Privacy Policy

Last updated: May 18, 2026

Viewnot is a productivity tool for sellers on Whatnot. It provides real-time sales analytics, competitor stream monitoring ("Spy"), profit & loss calculations, thermal label printing, and AI-assisted item categorization. To deliver these features, Viewnot must collect data from the user's Whatnot account and process it through our backend systems.

1. Data We Collect

We collect the following categories of data:

1.1 Account information

• Email address — collected when you sign up via Google OAuth or Discord OAuth.
• Authentication tokens — issued by Supabase Auth and stored locally in the Chrome extension and dashboard to keep you signed in.
• OAuth identity — your Google or Discord user ID and display name, used only to create and authenticate your Viewnot account.
• Whatnot username — entered by you during onboarding so we can attribute streams and sales to your account.

1.2 Whatnot session data (collected by the Chrome extension)

• Whatnot session cookies — when you are logged into whatnot.com, the extension reads your Whatnot session cookies and relays them to our backend approximately every two minutes. These cookies are used solely to make authenticated GraphQL requests to Whatnot on your behalf so we can track your own streams in the background, even when your browser is closed. Cookies are stored in a secure database row scoped to your account and are not shared with any other Viewnot user.
• WebSocket and GraphQL event payloads — when you have an active livestream open, the extension observes the same WebSocket and GraphQL responses your browser already receives from Whatnot, including auction events, sale events, listing metadata, and buyer usernames. These are forwarded to our backend so we can record your show history, generate analytics, and print shipping labels.
• Whatnot profile data — your public Whatnot profile information (username, follower count, profile picture URL) as returned by Whatnot's GraphQL API.

1.3 Sale and order data

• Item titles, prices, photos, and timestamps for items sold on your streams.
• Buyer Whatnot usernames associated with each sale (publicly visible to all sellers on Whatnot).
• Shipping addresses when you print a thermal label — addresses are read from Whatnot's seller dashboard and passed to the local print server to generate the label. Addresses are also stored in our database so the dashboard can display order history.
• Transaction type, fee category, and computed profit data derived from the above.

1.4 Competitor stream data (Spy feature)

• When you use the Spy feature, our backend polls the publicly-accessible Whatnot GraphQL endpoint LiveShopSold using session cookies from our cookie pool. The polling captures item titles, prices, buyer usernames, and timestamps for sales on the streams you monitor. These streams belong to other Whatnot sellers; the data captured is the same data any logged-in Whatnot viewer can already see in real time on the livestream page.

1.5 Local hardware data (optional)

• Printer name and printer settings — if you install the Viewnot print server, your selected printer name and label format preferences are stored locally on your computer and transmitted to our backend so the extension can display them in your settings.
• Scale weight readings — if you connect a Viewnot scale, weight readings are sent from the scale to the local print server on your computer, and the resulting weight value is forwarded to our backend only when you save a shipment.

1.6 Billing data

• Stripe customer ID, subscription state, and plan — created and managed by Stripe when you subscribe. Viewnot does not collect or store your credit card number, CVC, or full card details. Stripe handles all card data directly.

1.7 Support and communication data

• Support tickets — messages you submit through the in-product Help button, including any text and screenshots you choose to attach.
• Email correspondence sent to [email protected] or [email protected].
• Phone number — only if you opt in to SMS notifications.

1.8 Diagnostic and telemetry data

• Anonymous operational metrics: extension version, sync success/failure events, event counts, and error logs. These are used to monitor the health of the Service. No browsing history, page content outside whatnot.com, or third-party site data is ever collected.

Data we do NOT collect: We do not collect your browsing history outside whatnot.com, app.viewnot.com, and viewnot.com. We do not collect keystrokes, clipboard contents, form inputs on unrelated sites, financial information beyond what Stripe handles, biometric data, geolocation data, health data, or any data from minors under the age of 13.

2. How We Use Your Data

We use the data described above strictly for the following purposes:

• To provide the Service: displaying your shows, buyers, profit & loss, and Spy data; printing thermal shipping labels; tracking streams 24/7 via the cookie pool.
• To authenticate you across the dashboard, extension, and supporting APIs.
• To process payments for paid Viewnot plans through Stripe.
• To send transactional emails related to your account (sign-up confirmation, receipts, support replies, security notices).
• To respond to support requests you submit.
• To monitor and improve the Service through aggregate operational metrics and error reports.
• To prevent abuse and enforce our Terms of Service.

We do not sell user data. We do not use your data for advertising, profiling, or any purpose unrelated to delivering the Service.

3. How We Share Your Data

We share your data only with the following named third parties, and only for the specific purposes described below. Each provider is bound by its own privacy policy and applicable data-processing agreements.

Third party	What is shared	Purpose
Supabase, Inc.	All account data, authentication tokens, Whatnot session cookies, sale and order data, Spy data, support tickets	Database hosting, authentication, real-time sync (primary backend)
Vercel, Inc.	All HTTP requests to app.viewnot.com and viewnot.com, including authenticated API requests	Web hosting and edge functions for the dashboard and landing page
DigitalOcean, LLC	Whatnot session cookies (from the cookie pool), GraphQL responses captured during background polling	Hosts the Viewnot agent server that polls Whatnot on your behalf for 24/7 stream tracking
OpenAI, L.L.C.	Item titles and item image URLs from your sales (no email, no Whatnot credentials)	AI item categorization via the GPT-4o mini vision model
Stripe, Inc.	Email address, billing name, payment method (handled directly by Stripe), subscription state	Payment processing and subscription management
Resend, Inc.	Email address and transactional message contents	Sending transactional email (sign-up, receipts, support, notifications)
Twilio, Inc.	Phone number and message contents (only if you opt in)	SMS notifications
Google LLC	OAuth identity information at sign-in	Google OAuth authentication (only if you choose to sign in with Google)
Discord, Inc.	OAuth identity and Discord role membership	Discord OAuth authentication and community-role plan verification (only if you choose to sign in with Discord)

We do not share your data with advertising networks, data brokers, or any party not listed above. We do not share data with Whatnot itself beyond the authenticated GraphQL and WebSocket requests that the Whatnot platform inherently receives when our backend polls its API on your behalf using your cookies.

We may disclose data if required by law (subpoena, court order, or other valid legal process), to enforce our Terms of Service, or to protect the rights, safety, or property of Viewnot, our users, or the public. If Viralux Media LLC is acquired, merged, or sells substantially all of its assets, user data may transfer to the acquiring entity, subject to this Privacy Policy.

4. How We Store and Protect Your Data

4.1 Storage location

The primary database is hosted by Supabase in the United States. Vercel edge functions and DigitalOcean servers used by Viewnot are also located in the United States. If you access the Service from outside the United States, you consent to the transfer of your data to the United States for the purposes described in this Policy.

4.2 Security measures

• All traffic between your browser, the extension, the dashboard, and our backend is encrypted in transit via HTTPS/TLS.
• Whatnot session cookies in the cookie pool are stored in a Supabase table protected by Row Level Security policies that restrict access to the authenticated owner of each row and our service-role backend.
• Authentication tokens are short-lived and refreshed via Supabase Auth.
• Database access is restricted by Row Level Security policies on every user-facing table.
• API keys and service-role credentials are stored in environment variables on Vercel and DigitalOcean and are never committed to source control or exposed to the extension client.
• Two-factor authentication is enforced for all Viewnot administrative accounts.

4.3 Retention

We retain your data as follows:

• Free plan: sale, show, and Spy data is retained for 7 days. Account data is retained for as long as the account exists.
• Spy and Seller plans: sale, show, and Spy data is retained indefinitely while your subscription is active, so you can access historical analytics.
• Whatnot session cookies in the cookie pool are overwritten approximately every two minutes and are automatically removed when you sign out, uninstall the extension, or delete your Viewnot account.
• Support tickets are retained for as long as needed to resolve the request, then archived.
• Diagnostic logs are retained for a maximum of 30 days.

When you delete your Viewnot account, all account, sale, show, Spy, cookie pool, and support data associated with your account is deleted within 30 days, except where retention is required by law (for example, tax-related billing records held by Stripe).

5. Your Rights and Choices

• Access: You can view all sale, show, buyer, and Spy data associated with your account from the Viewnot dashboard.
• Export: You can export your data in CSV format from the dashboard.
• Correction: You can edit your Whatnot username, label preferences, and account settings from the dashboard.
• Deletion: You can delete your account at any time from the dashboard settings, or by emailing [email protected]. Deletion is permanent and removes all data described in Section 4.3 within 30 days.
• Sign out / disconnect cookies: Signing out of the extension stops the cookie pool relay immediately and removes your most recent cookie row from the pool.
• Opt out of SMS: Reply STOP to any SMS message or disable SMS notifications in your dashboard settings.
• Residents of California, the EU, the UK, and other jurisdictions with applicable data-protection laws have additional rights including the right to know, the right to delete, the right to portability, and the right to non-discrimination. To exercise these rights, email [email protected].

6. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly. Whatnot itself requires users to be 18 or older to sell on the platform.

7. Cookies and Local Storage

The Viewnot dashboard (app.viewnot.com) uses first-party cookies and local storage solely to maintain your authenticated session. We do not use third-party tracking cookies, advertising cookies, or analytics cookies that identify individual users. The Viewnot Chrome extension uses chrome.storage.local to cache your Whatnot username, label preferences, printer name, and authentication tokens on your own device.

The extension's access to your Whatnot session cookies is performed via the Chrome cookies permission and is limited to whatnot.com cookies only. These cookies are used solely as described in Section 1.2.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our data practices, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through an in-product notice. Your continued use of the Service after a change constitutes acceptance of the updated Policy.

9. Contact

If you have questions, requests, or concerns about this Privacy Policy or our data practices, contact us at:

Viralux Media LLC
Email: [email protected]
Support: [email protected]