Privacy

The short version

• We store your workspace, your catalog and costs, the contents of the reports you upload, and buyer usernames with state and country when your own report includes them.
• Stream recording stores other people. On any show that gets recorded we keep the host's handle, the audience count each minute, every chat line with the handle that wrote it, and each lot with its price and the handle that won it. On someone else's show those are people who have not been asked and have not been told. It is the part of this page worth reading twice.
• We never write street addresses, buyer email addresses or buyer phone numbers into the database. The report file you upload is kept exactly as you uploaded it in private storage, so whatever your own export contained is still in that file.
• We never store your Whatnot password, session cookie or refresh token. Our worker watches shows from its own browser signed in to its own Whatnot account, never yours.
• Your rows live in Supabase in the United States, and row-level security scopes every row to one workspace.
• You can export your workspace or delete most of it from Settings. Two things have no button yet, and they are named further down rather than left for you to discover.

What we store

Your account

Your email address, the display name you choose, when you last signed in, and which workspaces you belong to and in what role.

Your workspace

Workspace name, currency, timezone, primary category, the members you invite and their roles, and your plan and billing status.

Catalog and costs you enter

Items, lots and purchase costs, supplies, templates, show plans, notes and tags — everything you type into Whatnot Metrics yourself.

The contents of reports you upload

Every row of the Show Report and Weekly Orders Report you download from your own Whatnot Seller Hub: order ids, item titles, sale prices, fees, refunds, shipping charges and payout totals. We also keep the file itself, byte for byte as you uploaded it, so an import can be re-run or corrected and so you can see where a number came from. That file is not filtered the way the rows are — see the first item under What we never store.

Recordings of live shows

When a show is recorded — by the extension on a page you have open, or by our worker on a seller you added to your research list — we store the show's title and category, the host's handle, the audience count each minute, every chat line the page displayed with the handle that wrote it, a per-handle tally of how much each person chatted, and each lot with its title, price, closing time and the handle that won it. On your own show those winners are your buyers. On anyone else's they are third parties, and neither they nor the host has agreed to any of this.

Buyer records built from those reports

The buyer username, plus state and country when your own report includes them, and the order counts and totals we compute from your rows. Nothing else about a buyer, and nothing bought or enriched from anywhere else.

Operational records

Import history, browser-extension pairings and heartbeats, the permissions you switched on or off and when, and an audit trail of destructive actions. The audit trail keeps a before-and-after copy of any order row that is edited or deleted, which means it holds copies of report rows that a buyer wipe does not reach. There is no error-reporting or analytics service in the product today, so there are no error reports to keep.

What we never store

• Street addresses, buyer email addresses or buyer phone numbers, in the database. Any column whose heading looks like an address, an email address, a phone number or a postcode is dropped the moment your file is parsed — before the preview, before the row is stored — so no database column holds one. Two headings the filter deliberately does not drop, because they are not contact details and reports vary: a buyer name column and a city column survive into the stored rows if your export has them.
• Anyone else's Whatnot direct messages. Your own only if you switch the Inbox setting on, and then only the conversation list your inbox page draws while you are looking at it — never the inside of a conversation.
• Your Whatnot password, session cookie or any Whatnot token.
• Card numbers or bank details. There is no payment flow in the product today: billing is switched off, nothing charges you, and no payment processor receives anything. When billing is turned on, card details will go to that processor directly and this page will name it before it happens.
• Anything about another seller their public show page did not show us — their costs, their fees, their payouts, their own reports.

The first line is about the database, and it would be misleading to leave it there. The filter runs on the rows parsed out of your file, not on the file. The file itself is uploaded whole to a private storage bucket and kept until you delete the import, because an import you cannot re-run from the original is an import you cannot audit. So if the export you downloaded from Whatnot contained a shipping address, that address is in that stored file even though no column in the database holds it. Anyone who is a member of your workspace can download it, whatever their role. Deleting the import deletes the file with it, and deleting the workspace takes both.

The password-and-session line is a limit in the product, not a promise on a page. We never store your Whatnot password or your payment details, and we never store or relay your Whatnot session or refresh token to our servers — not to make one request on your behalf, not for a minute, not at all. You can check this yourself instead of believing it: open chrome://extensions, click Details, and read the permissions. The extension does not ask for Chrome’s “cookies” permission, and without it nothing we ship can reach your Whatnot login cookies — those are httpOnly, which puts them out of reach of the page-level access a content script has. Some tools in this category do request that permission and relay the whole cookie jar, refresh token included, to their own servers; it is how they read your inbox or your sold list while your browser is closed. We cannot, and that is what the direct-messages line above rests on. It is worth saying exactly rather than roundly, because an earlier version of this page said we never read your direct messages at all. Since the Inbox feature there is a switch, off until you find it and turn it on, that records the conversation list your own inbox page has already drawn — handles, dates and the one preview line each row shows — while that page is open in front of you. It opens no conversation and reads no message body. What has not changed is the part that was ever load-bearing: with no credential we cannot read your inbox when you are not looking at it, cannot read it from our servers, and cannot read anybody else’s at all.

What our servers do reach for is Whatnot’s own public browse feed, which is how the worker knows which shows are live. It never signs in as you: it runs a browser of its own, on a Whatnot account of ours, and your credentials are never involved in it. When it then watches a seller you put on your research list, what it records is the same set the extension records — the audience count, the lots that closed with their prices and the handle that won each one, and public chat with the handle that posted each line. Chat is sampled while it is watching rather than fetched as a complete history, because a show page only keeps the last stretch of chat on screen; the winners and the lot prices are not sampled, they are every lot it saw close.

Where it goes

Your data is stored in Supabase (Postgres) hosted in the United States. If you are outside the US, using Whatnot Metrics means your data is processed in the US.

Every tenant row carries a workspace_id, and Postgres row-level security policies scope every read and write to workspaces you are a member of. Queries in the app filter by workspace on top of that, so a bug in one layer is not enough to cross workspaces. Traffic is encrypted in transit and data is encrypted at rest. A small number of Whatnot Metrics staff can reach production for support and incident response; that access is logged.

We do not sell your data, and we do not share it with advertisers or data brokers.

Sub-processors

These are the companies that process data on our behalf. We update this list before adding a new one.

Two, and that is the entire list. There is no error-reporting service, no product-analytics service, no email provider and no AI provider behind Whatnot Metrics today — not switched off, not present. Settings shows switches for AI drafting, product analytics and product email because the consent machinery was built before the features were; turning one on sends nothing anywhere, because there is nowhere for it to go. This page named five other companies until we checked, and naming a processor that receives nothing is not caution: it tells you your data goes somewhere it does not, and it makes the two entries that matter harder to see.

How long we keep it

These are the windows the product runs to, and they are enforced by a job that runs every night. Say plainly what that job is: it is new. For most of this product’s life nothing expired on a timer at all, and the schedules that were supposed to enforce these windows were written into the schema and left switched off. If your workspace holds rows older than the windows below, they are being removed by the first passes of that sweep rather than having gone already.

• Workspace data — catalog, shows, orders, imports, buyer records — is kept while your workspace exists, because the point of the product is a running history you can compare against.
• The row-by-row copy an import makes of your report is kept for 90 days and then removed. The orders and line items it produced stay; it is the intermediate copy that goes.
• The report file itself is kept while its import exists, so the import can be re-run or audited. Delete the import and the file goes with it.
• The raw record of what a paired browser sent — kept so a figure in your ledger can be traced back to the observation that produced it — is removed 180 days after it has been processed.
• A pairing request that expired without being used is removed a day later.
• Stream recordings are split. What the recording says about a business — the show, its audience curve, its lots, their prices — is kept while your workspace exists. What it says about a person is not: chat lines and the handles that wrote them, the per-handle chat tallies, and the handle recorded as winning a lot are removed 90 days after the show. The host's handle stays while that seller is on your research list and goes when you remove them.
• Buyer records can be wiped in one action without touching your orders or financial totals; the orders simply stop naming a buyer.
• The audit trail of destructive actions is kept for the life of the workspace and is not swept, because its whole purpose is to answer a question about something that was deleted. Be aware of what that means: it holds before-and-after copies of any order row that was edited or deleted, a buyer wipe does not reach those copies, and owners and admins can read and export them.

Exporting or deleting your data

You do not need to email us or wait for us. Everything is a button in Settings → Privacy & data:

• Export a machine-readable copy of your workspace. Pressing the button queues the job rather than building the file in front of you, because a full workspace is too big for one request. A worker picks it up, writes a zip of CSV files — one per table your workspace holds — into private storage, and posts a notification on that same page when it is ready. You download it from there. The download link is signed and expires an hour after the page hands it to you, and the file itself is deleted after seven days, so take the download rather than saving the link.
• Delete every buyer record in the workspace. This removes the buyer profiles and every note written about them; your orders keep their rows and stop naming a buyer.
• Delete the whole workspace (owner only). Nothing is destroyed at once. Every member's permissions are suspended immediately, so nothing further can be written into it, and reads keep working on purpose so that you can still take an export while the clock runs. A paired browser is the exception and keeps sending until the end, because a device signs in as a device rather than as a member. Any owner can undo the whole thing from the same page. Thirty days after the stamp a scheduled job destroys the rows, and that includes the stored report files and the stream recordings.
• Turn each data permission on or off: report uploads, extension capture, buyer records, AI drafting, product analytics, product email. The last three govern features that do not exist yet.

Two things do not have a button, and you should hear it from us rather than find out. A recording of your own show is not attached to a research entry, so there is nothing to delete it from: it goes when its 90-day window reaches the handles in it, or when the workspace goes. And there is no way to erase one person — a single chatter, a single lot winner — from the recordings you hold. Both are gaps in the product, not positions we have taken.

If you are in a place with a statutory right of access, correction, portability or erasure, these controls are how you exercise it. If something you need is not covered by a button, ask us and we will do it by hand.

Cookies

We set a sign-in session cookie and a small cookie that remembers which workspace you last had open. That is all. No advertising cookies, no cross-site tracking pixels.

Changes and contact

If we change what we collect or add a sub-processor, we will update this page and, for anything material, tell you in the app. We say “in the app” rather than “in the app or by email” because there is no email provider behind Whatnot Metrics yet, so a notice in the product is the only channel that actually exists. Questions about your data: use the support link inside the app.