# Your data > Where buyer data lives, how you read and export it, and whether you can keep it in your own database. Toolaby is the record of who holds your tools. Your server does not need a copy to check access; when it wants one, it can have one. This page answers the questions a developer asks before trusting a service with customers. ## Can I use my own database? You do not need to. The extension checks entitlement with a signed token and no server of yours. Your server reads the same facts through the [API](https://toolaby.app/docs/reference/api.md), and hears of changes through [webhooks](https://toolaby.app/docs/reference/webhooks.md). You can keep a copy. [Sync customers](https://toolaby.app/docs/sync.md) loads a customers table from the API and keeps it current from webhooks. Toolaby stays the source of truth: a licence, subscription or grant exists because Toolaby says so, and the extension asks Toolaby, not your table. What you store beside the copy is yours: preferences, usage, your own product's data. Key it by the buyer's email, which Toolaby uses as the buyer's identity, or by `user_id` from the webhooks. ## What Toolaby stores | About | Stored | Not stored | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- | | A buyer | Email, name if they gave one, language, sign-in method, the Google account if connected | A password (sign-in is by link or Google) | | A licence | A SHA-256 hash of the key and its prefix, the plan, dates, status, the Stripe payment id, the buyer's email | The key itself | | A device | A device id, the public half of its key pair, the browser, first and last seen, the extension version it last reported, and the addresses it was seen from until it has been quiet for 90 days | Anything about the pages the person visits | | A subscription | Stripe's subscription id, status, period, plan | Card details, which stay with Stripe | | Free-plan use | A count per device. Where the tool requires an account, a count per inbox, kept as a keyed hash of the inbox, so a new account on the same inbox does not have the uses again. Throwaway and unverified addresses share one count per tool, which names no one and, where the tool counts uses in total, starts again each day (UTC) | The address | | A trial | A keyed hash of the inbox it was started from, so each inbox has one trial of a tool | The address | | A subscription moved from another Stripe account | A keyed hash of the inbox it was moved for, and when, so the period paid on the old account counts once for each inbox and tool | The address | | A move's record | The old and new subscription ids, the address and the account it was moved for, the plan and the outcome: the report you download | Card details | | Check-ins | A count a tool, a day and a build: how often copies asked for the tool's policy | Anything about the device or the person | | Analytics | For each device: the days it ran, its version, how often the paywall opened and for which feature, its first checkout and purchase, and the day it was removed. For each payment of a tool: the amount, the plan and what opened the paywall before it. See [Analytics](#analytics) | Names, email addresses, IP addresses; anything about the pages the person visits | | Support | Notes you write, refunds, grants, blocks | | Payment details never reach Toolaby. Stripe holds them on your account. ## Where it is | | Provider | Location | | --------------------------------- | ---------- | ----------------------------------------- | | Database | Supabase | Frankfurt | | Application | Vercel | Frankfurt | | Rate limits and replay protection | Upstash | Frankfurt | | Email | Amazon SES | Stockholm | | Webhook delivery | Svix | EU | | Payments | Stripe | Your Stripe account, under Stripe's terms | These are where buyer data is kept. The [privacy policy](/privacy) lists every sub-processor, the ones that handle mail sent to Toolaby among them. A change to the list is announced to workspace owners by email before it takes effect. ## Access * Buyers live in a pool per workspace. Another workspace cannot read them. * Members of your workspace see customers according to their [role](https://toolaby.app/docs/members.md). * Every table is protected by row-level security; card numbers never reach Toolaby. ## Retention | Data | Kept | | -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Accounts, licences, subscriptions, devices | While the account or the purchase exists, then as long as your legal obligations require: a purchase record outlives the licence | | Security and abuse records | No longer than twelve months | | Sign-in links, one-time tokens, device codes | Minutes; deleted when used or expired | | Check-ins (Versions → In use) | 35 days | | Analytics | Thirteen months | | Free-plan counts | Counted in total: while the tool exists. By the day, week or month: until the window ends. An inbox's count stays when the account is deleted | | An inbox's trial | Kept, so the inbox has one trial of the tool | | An inbox's moves | Kept, so a period paid on the old account counts once for each inbox and tool | | Webhook deliveries | On the endpoint under Configure → Webhooks, for Svix's retention period | | Support notes | With the customer | A deletion request is carried out within thirty days, keeping only what the law requires. ## Analytics [Analytics](https://toolaby.app/docs/analytics.md) counts, for each device of a tool whose counting is on, the days it ran, its version and its way to a purchase. A device is the id the extension signs its requests with; Analytics holds no name, email address or IP address beside it, and nothing about the pages the extension runs on. A tool's web app, on one of your own pages, is counted the same way for each signed-in buyer who uses it ([Web apps](https://toolaby.app/docs/analytics.md#web-apps)). The buyer is counted by a keyed hash of their account for the tool, which no one can turn back into the account without Toolaby's secret. Nothing is kept in their browser for it, and a visitor who is signed out is not counted. * **Counting is yours to turn on.** It is off for every tool until a member turns it on under the tool's **Configure → Settings → Analytics**. While it is off, a copy counts nothing and sends nothing beyond what its licence needs. Revenue is read from your Stripe account either way. * **The uninstall page.** When someone removes an extension, Chrome opens a page that asks why. Toolaby keeps the reason they pick and, where they write one, their note of up to 500 characters, with the device, its version and whether it was paying. Answering is optional. The page is set only while counting is on, and a developer can turn it off for a tool. * **Payments.** Each payment and refund of a tool is kept with its plan, its amount and, where the checkout was opened from the paywall, the device or the web app's buyer and what opened it. * **Retention.** Each day's counts, the payments and the answers: thirteen months. What is kept about a device: until it has not run the extension for thirteen months. Then deleted, and at once when the tool is deleted. * **Who sees it.** The members of the workspace, under **Analytics**, and its CSV files and API; your own server, for a paying buyer's removal (`device.uninstalled`). Toolaby counts none of this for a tool until a member of its workspace turns counting on for it. ### The Chrome Web Store's rules The Chrome Web Store's [program policies](https://developer.chrome.com/docs/webstore/program-policies/policies) say that extensions "may only collect, use, or transmit user data that is necessary for the extension's disclosed single purpose, including related operational purposes, such as maintaining, securing, or measuring the performance and reliability of those features". What an extension collects must be disclosed before it is installed, and "if an extension introduces different user data practices after installation, the extension must prominently disclose data practice changes". Google has enforced the stricter version of these rules since 1 August 2026. Whether counting fits your extension's purpose is yours to judge, which is why it waits for you to turn it on. Before you do, for a tool people already have: 1. Add the wording below to your privacy policy. 2. Declare the data in your item's **Privacy practices** tab in the Chrome Web Store's developer dashboard. 3. Tell the people who have it, for example in the release notes of the build that brings the client of 16 October 2026. ### Wording for your privacy policy > This extension uses Toolaby for its payments and licences. To see how the extension is used and what sells, Toolaby counts, for each device, by a random id the extension makes: the days it runs, its version, how often its upgrade screen opens and what opened it, the first checkout it opens and a purchase it makes. When the extension is removed, a page may ask why; answering is optional. No name, email address or IP address is kept with these counts, and nothing about the pages you visit. Each day's counts are kept for thirteen months, and what is kept about a device until it has not been used for thirteen months. See Toolaby's privacy policy at [https://toolaby.app/privacy](https://toolaby.app/privacy). For a web app, add: > When you use our web app signed in, Toolaby counts the same things for your account, by a keyed hash of it that names no one: the days you use the app, its version, how often its upgrade screen opens and what opened it, and the checkout and purchase that follow. Nothing is stored in your browser for this, and nothing is counted while you are signed out. ## The person's rights From a customer's page, **Download their data** gives everything Toolaby holds about a person as JSON, with what is kept for their inbox: its free uses of the tool, its trial and its moves (`inbox`); and what the tool's web app counted of their account, with the sales made from its paywall (`webApp`). **Erase their data** removes them: the account, its sign-ins, grants, trials and notes, and its link to a Stripe customer, are deleted, and so is what a web app counted of them in Analytics. Devices stay, without the addresses they were seen from, and the notes left on the uninstall page from those devices are deleted. Licences and payments are kept as records of the sale, with the email replaced by a keyed hash of it. The keyed hashes of their inbox stay too: a new account on it does not have the tool's trial or its free uses again. A subscription still running must be cancelled first. A buyer can delete their own account from their account page; see [Buyer pages](https://toolaby.app/docs/buyer-pages.md). ## Taking it with you **Configure → Export** downloads the whole workspace, signing keys included. See [Export](https://toolaby.app/docs/export-and-exit.md). ## Agreements Toolaby processes buyer data on your behalf under the [terms](/terms) and the [privacy policy](/privacy), which buyers reach from the foot of every page. A data processing agreement for your own records is available on request at [hello@toolaby.app](mailto:hello@toolaby.app).