Privacy Policy

This privacy policy explains how Decoy — Live Break Assistant (the "Extension"), a Chrome extension published by Blue Luchador LLC ("we", "us", or "our"), collects, uses, handles, stores, and shares user data. It covers every category of user data the Chrome Web Store asks about, including the categories we do not collect. Use of the Extension is also subject to our Terms of Service.

The Extension has one purpose: to help collectors follow a live sports card break. When you open it on a Whatnot live page, it reads the visible text on that page to identify the products in the break, then shows checklists, values, case hits, and odds, and answers your questions about the break. It runs only on Whatnot (whatnot.com and www.whatnot.com). It does not read any other website. It is not affiliated with, endorsed by, or sponsored by Whatnot.

Limited Use Disclosure: Our use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Summary

• What we collect: your email address and subscription details, the visible text on the Whatnot live page while a Decoy session is open, the chat messages you send in Decoy, the break corrections you make, usage counts, and technical logs, which include your IP address.
• What we do not collect: health information, payment card numbers, your GPS position or region, your browsing history, screenshots, images, audio, video, microphone input, or keystrokes.
• Who we share it with: ExtensionPay and Stripe (accounts and payments), our cloud hosting provider and our AI provider (hosting, storage, and AI answers), a card catalog data provider, and a public web search provider. No one else, except where the law requires it.
• What we never do: sell user data, use it for advertising, give it to data brokers, or use it to decide creditworthiness or lending.

Data Collection

We collect only the user data needed for the Extension's single purpose. Each category below states what we collect, or that we do not collect it.

Personally identifiable information

When you sign in, start a trial, or subscribe, ExtensionPay provides us with your email address. We keep an account record with your email address, your plan, whether your trial or subscription is active, the date your billing period ends, the date your usage period ends, your remaining live breaks and Expert Answers, and the time you last used them. We do not collect your name, phone number, or postal address.

Health information

We do not collect health information.

Financial and payment information

We do not collect your payment card number, bank account, or other payment credentials. If you pay, you enter your payment details on ExtensionPay's pages, and Stripe processes the payment for ExtensionPay. ExtensionPay tells us only your subscription status: whether you have paid, when you paid, your plan, your billing interval, and when your trial started.

Authentication information

We collect two credentials. The first is an ExtensionPay account key, which ExtensionPay creates when you sign in and the Extension keeps in Chrome sync storage. The second is a session token that our API issues. It contains your email address and plan, expires after 24 hours, and is kept only in the Extension's memory. We do not collect passwords.

Personal communications

When you use Decoy chat, we collect the messages you type, the replies we generate for you, and the recent break text needed to answer them. We do not collect email, text messages, or private messages from Whatnot or any other site.

Location

We do not ask for or collect your GPS position, region, or other location information. The only location-related data we receive is your IP address, which our hosting provider receives with every request the Extension makes to our API and can record in server logs. We do not use your IP address to find where you are.

Web history

We do not collect your browsing history. The Extension's tabs permission lets it see the address of a tab. When a tab loads or changes, the Extension checks that address on your device only to decide whether the tab is a Whatnot page where Decoy can open. On a Whatnot live page, it also reads the live-page path from the address so it can keep each break's chat separate. The Extension does not record a list of the sites you visit, and it does not send any tab address to us or to anyone else.

User activity

We collect how many live breaks and Expert Answers you use, the time of each request, and error and performance logs. When the Extension connects to our API, our hosting provider receives your IP address and browser type, as happens with any internet request, and can record them in server logs. We also keep a count of how often each card product is looked up, across all users, with no email or other identifier attached. We do not collect clicks, mouse movements, scrolling, or keystrokes.

Website content

The Extension reads page text only after you open Decoy on a Whatnot live page and a live-break session starts. It reads the visible text on that page when the session starts, and again from time to time while the session stays open. This includes lineup and listing text, the livestream title, and other words shown on the page, such as a chat overlay or a username. Closing Decoy or leaving the live page stops this.

If you use the "Update this break" form to correct the break, we collect the category, product names, and quantities you choose.

We do not take screenshots of the tab, and we do not collect images or video of the tab or the livestream. We do not collect, record, or transmit audio, and we do not access the livestream's sound, the tab's sound, or your microphone. We do not send image data of any kind to our servers or to anyone else. The icons and buttons packaged in the Extension are our own images, displayed to you; they are not user data.

We do not read page content from any site other than the Whatnot page where your Decoy session is open.

Data Usage

We use user data only to provide and improve the Extension's single purpose, which is helping you follow a live card break. That includes running your account, enforcing trial and subscription limits, keeping the service reliable and secure, and preventing fraud and abuse. We do not sell user data. We do not use it for advertising of any kind, including personalized, re-targeted, or interest-based ads. We do not use it to determine creditworthiness or for lending. We do not use your page text or chat messages to train AI models.

Personally identifiable information

We use your email address and account record to start a trial, recognize a paid subscription, count your live breaks and Expert Answers against your plan's limits, and reply to you if you contact support.

Health information

We do not use health information, because we do not collect it.

Financial and payment information

We use the subscription status from ExtensionPay only to decide whether your account can use the Extension and which plan limits apply. We do not use payment card numbers, because we never receive them.

Authentication information

We use the ExtensionPay account key to look up your account with ExtensionPay when a session starts. We use the session token to confirm that requests to our API come from your account.

Personal communications

We use your chat messages and the recent break text only to write replies to you.

Location

We use IP addresses in server logs only to keep the service running and to detect abuse. We do not use them to find your location, and we do not use location for any purpose.

Web history

On your device, the Extension uses a tab's address only to decide whether Decoy can open on that tab and to tell one Whatnot live break from another. We do not use browsing history, because we do not collect it.

User activity

We use usage counts to enforce plan limits. We use timestamps, error and performance logs, and IP addresses in server logs to keep the service running, fix failures, and detect abuse. We use the product lookup counts, which are not tied to any user, to load popular checklists faster.

Website content

We use the page text and your break corrections only to identify the products in the break, to find checklists, values, case hits, and odds, and to answer your questions about the break.

Data Handling

All user data that leaves your device is sent over HTTPS, which encrypts it in transit. Only the parties named in the Data Sharing section receive it.

People do not read your user data, with four exceptions: when you give us explicit permission, for example by asking support to look into a problem with your account; when it is necessary for security, such as investigating abuse; when the law requires it; or when the data has been aggregated and anonymized for internal operations.

Personally identifiable information

Our API receives your email address and subscription status from ExtensionPay over HTTPS when a session starts, updates your account record, and places your email address and plan in your signed session token.

Health information

We do not handle health information, because we do not collect it.

Financial and payment information

Your payment details are entered on ExtensionPay's pages and processed by Stripe. They never pass through the Extension or our API. We handle only the subscription status that ExtensionPay sends us over HTTPS.

Authentication information

The Extension sends the ExtensionPay account key over HTTPS to ExtensionPay, and to our API when a session starts. Our API uses the key to look up your account with ExtensionPay and then discards it. Our API signs the session token so it cannot be altered. The Extension sends the token only to our API, over HTTPS.

Personal communications

The Extension sends each chat message, the earlier messages in that chat, and the recent break text to our API over HTTPS. Our API passes them to our AI provider to write the reply.

Location

Your IP address reaches our hosting provider over HTTPS as part of each request, and it is written to our server logs. It is not added to your account record.

Web history

Tab addresses are checked only on your device and are never transmitted.

User activity

Usage counts are updated in your account record when you start a live break or receive an Expert Answer. Our API and hosting provider write logs and request records.

Website content

The Extension reads the visible text on your device and sends it to our API over HTTPS while a session is open. The "Update this break" form is a page we host with our cloud hosting provider that loads inside the Decoy side panel. The Extension passes the identified products to that form inside your browser. When you save your corrections, the Extension sends them to our API over HTTPS. The form itself does not send them anywhere.

Data Storage

We store user data in two places: on your device, inside the Extension, and with our cloud hosting provider, which encrypts stored data at rest. Each category below states where it is stored and for how long.

Personally identifiable information

Your account record is stored with our cloud hosting provider while your account is active, and afterward only as long as we need it for taxes, billing disputes, or other legal duties. Our server logs record your email address when a session starts and when a plan limit is reached. They are kept only as long as we need them for reliability and security.

Health information

We do not store health information, because we do not collect it.

Financial and payment information

We do not store payment card numbers or other payment credentials. ExtensionPay and Stripe store payment details under their own privacy policies. We store your plan, subscription status, and billing period end date in your account record with our hosting provider.

Authentication information

The ExtensionPay account key stays in Chrome sync storage until you uninstall the Extension. Chrome sync storage can copy it to other Chrome browsers where you are signed in with Chrome sync turned on. The session token stays only in the Extension's memory and is deleted when it expires or when you close the browser. Our API does not store the account key or the session token.

Personal communications

Your chats are kept in the Extension's memory so a break's chat survives closing and reopening the side panel. They are deleted when you close the tab or the browser, and sometimes sooner. Our API does not save chat messages to a database. If a request fails, our error log can include that request, including a chat message. Those logs are kept only as long as we need them for reliability and security.

Location

IP addresses are stored in server logs at our hosting provider only as long as we need them for reliability and security. We store no other location information.

Web history

We do not store your browsing history. Tab addresses are not stored. The live-page path is kept in the Extension's session storage only while that tab is open, so the Extension can tell one break from another, and Chrome deletes it when the browser closes.

User activity

Usage counts and the time of your last use are stored in your account record with our hosting provider, for the same period as the rest of the record. Request records, IP addresses, and error and performance logs are stored with our hosting provider only as long as we need them for reliability and security. Product lookup counts are stored with our hosting provider without any user identifier, and they decrease over time.

Website content

In the Extension, page text is kept in memory for the current break and deleted when you close the tab or the browser. On our API, the identified break details for an open session are kept in server memory so that follow-up questions work. They are not written to a database or to your account record. If a request fails, our error log can include that request, including page text. We do not store screenshots, images, audio, or video, because the Extension does not capture them.

The Extension also keeps a few items on your device until you change them or uninstall it: your light or dark theme choice, and whether you dismissed an in-product notice. These items are not sent to us.

Data Sharing

We share user data only with the parties listed below, and only as needed to provide the Extension's single purpose. Each one processes the data for us under its own privacy policy:

• ExtensionPay (extensionpay.com): sign-in, trials, subscriptions, and billing.
• Stripe: processes payments for ExtensionPay.
• Cloud hosting provider: hosts our API, account records, logs, and the "Update this break" form.
• AI provider: reads break text and chat messages to identify the break and write answers.
• Card catalog data provider: provides card checklists and catalog data.
• Web search provider: searches public web pages when a question needs current public information.

We do not sell user data. We do not transfer user data to advertising platforms, data brokers, or other information resellers. Beyond the parties above, we disclose user data only when the law requires it, or to protect against malware, spam, phishing, fraud, or abuse. If Blue Luchador LLC is part of a merger, acquisition, or sale of assets, we will transfer user data only after obtaining your explicit prior consent.

Personally identifiable information

ExtensionPay collects your email address and shares it with us. Our hosting provider stores it in our account records and logs. We do not send your email address to our AI provider, the card catalog data provider, or the web search provider.

Health information

We do not share health information, because we do not collect it.

Financial and payment information

ExtensionPay collects your payment details, and Stripe processes the payment for ExtensionPay. We never receive or share payment card numbers. The subscription status ExtensionPay sends us is stored with our hosting provider and is not shared with anyone else.

Authentication information

The ExtensionPay account key is sent to ExtensionPay, and to our API. The session token is sent only to our API. Neither one is shared with our AI provider, the card catalog data provider, or the web search provider.

Personal communications

Our API receives your chat messages. Our AI provider receives them, with the recent break text, to write the replies. When answering a question needs card data or public web information, the card catalog data provider or the web search provider receives a short search query based on your question, such as a player or product name, but not your full message. We do not send chat messages to ExtensionPay.

Location

Our hosting provider receives your IP address because it hosts our API, and ExtensionPay receives it when the Extension connects to ExtensionPay. We do not share IP addresses with anyone else.

Web history

We do not share browsing history or tab addresses with anyone, because they never leave your device.

User activity

Usage counts, request records, IP addresses, and logs are stored with our hosting provider. ExtensionPay also receives your IP address when the Extension connects to it. We do not share user activity with our AI provider, the card catalog data provider, or the web search provider.

Website content

Our API receives the visible page text and your break corrections. Our AI provider receives the page text to identify the break and answer questions. The card catalog data provider receives the break details needed to look up the right checklist, such as the sport, product or release name, and year. The web search provider receives a short search query, such as a product name, when a question needs public web information. We do not send your email address, payment information, or the page address to the card catalog data provider or the web search provider.

Data Security

All user data is sent over HTTPS. Our hosting provider encrypts stored data at rest. Session tokens are signed and expire after 24 hours. Access to our servers and records is limited to the people who operate the service. No system can guarantee absolute security. If we learn of a breach that affects your data, we will notify you as the law requires.

Your Choices and Rights

• The Extension reads page text only while you have a Decoy session open on a Whatnot live page. Close the Decoy side panel or leave the live page to stop it.
• Uninstalling the Extension deletes everything it keeps on your device, including the ExtensionPay account key.
• You can ask to access, correct, or delete your data by emailing support@blueluchador.com. We delete your account record within 30 days of a verified request, except for what the law requires us to keep. To delete your ExtensionPay account and payment history, contact ExtensionPay.

Children

The Extension is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact support@blueluchador.com and we will delete it.

Changes to This Policy

When we update this policy, we change the date at the top. If an update changes how the Extension collects, uses, or shares user data, we will tell you about it in the Extension and ask for your consent before the new practice applies to you.

Contact

Blue Luchador LLC
9615 E County Line Rd, Ste. B-314
Centennial, CO 80112
Email: support@blueluchador.com

Privacy | Terms | Refunds | Acceptable Use | Support