitor tabs in the background.

Saved products and preferences

Products you choose to save, imported COMPR comparison data, country, language, preferred size and cached public currency rates are stored in chrome.storage.local in your browser profile. Saved product records can include the product-page data listed above and the time the product was saved. They are not automatically synchronised to COMPR's servers.

Account and authentication

COMPR supports Sign in with Apple in the iOS app and Safari extension. Apple identity and authorization data is exchanged with Supabase and the COMPR backend to create or locate the account. The app stores the resulting COMPR session in its shared App Group so the app and Safari extension can use the same session; that storage is isolated by the active Supabase project. Where email-code sign-in remains available, COMPR sends the entered email address to Supabase and its configured email provider, currently Brevo, to deliver the requested code. COMPR processes a Supabase user ID, access token, refresh token and session expiry so the user can remain signed in.

Find This Cheaper

COMPR sends product data externally only when you select Find This Cheaper. The request can include the product name, brand, price, currency, category, colour, material, size, availability, retailer, product-page URL and product identifiers needed to identify the same product. It also contains a random request ID and your authentication token.

The COMPR backend verifies the account, enforces usage limits and derives search queries from the product name, brand, model or identifiers. Those queries are sent to Brave Search to locate public retailer pages. The backend may request candidate retailer pages to validate the product and price before returning results. COMPR stores a one-way product fingerprint, request and outcome timestamps, whether a provider ran, whether a search counted, and the returned search response so duplicate requests can be handled consistently and usage can be enforced.

Account, usage and purchase records

Supabase stores the user ID, account timestamps, plan, entitlement status, introductory, purchased and subscription check balances, and successful-search totals. For Apple in-app purchases and subscriptions, COMPR also processes product, transaction and original-transaction identifiers, purchase or subscription status, environment and relevant billing-period dates. Signed Apple transaction information is validated by the COMPR backend before checks or subscription access are granted. An encrypted Apple revocation credential may be held solely to complete an authorised account-deletion flow. COMPR does not receive the full payment-card number.

Operational and network information

The COMPR backend logs the request method and route and, when a request fails, a limited error code, message and technical details. Production mode does not intentionally log raw product-match diagnostics. Hosting, authentication, email, search, website and retailer providers can also receive ordinary network metadata such as IP address, user agent and request time when they deliver a request. COMPR does not use an analytics SDK, advertising pixel, affiliate tracker or crash-reporting SDK in the current build.

Why COMPR uses this data

COMPR processes account and requested price-check data to provide the service and take steps requested by you. Security, abuse prevention and service reliability are pursued as legitimate interests. Authentication and service emails are necessary to operate an account. Where consent is legally required for a future optional purpose, COMPR will request it separately before that processing begins.

To detect, display, save and compare the product selected by the user.
To authenticate accounts and keep sessions active.
To perform a price check explicitly requested by the user and return relevant retailer offers.
To enforce introductory, purchased and subscription check balances, rate limits and request idempotency.
To verify, restore where applicable, and manage Apple in-app purchases and subscription entitlements.
To secure, troubleshoot and improve the reliability of these user-facing features.

Where data is stored and how long

Local browser data: saved products and preferences remain until you remove them, use Clear all, clear the extension's data or uninstall COMPR. The account page keeps the email being verified only in that page's memory and does not persist it. Authentication tokens remain until sign-out, replacement, expiry or revocation, clearing extension data, or uninstall.
Search records: stored request identifiers, product fingerprints, outcomes and returned search responses become eligible for deletion after 30 days and are removed by the next hourly cleanup run.
Usage records: current account and entitlement records remain while the account exists. Ended usage periods become eligible for deletion 90 days after the period ends and are removed by the next hourly cleanup run.
Search cache: product and coupon cache records, including the persistent last-known-good cache, stop being used after 24 hours and are removed no later than the next hourly cleanup run.
Temporary server data: expired checkout reservations become eligible for deletion 1 day after expiry and are removed by the next hourly cleanup run. In-memory rate-limit identifiers are removed after their one-hour window at the next cleanup or when the server restarts.
Account data: eligible account, entitlement, usage and search records are removed when confirmed deletion completes. Minimal purchase-ownership records may be retained in de-linked form where needed to prevent replay, reconcile Apple transactions or meet legal obligations.
Provider logs: retention of infrastructure logs and data held independently by Render, Supabase, Brevo, Brave, the website host, the European Central Bank and contacted retailer sites is controlled by those providers and the active account settings. COMPR will state a more specific period when it has been verified.

Service providers and disclosures

Supabase: authentication, account, entitlement, usage, search-response and Apple purchase-ownership records.
Brevo: delivery of authentication emails and related email-delivery information.
Render: hosting the COMPR backend and processing requests and limited operational/security logs.
Brave Search API: product-derived search queries used to locate possible retailer offers.
Public retailer websites: candidate product pages requested by the backend to validate identity, price and availability; same-retailer promotion links may also be requested from the browser without credentials.
European Central Bank: public exchange-rate data for currency conversion. COMPR does not intentionally include account or product data in this request.
Website host: delivery of the public website at getcompr.nl and its login callback. The hosting provider receives ordinary request metadata needed to serve those pages.
Microsoft/Outlook: support emails and any information you voluntarily include in them.

COMPR does not sell user data. It does not use or transfer extension user data for personalised, retargeted or interest-based advertising. Data is transferred only as needed to provide COMPR's disclosed functionality, protect the service, comply with law, or as otherwise permitted by the Chrome Web Store User Data Policy.

Apple sign-in and purchases

The iOS app uses Sign in with Apple. Its session is stored locally in the COMPR App Group so the app and Safari extension can share it, isolated by Supabase project. Apple identity and authorization data is sent to Supabase and the COMPR backend for authentication and account deletion. Temporary product/request state supports safe search recovery.

The planned App Store release supports consumable extra-check packs and monthly and yearly Pro and Ultimate subscriptions through Apple in-app purchase. Apple processes payment and supplies the displayed local price and, for subscriptions, the billing period. COMPR receives signed transaction and subscription information needed to validate purchases, grant checks or subscription access, restore eligible purchases, reconcile status and handle revocation, but not the full payment-card number. Subscriptions are managed or cancelled through the user’s Apple Account.

Security

Production network transfers initiated by COMPR use HTTPS. Private backend keys are kept out of the extension, account and usage mutations are performed by the backend, database access is restricted by roles and row-level security, and authentication is required for account and price-check endpoints. No internet service can guarantee absolute security, so users should not send passwords, sign-in links, payment-card details or private API keys to support.

Your choices and rights

Subject to applicable law, you may ask for access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. You may also lodge a complaint with the Dutch Data Protection Authority or your local supervisory authority.

You can remove individual saved products or use Clear all on the comparison page. Signing out requests global session revocation and removes the local authentication session.

An authenticated user can select Delete account, type DELETE and accept a final confirmation. The server validates subscription ownership and, where required, uses the stored Apple revocation credential before deleting the Auth user and eligible linked records. The app clears local data only after server confirmation and does not report success when a step fails. Minimal de-linked purchase records may remain where required for transaction integrity or legal obligations.

You may also request access, correction or deletion assistance by emailing ms-timon@outlook.com from the address connected to the account.

Children

COMPR is a general shopping utility and is not specifically directed to children. It does not intentionally request a date of birth or other age data. If a parent or guardian believes a child supplied personal data, they can contact COMPR to request review and eligible deletion.

International transfers

Some service providers may process data outside the European Economic Area. Where required, COMPR will rely on an applicable transfer mechanism such as an adequacy decision or standard contractual clauses and will document the selected provider configuration before paid launch.

Website storage

This website uses no analytics, advertising cookies, tracking pixels or fingerprinting. The current homepage does not set cookies or local storage. The login callback may use necessary local storage to complete a user-requested Founding Access confirmation. No cookie banner is shown because non-essential storage is not active.

Chrome Web Store Limited Use

COMPR's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. COMPR limits use of extension user data to providing or improving its disclosed single purpose, limits transfers to permitted purposes, does not use the data for personalised advertising, and does not allow humans to read user data except with specific user consent for support, for security, to comply with law, or in aggregated and anonymised form for permitted internal operations.

Changes to this policy

COMPR may update this policy when its functionality, service providers or legal/business details change. The effective date at the top will be updated. Material changes to data handling will be disclosed before the changed processing begins and, where required, new consent will be requested.

Contact

COMPR privacy and support contact: ms-timon@outlook.com