Privacy policy

Affiliate links and third-party networks

Some outbound Visit links are affiliate links. When you click one, the merchant or its affiliate network may set cookies or similar identifiers to record that the click came from StoreAtlas. Networks we may use, when a program is actually active, include Amazon Associates, Impact, and CJ. Those cookies are controlled by the merchant or the network, not by StoreAtlas. Their privacy policy applies after you leave this site.

We use Google Analytics 4 (measurement ID G-58YGD0XEJV) and Google Tag Manager (GTM-WNHNFNT6) on StoreAtlas. We do not send the contact email from “Recommend an official store” to GA4 as an event parameter.

The page also loads a Google AdSense script (ca-pub-7315233248269303) as of 5 October 2026. If that script is removed, delete this sentence in the same release. While the script is present, say so here.

Accounts and Google Sign-In

If you choose “Sign in with Google”, we receive only basic identity from Google (OpenID Connect scopes openid, email, and profile):

• Google account ID (sub) — a stable numeric ID so we can recognize the same account.
• Email address — to identify your account and to answer account requests you send us.
• Display name — shown on your account page.
• Profile photo URL — we store the URL only; we do not download or re-host the image.

We do not read your Gmail, contacts, Drive, Calendar, or other Google data. We never receive your Google password. Sign-in happens on Google’s pages.

How we use it

Sign-in and identity, and syncing the stores and comparison articles you save so they follow you across devices. We do not use this data for other purposes, except service emails about your account if we later offer them (we will say so then).

Cookies

• sa_session — login session. HttpOnly, Secure, SameSite=Lax. Scripts cannot read it. Valid for 30 days with sliding renewal (each visit extends it; after 30 days idle you must sign in again). Absolute maximum 180 days from login, even with continued use. Cleared on sign-out.
• sa_csrf — CSRF token for write actions (save, submit). No personal data. Set, renewed, and cleared with sa_session.

Both are necessary functional cookies. They are not used for ads or cross-site tracking.

Storage

Account and saved items live in Cloudflare D1. Traffic is HTTPS. Session tokens are stored server-side as hashes or signatures, not in cleartext.

Retention and deletion

Account data is kept while the account exists. You can delete your account any time from the account page (shipping with Google Sign-In) or by emailing editors@storeatlas.cc with subject “Account deletion request”, from the same Google email you use to sign in. After you delete, sessions end immediately. We permanently delete your Google sub, email, name, photo URL, and saved items within 30 days.

You can also revoke StoreAtlas in Google’s “Third-party apps and services”. After revoke you cannot sign in with Google here; ask us to delete stored data as above. Records we must keep by law stay only as long as required.

No sale; Limited Use

We do not sell, rent, or trade your personal information. We share it only with infrastructure providers that process data on our instructions (for example Cloudflare), or when the law requires it. Google Sign-In data is not used for ads, ad profiles, or personalized advertising, and is not given to ad networks. We use and transfer Google API data under the Google API Services User Data Policy, including Limited Use.

Anonymous tips and outbound click logs

Recommend-a-store and official-deal tips do not require login. Deal tips take an official URL plus one sentence — no contact field. Content goes to editors only. If you are signed in when you tip, the tip may link to your account. For abuse control we store a keyed one-way hash of the IP (key rotated monthly), not the raw IP; non-spam tip hashes clear after 90 days. Forms use Cloudflare Turnstile.

Affiliate and deal-card clicks may go through api.storeatlas.cc/v1/out/…. Each click log stores time, destination, related store, referring path, and UI language only — no IP, no cookie, no account link. Ordinary official Visit links that do not use that hop are counted only by site analytics (GA4) under this policy’s analytics section. Affiliate links are labeled next to the button; commission does not change ranking. We do not send your personal data to the merchant with the click.