Privacy Policy — HS Code Finder

Last updated: 2026-07-03

HS Code Finder is a browser extension that helps importers find EU Combined Nomenclature (HS/CN) codes, estimate landed cost (duty + VAT), and flag anti-dumping measures. This page describes exactly what data the extension touches, where it goes, and what it never collects.

We keep data collection to the minimum needed to run the paid AI classification feature. The free local search and the duty/landed-cost calculator work entirely on your device.

Summary

No analytics, no telemetry, no third-party trackers, no ad IDs.
No browsing history, cookies, or page content — except the exact text you select and explicitly ask us to classify.
The only personal data we hold is the Google account (sub + email) of users who sign in to use the paid AI feature, plus their credit balance.
Sign-in and payment are opt-in. You can use search, the duty lookup, and the landed-cost calculator without an account.

What requires sign-in, and what doesn't

Feature	Account needed?	Leaves your device?
Code search (bundled CN snapshot)	No	No
Duty rate + anti-dumping lookup	No	No (data ships with the extension)
Landed-cost calculator	No	Only the daily ECB rates fetch (see below)
AI classification	Yes (Google sign-in)	Yes — selected text → our proxy → LLM

Data we collect (only for signed-in AI users)

When you sign in with Google to use AI classification:

Google account identifier (sub) and email address. We obtain these from the Google ID token issued during sign-in. We use the identifier as your account key and the email to (a) show which account is active and (b) associate purchased credits with you.
Credit balance and purchase records. How many AI classifications you have left, when your account was created/updated, and pending purchase order IDs.

This is stored server-side in a Cloudflare Workers KV namespace, keyed by your Google account identifier. We do not store your search queries, classified product text, or results on the server.

What leaves your browser, and when

1. Google sign-in

Signing in opens Google's standard OAuth consent screen (accounts.google.com). Google returns a signed ID token to the extension. The extension sends that token to our proxy with each paid request; our proxy verifies it with Google (oauth2.googleapis.com/tokeninfo) and reads the sub and email claims. We request only basic profile/email scope — no access to Gmail, Drive, contacts, or any other Google data.

2. AI classification — opt-in, per use

When you run an AI classification, the extension sends to our proxy (hs-helper-proxy.megabro-hs.workers.dev):

the product text you selected or typed,
a shortlist of candidate HS codes computed locally,
your Google ID token (for auth + to spend one credit).

Our proxy forwards the product text and candidates to an LLM provider (OpenRouter, routing to the configured model) to pick the best code. The proxy attaches our own LLM API key — yours is never involved.

We do not log or retain the product text or the result beyond the in-flight request. Cloudflare's standard operational metrics (request counts, status codes, latency) are not tied to your identity.
OpenRouter's data policy governs its leg of the call. See https://openrouter.ai/privacy.

3. Payments (crypto, opt-in)

If you buy more credits, the extension asks our proxy to create an invoice with our payment processor, NOWPayments (https://nowpayments.io), and opens their checkout. Payment details (wallet, transaction) are handled entirely by NOWPayments — we never see or store them. NOWPayments notifies our proxy when a payment completes so we can add credits to your account. We store only the order ID and the resulting credit balance.

4. Exchange rates (no personal data)

The Calculator fetches the daily reference rates XML from the European Central Bank (www.ecb.europa.eu). This is a plain GET with no identifiers, no selected text, and no account info. If it fails, the extension falls back to a rates snapshot bundled with the build and makes no network call.

What stays on your device

Favorites. Classifications and landed-cost calculations you save (the "★ Save" buttons) are stored in your browser's localStorage, scoped to the extension, along with the calculator's last-entered values and the last classification you ran. Never uploaded, never synced by us. You can delete any entry from the Favorites tab, or wipe everything via your browser's "Clear site data" for the extension.
Preferences. Your last-used origin/destination countries and a pending purchase order ID are kept in chrome.storage.local; a transient "which tab to open" hint is kept in chrome.storage.session. None of this leaves your device.
Duty & anti-dumping data. Ships inside the extension package and is read locally — no network call, nothing about your lookups leaves the device.

Permissions and why

Permission	Why
`identity`	Google sign-in for the paid AI feature (OAuth via `launchWebAuthFlow`)
`contextMenus`	The right-click "Classify with HS Code Finder" item on text you select
`storage`	Save favorites, preferences, and credit/order state locally
`host_permissions: www.ecb.europa.eu`	Daily exchange-rate fetch for the calculator
`host_permissions: hs-helper-proxy.megabro-hs.workers.dev`	Our AI-classification + licensing proxy

The extension runs no content scripts and asks for no broad host access to the pages you browse. The right-click classify reads only the text you have selected, and only when you click that menu item.

Data sharing

We do not sell or rent your data. Data is shared only with the processors strictly needed to run the service:

Google — verifies your sign-in token.
OpenRouter — receives product text to perform classification.
NOWPayments — processes payments.
Cloudflare — hosts the proxy and stores account/credit records.

Retention and deletion

Account and credit records persist while your account exists so your purchased credits remain available. To have your account and email deleted, contact us (below) and we will remove the google:<sub> record. On-device data (history, preferences) is removed when you uninstall the extension or clear its site data.

Children's privacy

HS Code Finder is a B2B tool not directed at children under 13. We do not knowingly process data from children.

Changes to this policy

Material changes will be noted by updating the "Last updated" date above. Continued use after a change constitutes acceptance.

Contact

Issues, questions, and data-deletion requests can be filed at the GitHub repository: https://github.com/BEPOHUKA-U3-KA3AXCTAHA/megabro-hs-code-helper/issues.

Disclaimer

HS Code Finder is an aid for finding candidate HS codes and estimating duty; it is not legal or customs-broker advice. Final classification and customs declarations are your responsibility — verify with a licenced customs broker or the official TARIC / Access2Markets databases before filing.