Privacy policy

The operator named in the Impressum.

SigPath is hosted by Vercel Inc., USA. To deliver the pages and protect them from abuse, Vercel processes technical data such as your IP address, the time and the page requested (legal basis: Art. 6(1)(f) GDPR, our interest in a secure, working site). The site's fonts are served by SigPath itself, so your browser makes no request to Google Fonts.

If you switch the site to German (or back), one cookie, sigpath-lang, remembers the choice for a year. It holds only “de” or “en”, is sent only to SigPath, and is set only when you press the switch (legal basis: § 25(2) no. 2 TDDDG, storage you asked for).

So that one script can't use up the site's searches or its checks for everyone, SigPath counts how many searches and requests come from each connection in a short window (ten minutes; one hour or one day for a few checks). It doesn't store your IP address for this: only a keyed hash of it, which can't be turned back into the address without SigPath's secret, next to a number. The count is kept in SigPath's database (Upstash) and is deleted automatically when its window ends (legal basis: Art. 6(1)(f) GDPR, our interest in keeping the site available).

To know how many people use SigPath and where they come from, the site counts page views with Vercel Web Analytics (Vercel Inc., USA). It sets no cookies. Before a page view is sent, its address is cut down to the page type: search words, order numbers, seller names and anything after “?” are removed. With each page view Vercel records the time, that page type, the website you came from (only if it is another site), your approximate location (country, region, city), and your browser, operating system and device type. Vercel tells visitors apart by a hash of the request, which it discards after 24 hours, and SigPath only sees totals (legal basis: Art. 6(1)(f) GDPR, our interest in knowing which pages are used and how people find the site).

Your search words are sent to eBay's and AliExpress’s official APIs to fetch listings. No information about you is sent with them, and SigPath stores neither the search nor the results. A price check (/check) sends the product name and price you bring, and the address of the page they came from, to SigPath to compare with eBay; none of it is stored. Listing photos are loaded from eBay and AliExpress, and some of eBay’s are compared for copying.

The extension runs by itself only on Amazon, AliExpress, OTTO, MediaMarkt and Saturn pages you open, and on another shop's page only when you click “Check this page” in its menu. On a product page it reads the product's name and price (on Amazon also its product number, photo address and seller name) and sends them, with the page's address, to SigPath for the same check as /check. Only if you turn on “Share Amazon.de prices I see” (a switch in the extension's menu, off until you do), SigPath keeps Amazon products you looked at, and those listed on Amazon results pages you open: the product number, title, price, photo address and when it was seen, for SigPath's search to show as “seen on Amazon”. Nothing about you is sent or kept with them: no account, no address, no record of who saw what. A newer sighting of a product replaces the older one, and sightings over a week old are not shown. Turn the switch off and nothing is shared; the check still works.

The cart is kept only in your browser (its local storage), not on SigPath's servers, and there is no account behind it. It holds what the search showed for each item you added: title, link, photo address, seller name, price and SigPath's verdict. When you open the cart, your browser sends the items' listing numbers to SigPath, which asks eBay for today's price; nothing about this is stored. Items are removed after 30 days, and “Empty the cart” or clearing this site's data removes them at once.

When you chat with Ai-chan, your messages are sent to an AI model from Groq, Inc., USA to write the answer, or, when that one is unavailable, to an AI model from Google (Gemini API), USA. SigPath does not save your chats. Please don't share personal details in them (legal basis: Art. 6(1)(f) GDPR).

• Your delivery address (name, street, postcode, city, country) is stored in an encrypted record in SigPath's database (Upstash), used only to have your item delivered, and passed to the seller when SigPath buys the item for you. It is deleted when the order is fulfilled or refunded, after 15 minutes if you don't pay, and in any case within 31 days.
• An order record (the listing, the price and your wallet address) is kept for 30 days after delivery so you can report a fake, then deleted.
• Your payment is a Solana transaction. Your wallet address and the payment are public on the blockchain and can't be deleted.

Legal basis: Art. 6(1)(b) GDPR, to carry out your purchase.

A report needs your description, a live photo of the item and a signature from the wallet that paid. They are stored encrypted for the reviewer and deleted as soon as the report is decided, and in any case after 90 days. The photo is checked by an AI model from Google (Gemini API), USA. If the report is upheld, a finding about the seller is published on Solana: it contains nothing about you, not your wallet, words or photo.

• Seller badge: SigPath keeps your marketplace account name, your wallet address and the badge dates. The live photo is checked by an AI model from Google (Gemini API), USA and then discarded: no picture or face data is kept. The badge is a token in your wallet and a record on Solana, both public; it lasts a year and is closed early if a fake-product report is upheld.
• Verified business: your VAT number is checked with the EU's VIES service and your website through its domain registry. SigPath keeps the business record for up to 365 days; on Solana the VAT number and website are stored only as one-way hashes.
• If you delete your eBay account, eBay notifies SigPath and the matching records are deleted.

Legal basis: Art. 6(1)(b) GDPR, the verification you ask for.

The VAT number and website you enter are sent to the EU's VIES service and to domain registries for the check. Nothing is saved.

Wallet transactions are sent through the Solana Foundation's public RPC service. Anything written to Solana is public and permanent: nobody, including SigPath, can delete it. Your wallet address appears there only when you pay, claim a seller badge or verify a business.

Links to AliExpress carry SigPath's affiliate tracking id, and SigPath may earn a commission on what you buy. Once you are on AliExpress, AliExpress's own privacy policy applies, including its cookies.

Some providers named here are based in the USA, and AliExpress’s API is served from Singapore, so data sent to them may be processed there.

You can ask for access to your data, its correction or deletion, restriction of its use and a copy of it, and you can object to its use (Art. 15–21 GDPR). Data on the blockchain can't be deleted by anyone. You can also complain to a data protection supervisory authority. To use any of these rights, write to the address in the Impressum.