What we keep, and why.
Catlist keeps what it needs to run your batches and bill them, and nothing for anyone else. No analytics, no trackers, no advertising, one sign-in cookie.
Questions about your data: [email protected].
Last updated 28 October 2026.
What we keep
An access request
Your name, email, company, store address, rough product count, platform and anything you wrote, plus your IP address and browser name so we can stop automated spam.
Kept until we delete itYour account
Your email, name and company. Your password is stored only as a slow one-way hash (scrypt): nobody here can read it. The credit history records who ran which batch.
Kept while the account existsYour batch
The links, sheet columns (prices, SKUs, barcodes, notes) and sheets you upload, and the products made from them with your edits, so a restart does not lose your work.
Replaced when you start a new listSign-in attempts and logs
The IP address of a failed sign-in, counted in memory for 15 minutes to lock out password guessing, and written to the server log with errors and batch progress.
Logs kept by our host for a limited timeServices that handle it
A batch needs a few outside services. Each gets only what its step needs: supplier pages and product photos, never your password or your account details.
| Service | What it does | What it receives |
|---|---|---|
| Railway | Runs the app and stores its database | Everything listed above |
| Zyte | Fetches a supplier page a plain request could not | The supplier link |
| Moonshot AI (Kimi) | Writes the product copy | The supplier page's text, its product photos, and your column values for that product |
| Google (Gemini) | Checks photos, and redraws the ones you ask for | Product photos and the product's title |
| ImageKit | Hosts the finished square photos | Product photos |
| Cloudflare | Cuts a product out onto white | Product photos |
Cookies and your browser
- One cookie,
shelfline_session: it keeps you signed in for 30 days. It is only set when you sign in, cannot be read by page scripts, and is never shared. - Your theme choice (dark or light) is remembered in your own browser, not sent to us.
Your choices
You can ask what we hold about you, have it corrected, or have your account and everything in it deleted. Email [email protected], or reply to any email from us. A person does it by hand, usually within a few days, and tells you when it is done.
Supplier photos and copy remain the supplier's: what you are allowed to publish is between you and them.