Privacy Policy — HS Code Finder

Last updated: 2026-10-05

HS Code Finder helps importers find EU Combined Nomenclature (HS/CN) codes, estimate landed cost (duty + VAT), and flag anti-dumping measures. It comes as a browser extension, as a web app at megabro.pages.dev/hs-code-finder/app/, and as an Android app on Google Play (com.megabro.hscodefinder, published by ApricotJamStudio). This page describes exactly what data each of them touches, where it goes, and what it never collects. The extension is described in detail first; the web app and the Android app work the same way, and the section "Web app and Android app" lists the differences.

We keep data collection to the minimum needed to run the paid AI classification feature. The free local search and the duty/landed-cost calculator work entirely on your device.

Summary

No analytics, no telemetry, no third-party trackers, no ad IDs.
No browsing history, cookies, or page content — except the exact text you select and explicitly ask us to classify.
The only personal data we hold is the Google account (sub + email) of users who sign in to use the paid AI feature, plus their credit balance.
Sign-in and payment are opt-in. You can use search, the duty lookup, and the landed-cost calculator without an account.

What requires sign-in, and what doesn't

Feature	Account needed?	Leaves your device?
Code search (bundled CN snapshot)	No	No
Duty rate + anti-dumping lookup	No	No (data ships with the extension)
Landed-cost calculator	No	Only the daily ECB rates fetch (see below)
AI classification	Yes (Google sign-in)	Yes — selected text → our proxy → LLM

Data we collect (only for signed-in AI users)

When you sign in with Google to use AI classification:

Google account identifier (sub) and email address. We obtain these from the Google ID token issued during sign-in. We use the identifier as your account key and the email to (a) show which account is active and (b) associate purchased credits with you.
Credit balance and purchase records. How many AI classifications you have left, when your account was created/updated, and the identifiers of completed payments.

This is stored server-side in a Cloudflare Workers KV namespace, keyed by your Google account identifier. We do not store your search queries, classified product text, or results on the server.

What leaves your browser, and when

1. Google sign-in

Signing in opens Google's standard OAuth consent screen (accounts.google.com). Google returns a signed ID token to the extension. The extension sends that token to our proxy with each paid request; our proxy verifies it with Google (oauth2.googleapis.com/tokeninfo) and reads the sub and email claims. We request only basic profile/email scope — no access to Gmail, Drive, contacts, or any other Google data.

2. AI classification — opt-in, per use

When you run an AI classification, the extension sends to our proxy (hs-helper-proxy.megabro-hs.workers.dev):

the product text you selected or typed,
a shortlist of candidate HS codes computed locally,
your Google ID token (for auth + to spend one credit).

Our proxy forwards the product text and candidates to an LLM provider (OpenRouter, routing to the configured model) to pick the best code. The proxy attaches our own LLM API key — yours is never involved.

We do not log or retain the product text or the result beyond the in-flight request. Cloudflare's standard operational metrics (request counts, status codes, latency) are not tied to your identity.
OpenRouter's data policy governs its leg of the call. See https://openrouter.ai/privacy.

3. Payments (card, opt-in)

If you buy more credits, the extension opens our checkout page (megabro.pages.dev/hs-code-finder/) in a new tab. The only thing it carries across is your account identifier, so the purchase can be credited to the right account.

The payment itself runs on Paddle (https://www.paddle.com), which is our reseller and seller of record: Paddle takes the payment, charges the VAT and files it, and shows its own payment window. Card, Apple Pay and Google Pay details are entered in that window and are handled entirely by Paddle — we never see or store them. Paddle notifies our proxy when a payment completes so we can add credits to your account. From Paddle we keep only the transaction identifier and the resulting credit balance. Paddle's own privacy notice covers its side of the payment: https://www.paddle.com/legal/privacy.

4. Exchange rates (no personal data)

The Calculator fetches the daily reference rates XML from the European Central Bank (www.ecb.europa.eu). This is a plain GET with no identifiers, no selected text, and no account info. If it fails, the extension falls back to a rates snapshot bundled with the build and makes no network call.

What stays on your device

Favorites. Classifications and landed-cost calculations you save (the "★ Save" buttons) are stored in your browser's localStorage, scoped to the extension, along with the calculator's last-entered values and the last classification you ran. Never uploaded, never synced by us. You can delete any entry from the Favorites tab, or wipe everything via your browser's "Clear site data" for the extension.
Preferences. Your last-used origin/destination countries are kept in chrome.storage.local; a transient "which tab to open" hint is kept in chrome.storage.session. None of this leaves your device.
Duty & anti-dumping data. Ships inside the extension package and is read locally — no network call, nothing about your lookups leaves the device.

Web app and Android app

The web app is the same tool as a web page. The Android app opens that web page full-screen in your device's browser (a Trusted Web Activity); the app itself contains no code that collects data, no ads and no analytics. Both send and store the same data as the extension, with these differences:

Sign-in uses Google Identity Services on the page instead of the extension's OAuth window. The Google ID token is kept in the page's localStorage until shortly before it expires (about an hour), so a reload doesn't sign you out. "Sign out" removes it.
Favorites, preferences and the last calculation are kept in the page's localStorage on your device, never uploaded.
Duty & anti-dumping data and the code list are downloaded from megabro.pages.dev as plain data files and looked up on your device. These downloads carry no account information.
Exchange rates come from our proxy's /fx route, which relays the European Central Bank's daily reference rates. No identifiers are sent.
Payments. The Android app sells nothing and opens no payment page. Credits bought elsewhere show up in it after sign-in with the same Google account.
Your browser's own privacy policy (for example Chrome's) covers what the browser itself does while showing the page.

Permissions and why

Permission	Why
`identity`	Google sign-in for the paid AI feature (OAuth via `launchWebAuthFlow`)
`contextMenus`	The right-click "Classify with HS Code Finder" item on text you select
`storage`	Save favorites and preferences locally
`host_permissions: www.ecb.europa.eu`	Daily exchange-rate fetch for the calculator
`host_permissions: hs-helper-proxy.megabro-hs.workers.dev`	Our AI-classification + licensing proxy

The extension runs no content scripts and asks for no broad host access to the pages you browse. The right-click classify reads only the text you have selected, and only when you click that menu item.

Data sharing

We do not sell or rent your data. Data is shared only with the processors strictly needed to run the service:

Google — verifies your sign-in token.
OpenRouter — receives product text to perform classification.
Paddle — takes card payments as seller of record and handles VAT.
NOWPayments — takes crypto payments.
Cloudflare — hosts the proxy and the website, and stores account/credit records.

Retention and deletion

Account and credit records persist while your account exists so your purchased credits remain available.

Deleting your account. Email serzhserg98@gmail.com from the Google address you sign in with, subject "Delete my HS Code Finder account". We delete your account record (Google account identifier, email, credit balance and payment identifiers) within 30 days and confirm by email. Unused credits are lost. Payment records that Paddle or NOWPayments must keep by law stay with them. The steps are also at megabro.pages.dev/delete-account, linked from the app's footer.

On-device data (favorites, preferences) is removed when you uninstall the extension or clear the site data of megabro.pages.dev in your browser. For the Android app that is Settings → Apps → HS Code Finder → Storage → Manage space, which opens the browser's site settings.

Children's privacy

HS Code Finder is a B2B tool not directed at children under 13. We do not knowingly process data from children.

Changes to this policy

Material changes will be noted by updating the "Last updated" date above. Continued use after a change constitutes acceptance.

Contact

Questions and data-deletion requests: email serzhserg98@gmail.com.

Disclaimer

HS Code Finder is an aid for finding candidate HS codes and estimating duty; it is not legal or customs-broker advice. Final classification and customs declarations are your responsibility — verify with a licenced customs broker or the official TARIC / Access2Markets databases before filing.

← MegaBro Software